@agent-native/core 0.47.1 → 0.48.2

package/dist/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GAInB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,uCAAuC,EACvC,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,6EAA6E;AAC7E,4EAA4E;AAC5E,yDAAyD;AACzD,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,CAAC;AAGF,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAc;IAInC,MAAM,CAAC,GAAG,KAAY,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,IAAI,GACR,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,IAAI,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,YAAY,GAAG,gBAAgB,CACnC,KAAK,EACL,4BAA4B,CAC7B,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,MAAM,GACV,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,UAAU;QAC3B,YAAY,KAAK,SAAS;QACxB,CAAC,CAAE,YAAyC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9E,MAAM,UAAU,GACd,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5E,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,KAAK,EACL,iCAAiC,CAClC,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,WAAW,GACf,iBAAiB,KAAK,GAAG;QACzB,iBAAiB,KAAK,MAAM;QAC5B,iBAAiB,KAAK,KAAK,CAAC;IAC9B,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;QACN,UAAU;QACV,UAAU;QACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,CACL,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,KAAK;YAClB,QAAQ,KAAK,OAAO;YACpB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,MAAc;IACrD,MAAM,GAAG,GAAI,KAAa,CAAC,GAA0B,CAAC;IAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAI,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAEhC,CAAC;QACd,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,KAAK,IAAI,IAAI;oBAAE,SAAS;gBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IAEjE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,QAAQ,oBAAoB,CAAC;IAE9D,qEAAqE;IACrE,yEAAyE;IACzE,oDAAoD;IACpD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAW3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GAAG,uCAAuC,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,gBAAgB,GAAG,MAAM;QAC7B,CAAC,CAAC,wBAAwB,MAAM,EAAE;QAClC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,MAAM;QACzB,CAAC,CAAC,GAAG,MAAM,oCAAoC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,kCAAkC,OAAO,6BAA6B;YACtE,uEAAuE;YACvE,mEAAmE;YACnE,gBAAgB,gBAAgB,KAAK;QACvC,CAAC,CAAC,wEAAwE;YACxE,aAAa,CAAC;IAClB,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,OAAO;QACP,YAAY,EAAE;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAc,EACd,MAAiB;IAIjB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,GAAG,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,2EAA2E;IAC3E,uDAAuD;IACvD,+DAA+D;IAC/D,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,KAAK,EACL,4BAA4B,CAC7B,CAAC;IACF,oEAAoE;IACpE,4DAA4D;IAC5D,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAChE,YAAY,EACV,iBAAiB,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC;QAClE,WAAW,EAAE,mBAAmB,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,8EAA8E;IAC9E,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzC,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CACpB,CAAC,CAAC,EAAsE,EAAE,CACxE,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,IAAI;YACT,CAA0B,CAAC,MAAM,KAAK,YAAY,CACtD,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CACX,8BAA8B,EAC9B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,eAAe,EACf,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC1E,GAAG,WAAW;QACd,WAAW,EAAE,UAAU,CAAC,WAAW,KAAK,IAAI;KAC7C,CAAC,CAAC;IAEH,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClD,2EAA2E;QAC3E,MAAM,EAAE,6BAA6B,EAAE,GACrC,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,GAAG,EAAE,IAAI,KAAK,4BAA4B;gBAAE,MAAM,GAAG,CAAC;YAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;gBACnB,OAAO,CAAC,GAAG,CACT,2EAA2E,CAC5E,CAAC;QACN,CAAC;QACD,8CAA8C;QAC7C,KAAa,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,uEAAuE;IACvE,qBAAqB;IACrB,MAAM,EAAE,wCAAwC,EAAE,GAChD,MAAM,MAAM,CAAC,+DAA+D,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,kBAAkB,EAAE,SAAS,EAAE,oCAAoC;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAC5C,UAAU,EACV,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,OAAO,gBAAgB,CAAC,KAAgB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACnB,OAAO,CAAC,GAAG,CACT,+BAA+B,WAAW,SAAS,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,CACvI,CAAC;AACN,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport {\n  defineEventHandler,\n  setResponseStatus,\n  setResponseHeader,\n  getMethod,\n  getRequestHeader,\n} from \"h3\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { isLoopbackRequest } from \"../server/auth.js\";\nimport { getConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n  type MCPConfig,\n  type MCPCallerIdentity,\n  type MCPRequestMeta,\n} from \"./build-server.js\";\nimport {\n  buildMcpOAuthChallenge,\n  getMcpOAuthIssuer,\n  getMcpOAuthProtectedResourceMetadataUrl,\n  getMcpOAuthResource,\n} from \"./oauth-route.js\";\n\n// Re-export the shared MCP server builder + types so the stdio transport and\n// any (future) external importer of `@agent-native/core/mcp` keep resolving\n// against `./server.js` exactly as before this refactor.\nexport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n};\nexport type { MCPConfig, MCPCallerIdentity, MCPRequestMeta };\n\n// ---------------------------------------------------------------------------\n// Runtime detection — Node fast-path vs. web-standard fallback\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the underlying Node `http` req/res pair if (and only if) we're\n * running on a real Node HTTP server (local dev, `node` Nitro preset). On the\n * web-standard runtime (Nitro 3 / Netlify web runtime, Cloudflare, Deno, Bun)\n * BOTH of these are undefined — that's the signal to take the web fallback\n * instead of returning 501.\n */\nfunction getNodeReqRes(event: H3Event): {\n  nodeReq: any | undefined;\n  nodeRes: any | undefined;\n} {\n  const e = event as any;\n  const nodeReq = e.node?.req ?? e.req?.runtime?.node?.req;\n  const nodeRes = e.node?.res ?? e.req?.runtime?.node?.res;\n  return { nodeReq, nodeRes };\n}\n\nfunction shouldUseNodeFastPath(event: H3Event): boolean {\n  if (process.env.AGENT_NATIVE_MCP_NODE_FAST_PATH !== \"1\") return false;\n  const { nodeReq, nodeRes } = getNodeReqRes(event);\n  return Boolean(nodeReq && nodeRes);\n}\n\n/**\n * Derive the request origin + the markdown deep-link target from the inbound\n * headers. Identical logic for both the Node and web paths so the absolute\n * deep-link URLs in tool results are computed the same way regardless of\n * runtime.\n */\nfunction deriveRequestMeta(event: H3Event): MCPRequestMeta {\n  const forwardedProto = getRequestHeader(event, \"x-forwarded-proto\");\n  const host =\n    getRequestHeader(event, \"x-forwarded-host\") ||\n    getRequestHeader(event, \"host\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (host && /^(localhost|127\\.0\\.0\\.1)(:|$)/.test(host) ? \"http\" : \"https\");\n  const origin = host ? `${proto}://${host}` : undefined;\n  const targetHeader = getRequestHeader(\n    event,\n    \"x-agent-native-open-target\",\n  )?.toLowerCase();\n  const target =\n    targetHeader === \"desktop\" ||\n    targetHeader === \"terminal\" ||\n    targetHeader === \"browser\"\n      ? (targetHeader as MCPRequestMeta[\"target\"])\n      : undefined;\n  const clientName = getRequestHeader(event, \"user-agent\")?.trim() || undefined;\n  const clientHint =\n    getRequestHeader(event, \"x-agent-native-mcp-client\")?.trim() || undefined;\n  const fullCatalogHeader = getRequestHeader(\n    event,\n    \"x-agent-native-mcp-full-catalog\",\n  )?.toLowerCase();\n  const fullCatalog =\n    fullCatalogHeader === \"1\" ||\n    fullCatalogHeader === \"true\" ||\n    fullCatalogHeader === \"yes\";\n  const basePath = getConfiguredAppBasePath();\n  return {\n    origin,\n    ...(basePath ? { basePath } : {}),\n    target,\n    clientName,\n    clientHint,\n    ...(fullCatalog ? { fullCatalog } : {}),\n  };\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    const hostname = new URL(origin).hostname;\n    return (\n      hostname === \"localhost\" ||\n      hostname === \"127.0.0.1\" ||\n      hostname === \"::1\" ||\n      hostname === \"[::1]\" ||\n      hostname.startsWith(\"127.\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Reconstruct a Web Standard `Request` for the web-standard MCP transport.\n *\n * On the web runtime h3 v2 exposes the real web `Request` as `event.req`; we\n * prefer it (its `method` / `headers` are exactly what the client sent). But\n * the framework middleware rewrites `event.req.url` when it strips a mount\n * prefix, and the transport reads `req.method` + `req.headers` (never the\n * body — we pass that via `parsedBody`), so we always synthesize a clean\n * `Request` with the verified method + a fresh `Headers` copy. The URL is\n * cosmetic for the SDK (it only does `new URL(req.url)` for `requestInfo`),\n * so a best-effort absolute URL derived from the inbound host is sufficient\n * and never throws.\n */\nfunction buildWebRequest(event: H3Event, method: string): Request {\n  const src = (event as any).req as Request | undefined;\n\n  const headers = new Headers();\n  if (src?.headers && typeof src.headers.forEach === \"function\") {\n    src.headers.forEach((value, key) => headers.set(key, value));\n  } else {\n    const rawHeaders = (event as any).node?.req?.headers as\n      | Record<string, string | string[] | undefined>\n      | undefined;\n    if (rawHeaders) {\n      for (const [key, value] of Object.entries(rawHeaders)) {\n        if (value == null) continue;\n        headers.set(key, Array.isArray(value) ? value.join(\", \") : value);\n      }\n    }\n  }\n\n  // The SDK requires Accept + Content-Type to advertise both JSON and SSE on\n  // a POST. Real MCP clients (Claude Code, `agent-native connect`) always\n  // send these; we never inject/alter them — if they're absent the SDK\n  // returns its spec-mandated 406/415, identical to the Node path.\n\n  const host =\n    headers.get(\"x-forwarded-host\") || headers.get(\"host\") || \"localhost\";\n  const forwardedProto = headers.get(\"x-forwarded-proto\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (/^(localhost|127\\.0\\.0\\.1)(:|$)/.test(host) ? \"http\" : \"https\");\n  const basePath = getConfiguredAppBasePath();\n  const url = `${proto}://${host}${basePath}/_agent-native/mcp`;\n\n  // No body here on purpose: the JSON-RPC payload is forwarded via the\n  // transport's `parsedBody` option (the same mechanism the Node transport\n  // uses), so the request stream is never read twice.\n  return new Request(url, { method, headers });\n}\n\n/**\n * Build an actionable JSON body for the 401 response. OAuth-capable clients\n * follow the `WWW-Authenticate` header automatically, but the JSON body is what\n * a human or a coding agent reads when a tool call comes back unauthorized — so\n * spell out the exact remediation: the `agent-native connect <url>` command and\n * the authorize/metadata URL. Keeping the legacy `error: \"Unauthorized\"` field\n * means existing clients that only check that field still work.\n */\nfunction buildUnauthorizedBody(event: H3Event): {\n  error: string;\n  message: string;\n  authenticate: {\n    command?: string;\n    firstTimeCommand?: string;\n    authorizeUrl?: string;\n    resourceMetadataUrl?: string;\n    mcpUrl?: string;\n  };\n} {\n  const issuer = getMcpOAuthIssuer(event);\n  const mcpUrl = getMcpOAuthResource(event);\n  const resourceMetadataUrl = getMcpOAuthProtectedResourceMetadataUrl(event);\n  const command = issuer ? `agent-native reconnect ${issuer}` : undefined;\n  const firstTimeCommand = issuer\n    ? `agent-native connect ${issuer}`\n    : undefined;\n  const authorizeUrl = issuer\n    ? `${issuer}/_agent-native/mcp/oauth/authorize`\n    : undefined;\n  const message = command\n    ? `Authentication required. Run \\`${command}\\` to re-authenticate this ` +\n      `MCP connector without reinstalling it (or, in an OAuth-capable host, ` +\n      `re-run /mcp and choose Authenticate), then retry. For first-time ` +\n      `setup, run \\`${firstTimeCommand}\\`.`\n    : \"Authentication required. Authenticate the MCP connector in your host, \" +\n      \"then retry.\";\n  return {\n    error: \"Unauthorized\",\n    message,\n    authenticate: {\n      ...(command ? { command } : {}),\n      ...(firstTimeCommand ? { firstTimeCommand } : {}),\n      ...(authorizeUrl ? { authorizeUrl } : {}),\n      ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}),\n      ...(mcpUrl ? { mcpUrl } : {}),\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// handleMcpRequest — runtime-agnostic MCP request handler\n// ---------------------------------------------------------------------------\n\n/**\n * Handle a single `{routePrefix}/mcp` request on either runtime.\n *\n * - **Default path:** build the SAME MCP `Server`\n *   from the SAME config + identity, drive it through the SDK's\n *   `WebStandardStreamableHTTPServerTransport` (which the Node transport is\n *   itself just a thin wrapper around), and return the resulting Web\n *   `Response` as a normal h3 return value. This is used for Nitro local dev\n *   too; the direct Node writer can otherwise race h3 and double-write.\n * - **Opt-in Node fast-path:** set `AGENT_NATIVE_MCP_NODE_FAST_PATH=1` to\n *   delegate directly to the SDK's `StreamableHTTPServerTransport`.\n *\n * Auth, the `runWithRequestContext` identity wrap, the deep-link `_meta` /\n * markdown append, `requestMeta` origin/target derivation and the stateless\n * semantics are IDENTICAL on both paths because both build the same server\n * via `createMCPServerForRequest` and both transports funnel into the same\n * `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {\n * parsedBody })` with the same options.\n *\n * Returns:\n *   - `undefined` when the request targets a sub-route (so management/status\n *     routes mounted under `/_agent-native/mcp/*` handle it themselves) — the\n *     h3 mount falls through to the next handler.\n *   - a Web `Response` (web fallback) or a string/object (Node path /\n *     auth-error path) otherwise. The Node path also sets `_handled` so h3\n *     doesn't double-write.\n */\nexport async function handleMcpRequest(\n  event: H3Event,\n  config: MCPConfig,\n): Promise<\n  Response | string | { error: string } | Record<string, unknown> | undefined\n> {\n  const pathname = event.url?.pathname || \"/\";\n  const subpath = pathname.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  if (subpath) {\n    // Let management/status routes mounted under /_agent-native/mcp/* handle\n    // their own requests instead of treating them as MCP protocol traffic.\n    return undefined;\n  }\n\n  const method = getMethod(event);\n\n  // Auth check — extracts the caller's identity from the JWT (`sub`), or, on\n  // the static-token / dev-open path, from the forwarded\n  // `X-Agent-Native-Owner-Email` hint the stdio proxy sends (the\n  // `agent-native mcp install` flow). Without this the install flow would run\n  // every tool unscoped (userEmail === undefined).\n  const authHeader = getRequestHeader(event, \"authorization\");\n  const ownerEmailHeader = getRequestHeader(\n    event,\n    \"x-agent-native-owner-email\",\n  );\n  // Gate header-only dev-open on the REAL socket peer, never a parsed\n  // `Host` header (client-controlled — an attacker could send\n  // `Host: localhost`). A deployed app missing A2A_SECRET / ACCESS_TOKEN\n  // must fail closed rather than trust a spoofable owner-email header that\n  // `fullSurface` would otherwise escalate to the full mutating surface.\n  const requestMeta = deriveRequestMeta(event);\n  const authResult = await verifyAuth(authHeader, ownerEmailHeader, {\n    allowDevOpen:\n      isLoopbackRequest(event) && isLoopbackOrigin(requestMeta.origin),\n    resourceUrl: getMcpOAuthResource(event),\n  });\n  if (!authResult.authed) {\n    setResponseStatus(event, 401);\n    setResponseHeader(event, \"WWW-Authenticate\", buildMcpOAuthChallenge(event));\n    return buildUnauthorizedBody(event);\n  }\n\n  // Stateless mode: only POST is meaningful. A stateless, per-request transport\n  // on serverless cannot keep the standalone GET SSE stream (server->client\n  // channel) alive across invocations — once the function returns and freezes,\n  // that stream dies and the client reports \"session expired\" / \"not\n  // connected\". The spec lets a server that offers no GET stream answer 405, so\n  // the client falls back to plain POST request/response. Reject GET here\n  // instead of letting the SDK open a doomed stream.\n  if (method === \"DELETE\") {\n    setResponseStatus(event, 204);\n    return \"\";\n  }\n\n  if (method !== \"POST\") {\n    setResponseStatus(event, 405);\n    return { error: \"Method not allowed\" };\n  }\n\n  // Read body for POST (GET has no body). Read it via the h3 helper exactly\n  // once; both transports accept it as a pre-parsed body so the request\n  // stream is never consumed twice.\n  const body = method === \"POST\" ? await readBody(event) : undefined;\n\n  // Optional diagnostics for host capability negotiation. Keep disabled by\n  // default because initialize payloads can include client-specific metadata.\n  if (process.env.MCP_DEBUG_INIT && body) {\n    const msgs = Array.isArray(body) ? body : [body];\n    const init = msgs.find(\n      (m): m is { params?: { capabilities?: unknown; clientInfo?: unknown } } =>\n        typeof m === \"object\" &&\n        m !== null &&\n        (m as { method?: unknown }).method === \"initialize\",\n    );\n    if (init) {\n      console.error(\n        \"[MCP_DEBUG_INIT] clientInfo=\",\n        JSON.stringify(init.params?.clientInfo),\n        \"capabilities=\",\n        JSON.stringify(init.params?.capabilities),\n      );\n    }\n  }\n\n  // Per-request stateless transport + server. Both runtimes build the SAME\n  // server from the SAME config + verified identity + request meta, so\n  // tools/list, tools/call, and the deep-link `_meta` are identical. A\n  // connected real caller (connect-minted token / `mcp install` /\n  // ACCESS_TOKEN / production) gets the full action surface even in local\n  // dev; unauthenticated dev probes stay sparse. See `external-agents` skill.\n  const server = await createMCPServerForRequest(config, authResult.identity, {\n    ...requestMeta,\n    fullSurface: authResult.fullSurface === true,\n  });\n\n  if (shouldUseNodeFastPath(event)) {\n    const { nodeReq, nodeRes } = getNodeReqRes(event);\n    // ---- Opt-in Node fast-path ---------------------------------------------\n    const { StreamableHTTPServerTransport } =\n      await import(\"@modelcontextprotocol/sdk/server/streamableHttp.js\");\n    const transport = new StreamableHTTPServerTransport({\n      sessionIdGenerator: undefined, // stateless\n      // Return JSON request/response instead of SSE. A stateless serverless\n      // instance can freeze right after returning a streaming Response, before\n      // the deferred SSE result event is flushed — the client then never gets\n      // the tools/call result and reports \"session expired\". JSON mode awaits\n      // the result inside the request lifecycle and returns it as one body.\n      enableJsonResponse: true,\n    });\n    await server.connect(transport);\n    try {\n      // The SDK transport writes directly to the Node response. Node-only by\n      // construction; we only reach here when real Node req/res exist.\n      await transport.handleRequest(nodeReq, nodeRes, body);\n    } catch (err: any) {\n      // The SDK transport writes directly to the Node response. If the socket\n      // is already closed/ended (client disconnected, or the host stream\n      // layer also flushed), Node throws ERR_STREAM_WRITE_AFTER_END *after*\n      // the MCP payload was already delivered correctly. Swallow that benign\n      // post-flush write so an external agent disconnecting mid-stream can\n      // never take down the server process; rethrow anything else.\n      if (err?.code !== \"ERR_STREAM_WRITE_AFTER_END\") throw err;\n      if (process.env.DEBUG)\n        console.log(\n          \"[mcp] ignored post-flush ERR_STREAM_WRITE_AFTER_END (client disconnected)\",\n        );\n    }\n    // Prevent H3 from double-writing the response\n    (event as any)._handled = true;\n    return undefined;\n  }\n\n  // ---- Web-standard response path (Nitro local dev, Netlify web runtime, CF,\n  // Deno, Bun) ---------------------------------------------------------------\n  //\n  // `StreamableHTTPServerTransport` is itself just a thin wrapper that\n  // converts the Node req/res to a web Request/Response and delegates to\n  // `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {\n  // parsedBody })`. Using the web transport directly with the SAME options +\n  // the same pre-read `parsedBody` produces byte-identical protocol output\n  // (including the deep-link `_meta` built inside createMCPServerForRequest),\n  // and works on every web runtime because it returns a Web `Response`\n  // (JSON for request/response, or an SSE `ReadableStream` body which h3\n  // streams natively).\n  const { WebStandardStreamableHTTPServerTransport } =\n    await import(\"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\");\n  const transport = new WebStandardStreamableHTTPServerTransport({\n    sessionIdGenerator: undefined, // stateless — same as the Node path\n    // JSON request/response (not SSE) — see the Node fast-path note above.\n    // This is the serverless-safe framing: the result is computed and returned\n    // within the request, never pushed onto a stream after the instance froze.\n    enableJsonResponse: true,\n  });\n  await server.connect(transport);\n  const webRequest = buildWebRequest(event, method);\n  // `parsedBody: undefined` would make the SDK try to read `req.json()`; our\n  // synthesized request has no body, so only pass the option for POST (where\n  // we actually have a parsed body). For GET the transport reads no body.\n  const response = await transport.handleRequest(\n    webRequest,\n    method === \"POST\" ? { parsedBody: body } : undefined,\n  );\n  return response;\n}\n\n// ---------------------------------------------------------------------------\n// mountMCP — register MCP Streamable HTTP endpoint on H3/Nitro\n// ---------------------------------------------------------------------------\n\n/**\n * Mount an MCP remote server on an H3/Nitro app.\n *\n * Endpoint: `{routePrefix}/mcp` (default `/_agent-native/mcp`)\n *\n * Uses stateless Streamable HTTP transport — no in-memory sessions, JSON\n * request/response (no SSE), and no standalone GET stream, so it survives\n * serverless instances that freeze between invocations (SSE framing there\n * drops the result and clients report \"session expired\"). Runtime-agnostic: a real Node\n * server uses the SDK's Node transport; the web-standard runtime (Nitro 3 /\n * Netlify web runtime, Cloudflare, Deno, Bun) uses the SDK's web-standard\n * transport. Both build the same server and produce identical JSON-RPC\n * output.\n *\n * Auth: Bearer token matching ACCESS_TOKEN/ACCESS_TOKENS or JWT via A2A_SECRET.\n * No auth required when neither is configured (dev mode).\n */\nexport function mountMCP(\n  nitroApp: any,\n  config: MCPConfig,\n  routePrefix = \"/_agent-native\",\n): void {\n  getH3App(nitroApp).use(\n    `${routePrefix}/mcp`,\n    defineEventHandler(async (event) => {\n      return handleMcpRequest(event as H3Event, config);\n    }),\n  );\n\n  if (process.env.DEBUG)\n    console.log(\n      `[mcp] Mounted MCP server at ${routePrefix}/mcp (${Object.keys(config.actions).length} tools${config.askAgent ? \" + ask-agent\" : \"\"})`,\n    );\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GAInB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,uCAAuC,EACvC,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,6EAA6E;AAC7E,4EAA4E;AAC5E,yDAAyD;AACzD,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,CAAC;AAGF,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAc;IAInC,MAAM,CAAC,GAAG,KAAY,CAAC;IACvB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;IACzD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACpE,MAAM,IAAI,GACR,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QAC3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,IAAI,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,YAAY,GAAG,gBAAgB,CACnC,KAAK,EACL,4BAA4B,CAC7B,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,MAAM,GACV,YAAY,KAAK,SAAS;QAC1B,YAAY,KAAK,UAAU;QAC3B,YAAY,KAAK,SAAS;QACxB,CAAC,CAAE,YAAyC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9E,MAAM,UAAU,GACd,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC5E,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,KAAK,EACL,iCAAiC,CAClC,EAAE,WAAW,EAAE,CAAC;IACjB,MAAM,WAAW,GACf,iBAAiB,KAAK,GAAG;QACzB,iBAAiB,KAAK,MAAM;QAC5B,iBAAiB,KAAK,KAAK,CAAC;IAC9B,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,OAAO;QACL,MAAM;QACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM;QACN,UAAU;QACV,UAAU;QACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,CACL,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,KAAK;YAClB,QAAQ,KAAK,OAAO;YACpB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,KAAc,EAAE,MAAc;IACrD,MAAM,GAAG,GAAI,KAAa,CAAC,GAA0B,CAAC;IAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAI,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAEhC,CAAC;QACd,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,IAAI,KAAK,IAAI,IAAI;oBAAE,SAAS;gBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IAEjE,MAAM,IAAI,GACR,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IACxE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,KAAK,GACT,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;QACrC,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,IAAI,GAAG,QAAQ,oBAAoB,CAAC;IAE9D,qEAAqE;IACrE,yEAAyE;IACzE,oDAAoD;IACpD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAW3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,mBAAmB,GAAG,uCAAuC,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,gBAAgB,GAAG,MAAM;QAC7B,CAAC,CAAC,wBAAwB,MAAM,EAAE;QAClC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,YAAY,GAAG,MAAM;QACzB,CAAC,CAAC,GAAG,MAAM,oCAAoC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,kCAAkC,OAAO,6BAA6B;YACtE,uEAAuE;YACvE,mEAAmE;YACnE,gBAAgB,gBAAgB,KAAK;QACvC,CAAC,CAAC,wEAAwE;YACxE,aAAa,CAAC;IAClB,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,OAAO;QACP,YAAY,EAAE;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAc,EACd,MAAiB;IAIjB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,GAAG,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAEhC,2EAA2E;IAC3E,uDAAuD;IACvD,+DAA+D;IAC/D,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,gBAAgB,CACvC,KAAK,EACL,4BAA4B,CAC7B,CAAC;IACF,oEAAoE;IACpE,4DAA4D;IAC5D,uEAAuE;IACvE,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,gBAAgB,EAAE;QAChE,YAAY,EACV,iBAAiB,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC;QAClE,WAAW,EAAE,mBAAmB,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE,8EAA8E;IAC9E,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACzC,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,kCAAkC;IAClC,MAAM,IAAI,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CACpB,CAAC,CAAC,EAAsE,EAAE,CACxE,OAAO,CAAC,KAAK,QAAQ;YACrB,CAAC,KAAK,IAAI;YACT,CAA0B,CAAC,MAAM,KAAK,YAAY,CACtD,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,KAAK,CACX,8BAA8B,EAC9B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,eAAe,EACf,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC1E,GAAG,WAAW;QACd,WAAW,EAAE,UAAU,CAAC,WAAW,KAAK,IAAI;QAC5C,yEAAyE;QACzE,+DAA+D;QAC/D,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClD,2EAA2E;QAC3E,MAAM,EAAE,6BAA6B,EAAE,GACrC,MAAM,MAAM,CAAC,oDAAoD,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,wEAAwE;YACxE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,GAAG,EAAE,IAAI,KAAK,4BAA4B;gBAAE,MAAM,GAAG,CAAC;YAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;gBACnB,OAAO,CAAC,GAAG,CACT,2EAA2E,CAC5E,CAAC;QACN,CAAC;QACD,8CAA8C;QAC7C,KAAa,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,uEAAuE;IACvE,qBAAqB;IACrB,MAAM,EAAE,wCAAwC,EAAE,GAChD,MAAM,MAAM,CAAC,+DAA+D,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,kBAAkB,EAAE,SAAS,EAAE,oCAAoC;QACnE,uEAAuE;QACvE,2EAA2E;QAC3E,2EAA2E;QAC3E,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAC5C,UAAU,EACV,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CACrD,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,OAAO,gBAAgB,CAAC,KAAgB,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;QACnB,OAAO,CAAC,GAAG,CACT,+BAA+B,WAAW,SAAS,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,SAAS,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,CACvI,CAAC;AACN,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport {\n  defineEventHandler,\n  setResponseStatus,\n  setResponseHeader,\n  getMethod,\n  getRequestHeader,\n} from \"h3\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { isLoopbackRequest } from \"../server/auth.js\";\nimport { getConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n  type MCPConfig,\n  type MCPCallerIdentity,\n  type MCPRequestMeta,\n} from \"./build-server.js\";\nimport {\n  buildMcpOAuthChallenge,\n  getMcpOAuthIssuer,\n  getMcpOAuthProtectedResourceMetadataUrl,\n  getMcpOAuthResource,\n} from \"./oauth-route.js\";\n\n// Re-export the shared MCP server builder + types so the stdio transport and\n// any (future) external importer of `@agent-native/core/mcp` keep resolving\n// against `./server.js` exactly as before this refactor.\nexport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n};\nexport type { MCPConfig, MCPCallerIdentity, MCPRequestMeta };\n\n// ---------------------------------------------------------------------------\n// Runtime detection — Node fast-path vs. web-standard fallback\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the underlying Node `http` req/res pair if (and only if) we're\n * running on a real Node HTTP server (local dev, `node` Nitro preset). On the\n * web-standard runtime (Nitro 3 / Netlify web runtime, Cloudflare, Deno, Bun)\n * BOTH of these are undefined — that's the signal to take the web fallback\n * instead of returning 501.\n */\nfunction getNodeReqRes(event: H3Event): {\n  nodeReq: any | undefined;\n  nodeRes: any | undefined;\n} {\n  const e = event as any;\n  const nodeReq = e.node?.req ?? e.req?.runtime?.node?.req;\n  const nodeRes = e.node?.res ?? e.req?.runtime?.node?.res;\n  return { nodeReq, nodeRes };\n}\n\nfunction shouldUseNodeFastPath(event: H3Event): boolean {\n  if (process.env.AGENT_NATIVE_MCP_NODE_FAST_PATH !== \"1\") return false;\n  const { nodeReq, nodeRes } = getNodeReqRes(event);\n  return Boolean(nodeReq && nodeRes);\n}\n\n/**\n * Derive the request origin + the markdown deep-link target from the inbound\n * headers. Identical logic for both the Node and web paths so the absolute\n * deep-link URLs in tool results are computed the same way regardless of\n * runtime.\n */\nfunction deriveRequestMeta(event: H3Event): MCPRequestMeta {\n  const forwardedProto = getRequestHeader(event, \"x-forwarded-proto\");\n  const host =\n    getRequestHeader(event, \"x-forwarded-host\") ||\n    getRequestHeader(event, \"host\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (host && /^(localhost|127\\.0\\.0\\.1)(:|$)/.test(host) ? \"http\" : \"https\");\n  const origin = host ? `${proto}://${host}` : undefined;\n  const targetHeader = getRequestHeader(\n    event,\n    \"x-agent-native-open-target\",\n  )?.toLowerCase();\n  const target =\n    targetHeader === \"desktop\" ||\n    targetHeader === \"terminal\" ||\n    targetHeader === \"browser\"\n      ? (targetHeader as MCPRequestMeta[\"target\"])\n      : undefined;\n  const clientName = getRequestHeader(event, \"user-agent\")?.trim() || undefined;\n  const clientHint =\n    getRequestHeader(event, \"x-agent-native-mcp-client\")?.trim() || undefined;\n  const fullCatalogHeader = getRequestHeader(\n    event,\n    \"x-agent-native-mcp-full-catalog\",\n  )?.toLowerCase();\n  const fullCatalog =\n    fullCatalogHeader === \"1\" ||\n    fullCatalogHeader === \"true\" ||\n    fullCatalogHeader === \"yes\";\n  const basePath = getConfiguredAppBasePath();\n  return {\n    origin,\n    ...(basePath ? { basePath } : {}),\n    target,\n    clientName,\n    clientHint,\n    ...(fullCatalog ? { fullCatalog } : {}),\n  };\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    const hostname = new URL(origin).hostname;\n    return (\n      hostname === \"localhost\" ||\n      hostname === \"127.0.0.1\" ||\n      hostname === \"::1\" ||\n      hostname === \"[::1]\" ||\n      hostname.startsWith(\"127.\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Reconstruct a Web Standard `Request` for the web-standard MCP transport.\n *\n * On the web runtime h3 v2 exposes the real web `Request` as `event.req`; we\n * prefer it (its `method` / `headers` are exactly what the client sent). But\n * the framework middleware rewrites `event.req.url` when it strips a mount\n * prefix, and the transport reads `req.method` + `req.headers` (never the\n * body — we pass that via `parsedBody`), so we always synthesize a clean\n * `Request` with the verified method + a fresh `Headers` copy. The URL is\n * cosmetic for the SDK (it only does `new URL(req.url)` for `requestInfo`),\n * so a best-effort absolute URL derived from the inbound host is sufficient\n * and never throws.\n */\nfunction buildWebRequest(event: H3Event, method: string): Request {\n  const src = (event as any).req as Request | undefined;\n\n  const headers = new Headers();\n  if (src?.headers && typeof src.headers.forEach === \"function\") {\n    src.headers.forEach((value, key) => headers.set(key, value));\n  } else {\n    const rawHeaders = (event as any).node?.req?.headers as\n      | Record<string, string | string[] | undefined>\n      | undefined;\n    if (rawHeaders) {\n      for (const [key, value] of Object.entries(rawHeaders)) {\n        if (value == null) continue;\n        headers.set(key, Array.isArray(value) ? value.join(\", \") : value);\n      }\n    }\n  }\n\n  // The SDK requires Accept + Content-Type to advertise both JSON and SSE on\n  // a POST. Real MCP clients (Claude Code, `agent-native connect`) always\n  // send these; we never inject/alter them — if they're absent the SDK\n  // returns its spec-mandated 406/415, identical to the Node path.\n\n  const host =\n    headers.get(\"x-forwarded-host\") || headers.get(\"host\") || \"localhost\";\n  const forwardedProto = headers.get(\"x-forwarded-proto\");\n  const proto =\n    forwardedProto?.split(\",\")[0]?.trim() ||\n    (/^(localhost|127\\.0\\.0\\.1)(:|$)/.test(host) ? \"http\" : \"https\");\n  const basePath = getConfiguredAppBasePath();\n  const url = `${proto}://${host}${basePath}/_agent-native/mcp`;\n\n  // No body here on purpose: the JSON-RPC payload is forwarded via the\n  // transport's `parsedBody` option (the same mechanism the Node transport\n  // uses), so the request stream is never read twice.\n  return new Request(url, { method, headers });\n}\n\n/**\n * Build an actionable JSON body for the 401 response. OAuth-capable clients\n * follow the `WWW-Authenticate` header automatically, but the JSON body is what\n * a human or a coding agent reads when a tool call comes back unauthorized — so\n * spell out the exact remediation: the `agent-native connect <url>` command and\n * the authorize/metadata URL. Keeping the legacy `error: \"Unauthorized\"` field\n * means existing clients that only check that field still work.\n */\nfunction buildUnauthorizedBody(event: H3Event): {\n  error: string;\n  message: string;\n  authenticate: {\n    command?: string;\n    firstTimeCommand?: string;\n    authorizeUrl?: string;\n    resourceMetadataUrl?: string;\n    mcpUrl?: string;\n  };\n} {\n  const issuer = getMcpOAuthIssuer(event);\n  const mcpUrl = getMcpOAuthResource(event);\n  const resourceMetadataUrl = getMcpOAuthProtectedResourceMetadataUrl(event);\n  const command = issuer ? `agent-native reconnect ${issuer}` : undefined;\n  const firstTimeCommand = issuer\n    ? `agent-native connect ${issuer}`\n    : undefined;\n  const authorizeUrl = issuer\n    ? `${issuer}/_agent-native/mcp/oauth/authorize`\n    : undefined;\n  const message = command\n    ? `Authentication required. Run \\`${command}\\` to re-authenticate this ` +\n      `MCP connector without reinstalling it (or, in an OAuth-capable host, ` +\n      `re-run /mcp and choose Authenticate), then retry. For first-time ` +\n      `setup, run \\`${firstTimeCommand}\\`.`\n    : \"Authentication required. Authenticate the MCP connector in your host, \" +\n      \"then retry.\";\n  return {\n    error: \"Unauthorized\",\n    message,\n    authenticate: {\n      ...(command ? { command } : {}),\n      ...(firstTimeCommand ? { firstTimeCommand } : {}),\n      ...(authorizeUrl ? { authorizeUrl } : {}),\n      ...(resourceMetadataUrl ? { resourceMetadataUrl } : {}),\n      ...(mcpUrl ? { mcpUrl } : {}),\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// handleMcpRequest — runtime-agnostic MCP request handler\n// ---------------------------------------------------------------------------\n\n/**\n * Handle a single `{routePrefix}/mcp` request on either runtime.\n *\n * - **Default path:** build the SAME MCP `Server`\n *   from the SAME config + identity, drive it through the SDK's\n *   `WebStandardStreamableHTTPServerTransport` (which the Node transport is\n *   itself just a thin wrapper around), and return the resulting Web\n *   `Response` as a normal h3 return value. This is used for Nitro local dev\n *   too; the direct Node writer can otherwise race h3 and double-write.\n * - **Opt-in Node fast-path:** set `AGENT_NATIVE_MCP_NODE_FAST_PATH=1` to\n *   delegate directly to the SDK's `StreamableHTTPServerTransport`.\n *\n * Auth, the `runWithRequestContext` identity wrap, the deep-link `_meta` /\n * markdown append, `requestMeta` origin/target derivation and the stateless\n * semantics are IDENTICAL on both paths because both build the same server\n * via `createMCPServerForRequest` and both transports funnel into the same\n * `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {\n * parsedBody })` with the same options.\n *\n * Returns:\n *   - `undefined` when the request targets a sub-route (so management/status\n *     routes mounted under `/_agent-native/mcp/*` handle it themselves) — the\n *     h3 mount falls through to the next handler.\n *   - a Web `Response` (web fallback) or a string/object (Node path /\n *     auth-error path) otherwise. The Node path also sets `_handled` so h3\n *     doesn't double-write.\n */\nexport async function handleMcpRequest(\n  event: H3Event,\n  config: MCPConfig,\n): Promise<\n  Response | string | { error: string } | Record<string, unknown> | undefined\n> {\n  const pathname = event.url?.pathname || \"/\";\n  const subpath = pathname.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  if (subpath) {\n    // Let management/status routes mounted under /_agent-native/mcp/* handle\n    // their own requests instead of treating them as MCP protocol traffic.\n    return undefined;\n  }\n\n  const method = getMethod(event);\n\n  // Auth check — extracts the caller's identity from the JWT (`sub`), or, on\n  // the static-token / dev-open path, from the forwarded\n  // `X-Agent-Native-Owner-Email` hint the stdio proxy sends (the\n  // `agent-native mcp install` flow). Without this the install flow would run\n  // every tool unscoped (userEmail === undefined).\n  const authHeader = getRequestHeader(event, \"authorization\");\n  const ownerEmailHeader = getRequestHeader(\n    event,\n    \"x-agent-native-owner-email\",\n  );\n  // Gate header-only dev-open on the REAL socket peer, never a parsed\n  // `Host` header (client-controlled — an attacker could send\n  // `Host: localhost`). A deployed app missing A2A_SECRET / ACCESS_TOKEN\n  // must fail closed rather than trust a spoofable owner-email header that\n  // `fullSurface` would otherwise escalate to the full mutating surface.\n  const requestMeta = deriveRequestMeta(event);\n  const authResult = await verifyAuth(authHeader, ownerEmailHeader, {\n    allowDevOpen:\n      isLoopbackRequest(event) && isLoopbackOrigin(requestMeta.origin),\n    resourceUrl: getMcpOAuthResource(event),\n  });\n  if (!authResult.authed) {\n    setResponseStatus(event, 401);\n    setResponseHeader(event, \"WWW-Authenticate\", buildMcpOAuthChallenge(event));\n    return buildUnauthorizedBody(event);\n  }\n\n  // Stateless mode: only POST is meaningful. A stateless, per-request transport\n  // on serverless cannot keep the standalone GET SSE stream (server->client\n  // channel) alive across invocations — once the function returns and freezes,\n  // that stream dies and the client reports \"session expired\" / \"not\n  // connected\". The spec lets a server that offers no GET stream answer 405, so\n  // the client falls back to plain POST request/response. Reject GET here\n  // instead of letting the SDK open a doomed stream.\n  if (method === \"DELETE\") {\n    setResponseStatus(event, 204);\n    return \"\";\n  }\n\n  if (method !== \"POST\") {\n    setResponseStatus(event, 405);\n    return { error: \"Method not allowed\" };\n  }\n\n  // Read body for POST (GET has no body). Read it via the h3 helper exactly\n  // once; both transports accept it as a pre-parsed body so the request\n  // stream is never consumed twice.\n  const body = method === \"POST\" ? await readBody(event) : undefined;\n\n  // Optional diagnostics for host capability negotiation. Keep disabled by\n  // default because initialize payloads can include client-specific metadata.\n  if (process.env.MCP_DEBUG_INIT && body) {\n    const msgs = Array.isArray(body) ? body : [body];\n    const init = msgs.find(\n      (m): m is { params?: { capabilities?: unknown; clientInfo?: unknown } } =>\n        typeof m === \"object\" &&\n        m !== null &&\n        (m as { method?: unknown }).method === \"initialize\",\n    );\n    if (init) {\n      console.error(\n        \"[MCP_DEBUG_INIT] clientInfo=\",\n        JSON.stringify(init.params?.clientInfo),\n        \"capabilities=\",\n        JSON.stringify(init.params?.capabilities),\n      );\n    }\n  }\n\n  // Per-request stateless transport + server. Both runtimes build the SAME\n  // server from the SAME config + verified identity + request meta, so\n  // tools/list, tools/call, and the deep-link `_meta` are identical. A\n  // connected real caller (connect-minted token / `mcp install` /\n  // ACCESS_TOKEN / production) gets the full action surface even in local\n  // dev; unauthenticated dev probes stay sparse. See `external-agents` skill.\n  const server = await createMCPServerForRequest(config, authResult.identity, {\n    ...requestMeta,\n    fullSurface: authResult.fullSurface === true,\n    // When the caller minted their token with --full-catalog (catalog_scope:\n    // \"full\" JWT claim), bypass the connector-catalog tier filter.\n    ...(authResult.fullCatalog === true ? { fullCatalog: true } : {}),\n  });\n\n  if (shouldUseNodeFastPath(event)) {\n    const { nodeReq, nodeRes } = getNodeReqRes(event);\n    // ---- Opt-in Node fast-path ---------------------------------------------\n    const { StreamableHTTPServerTransport } =\n      await import(\"@modelcontextprotocol/sdk/server/streamableHttp.js\");\n    const transport = new StreamableHTTPServerTransport({\n      sessionIdGenerator: undefined, // stateless\n      // Return JSON request/response instead of SSE. A stateless serverless\n      // instance can freeze right after returning a streaming Response, before\n      // the deferred SSE result event is flushed — the client then never gets\n      // the tools/call result and reports \"session expired\". JSON mode awaits\n      // the result inside the request lifecycle and returns it as one body.\n      enableJsonResponse: true,\n    });\n    await server.connect(transport);\n    try {\n      // The SDK transport writes directly to the Node response. Node-only by\n      // construction; we only reach here when real Node req/res exist.\n      await transport.handleRequest(nodeReq, nodeRes, body);\n    } catch (err: any) {\n      // The SDK transport writes directly to the Node response. If the socket\n      // is already closed/ended (client disconnected, or the host stream\n      // layer also flushed), Node throws ERR_STREAM_WRITE_AFTER_END *after*\n      // the MCP payload was already delivered correctly. Swallow that benign\n      // post-flush write so an external agent disconnecting mid-stream can\n      // never take down the server process; rethrow anything else.\n      if (err?.code !== \"ERR_STREAM_WRITE_AFTER_END\") throw err;\n      if (process.env.DEBUG)\n        console.log(\n          \"[mcp] ignored post-flush ERR_STREAM_WRITE_AFTER_END (client disconnected)\",\n        );\n    }\n    // Prevent H3 from double-writing the response\n    (event as any)._handled = true;\n    return undefined;\n  }\n\n  // ---- Web-standard response path (Nitro local dev, Netlify web runtime, CF,\n  // Deno, Bun) ---------------------------------------------------------------\n  //\n  // `StreamableHTTPServerTransport` is itself just a thin wrapper that\n  // converts the Node req/res to a web Request/Response and delegates to\n  // `WebStandardStreamableHTTPServerTransport.handleRequest(webRequest, {\n  // parsedBody })`. Using the web transport directly with the SAME options +\n  // the same pre-read `parsedBody` produces byte-identical protocol output\n  // (including the deep-link `_meta` built inside createMCPServerForRequest),\n  // and works on every web runtime because it returns a Web `Response`\n  // (JSON for request/response, or an SSE `ReadableStream` body which h3\n  // streams natively).\n  const { WebStandardStreamableHTTPServerTransport } =\n    await import(\"@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js\");\n  const transport = new WebStandardStreamableHTTPServerTransport({\n    sessionIdGenerator: undefined, // stateless — same as the Node path\n    // JSON request/response (not SSE) — see the Node fast-path note above.\n    // This is the serverless-safe framing: the result is computed and returned\n    // within the request, never pushed onto a stream after the instance froze.\n    enableJsonResponse: true,\n  });\n  await server.connect(transport);\n  const webRequest = buildWebRequest(event, method);\n  // `parsedBody: undefined` would make the SDK try to read `req.json()`; our\n  // synthesized request has no body, so only pass the option for POST (where\n  // we actually have a parsed body). For GET the transport reads no body.\n  const response = await transport.handleRequest(\n    webRequest,\n    method === \"POST\" ? { parsedBody: body } : undefined,\n  );\n  return response;\n}\n\n// ---------------------------------------------------------------------------\n// mountMCP — register MCP Streamable HTTP endpoint on H3/Nitro\n// ---------------------------------------------------------------------------\n\n/**\n * Mount an MCP remote server on an H3/Nitro app.\n *\n * Endpoint: `{routePrefix}/mcp` (default `/_agent-native/mcp`)\n *\n * Uses stateless Streamable HTTP transport — no in-memory sessions, JSON\n * request/response (no SSE), and no standalone GET stream, so it survives\n * serverless instances that freeze between invocations (SSE framing there\n * drops the result and clients report \"session expired\"). Runtime-agnostic: a real Node\n * server uses the SDK's Node transport; the web-standard runtime (Nitro 3 /\n * Netlify web runtime, Cloudflare, Deno, Bun) uses the SDK's web-standard\n * transport. Both build the same server and produce identical JSON-RPC\n * output.\n *\n * Auth: Bearer token matching ACCESS_TOKEN/ACCESS_TOKENS or JWT via A2A_SECRET.\n * No auth required when neither is configured (dev mode).\n */\nexport function mountMCP(\n  nitroApp: any,\n  config: MCPConfig,\n  routePrefix = \"/_agent-native\",\n): void {\n  getH3App(nitroApp).use(\n    `${routePrefix}/mcp`,\n    defineEventHandler(async (event) => {\n      return handleMcpRequest(event as H3Event, config);\n    }),\n  );\n\n  if (process.env.DEBUG)\n    console.log(\n      `[mcp] Mounted MCP server at ${routePrefix}/mcp (${Object.keys(config.actions).length} tools${config.askAgent ? \" + ask-agent\" : \"\"})`,\n    );\n}\n"]}

package/dist/mcp-client/routes.js

@@ -728,7 +728,7 @@ async function handleTestUrl(event) {
     }
     return { ok: true, toolCount: result.toolCount, tools: result.tools };
 }
-async function handleTestExisting(event, manager, id) {
+async function handleTestExisting(event, _manager, id) {
     const scope = getQuery(event).scope;
     const parsedScope = scope === "org" ? "org" : scope === "user" ? "user" : null;
     if (!parsedScope) {

package/dist/mcp-client/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,sEAAsE;AACtE,SAAS,aAAa,CACpB,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA6B,EAC7B,KAAqB,EACrB,OAAe,EACf,MAAoB;IAEpB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC;AAoCD,SAAS,SAAS,CAAC,OAAyB,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgC;IAEhC,OAAO;QACL,EAAE,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC9B,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,GAAG,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAqB,EACrB,UAAgC,EAChC,OAAe;IAEf,OAAO,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,KAA+C,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS;YACxE,oEAAoE;YACpE,gEAAgE;YAChE,sEAAsE;YACtE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,kCAAkC,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,iCAAiC,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,KAAK,GAA0B,IAAI,CAAC;YACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,GAAG,MAAM,CAAC;gBACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,KAAK,GAAG,KAAK,CAAC;gBACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAS;YACjC,MAAM,UAAU,GAAG,gCAAgC,CACjD,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,UAAU,CAAC;gBACtC,CAAC,CAAE,KAAa,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,EAAE,CACP,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChE,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;oBACzD,wBAAwB,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,qDAAqD,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CAC1G,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAwB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IAC3D,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAyB;IAEzB,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,IAAI,UAAU,IAAI,CAAC,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,IAAI,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAChC,gBAAgB,GAAG,aAAa,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC7D,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAc;IAKpD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,OAAyB;IAEzB,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,kCAAkC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAE7D,+DAA+D;YAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/D,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAClE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACnD,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACvD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,4CAA4C,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,EAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,qBAAqB,CAC1B;QACE,SAAS,EAAE,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,EACD,EAAE,CACW,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAyB,EACzB,QAAgB;IAEhB,OAAO,OAAO;SACX,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CACnE,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAgB,EAChB,OAAgB;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,YAAY;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAyB,EACzB,QAAgB,EAChB,gBAAwB;IAExB,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,IAAI,GACR,OAAO;SACJ,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,YAAY,KAAK,gBAAgB,CAC9C,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAc,EAAE,OAAyB;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAIpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClD,CAAC,CAAE,IAAI,CAAC,SAAqC;gBAC7C,CAAC,CAAC,EAAE,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,OAAO;YACL,KAAK,EAAE,OAAO;iBACX,iBAAiB,CAAC,QAAQ,CAAC;iBAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACvD,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,gBAAgB,CAAC;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,0BAA0B,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,OAAyB;IAUzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,kCAAkC,EAAE,CAAC;IACvD,MAAM,WAAW,GACf,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,MAAM,EAAE,KAAK,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,YAAY,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAC3D,CAAC,UAAU,EAAE,EAAE;YACb,MAAM,SAAS,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,KAAK;gBACxB,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,KAAK;gBACvB,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,SAAS;gBACT,iBAAiB,EAAE,SAAS;oBAC1B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,qBAAqB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3D,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;iBACxC;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,YAAY;oBAClB,GAAG,EAAE,WAAW;iBACjB;gBACD,MAAM,EAAE;oBACN,IAAI,EACF,YAAY,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjD,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;wBAClC,CAAC,CAAC,SAAS;oBACf,GAAG,EACD,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC/C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;wBACjC,CAAC,CAAC,SAAS;iBAChB;aACF,CAAC;QACJ,CAAC,CACF;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;QACjC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAc,EAAE,OAAyB;IAC1E,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,kEAAkE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,2DAA2D;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,gCAAgC,CACpC,KAAK,EACL,OAAO,EACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,KAAK,EACL,OAAO,EACP,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,OAAO,CACb,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kCAAkC,CAAC,EAAU;IACpD,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,oCAAoC,EAAE,GAAG,CAAC;IAClE,IAAI,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;YAC1C,OAAO,0EAA0E,CAAC;QACpF,CAAC;QACD,OAAO,GAAG,UAAU,CAAC,IAAI,yBAAyB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAc,EACd,OAAyB;IAOzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,gBAAgB,CACd,CAAC,EACD,MAAM,EACN,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC5D,CACF;QACD,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB,gBAAgB,CACd,CAAC,EACD,KAAK,EACL,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC3D,CACF;QACD,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,OAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAMpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+DAA+D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE;QACnD,IAAI;QACJ,GAAG;QACH,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,gBAAgB,CACtB,MAAM,CAAC,MAAM,EACb,KAAK,EACL,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,yDAAyD;aACjE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,OAAgC;IAKhC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,6BAA6B,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,MAAM,CAAC,2CAA2C,CAAC;YACnD,MAAM,CAAC,oDAAoD,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA6B,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC","sourcesContent":["/**\n * HTTP routes for user- and org-scope remote MCP server management.\n *\n * Mounted under `/_agent-native/mcp/servers` by `agent-chat-plugin` —\n * requires a reference to the running `McpClientManager` so mutations can\n * hot-reload the configured server set.\n *\n *   GET    /_agent-native/mcp/servers           list user + org servers\n *   POST   /_agent-native/mcp/servers           add a server\n *   DELETE /_agent-native/mcp/servers/:id       remove a server (scope via ?scope=)\n *   POST   /_agent-native/mcp/servers/:id/test  dry-run connect (no persist)\n *   POST   /_agent-native/mcp/servers/test      dry-run a URL before persisting\n *   GET    /_agent-native/mcp/builtin           list built-in capability toggles\n *   POST   /_agent-native/mcp/builtin           update built-in capability toggles\n *   POST   /_agent-native/mcp/apps/call-tool    mediated same-server app tool call\n *   POST   /_agent-native/mcp/apps/list-tools   list tools visible to an app iframe\n *   POST   /_agent-native/mcp/apps/read-resource read a ui:// app resource\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getQuery,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport { getAllSettings } from \"../settings/store.js\";\nimport {\n  buildMcpToolName,\n  parseMcpToolName,\n  type McpClientManager,\n  type McpTool,\n} from \"./manager.js\";\nimport type { McpConfig, McpServerConfig } from \"./config.js\";\nimport { loadMcpConfig, autoDetectMcpConfig } from \"./config.js\";\nimport { formatMcpConnectError } from \"./errors.js\";\nimport {\n  areBuiltinMcpCapabilitiesSupported,\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  listSupportedBuiltinMcpCapabilities,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\nimport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  setEnabledBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\nimport {\n  addRemoteServer,\n  listRemoteServers,\n  mergedConfigKey,\n  removeRemoteServer,\n  toHttpServerConfigAsync,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\nimport { fetchHubServers } from \"./hub-client.js\";\nimport { loadWorkspaceMcpServers } from \"./workspace-servers.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isToolVisibilityModelOnly } from \"@modelcontextprotocol/ext-apps/app-bridge\";\n\nexport { formatMcpConnectError } from \"./errors.js\";\n\n/** Redact obvious auth header values before sending to the client. */\nfunction redactHeaders(\n  headers?: Record<string, string>,\n): Record<string, { set: true }> | undefined {\n  if (!headers) return undefined;\n  const out: Record<string, { set: true }> = {};\n  for (const k of Object.keys(headers)) out[k] = { set: true };\n  return out;\n}\n\nfunction projectForClient(\n  stored: StoredRemoteMcpServer,\n  scope: RemoteMcpScope,\n  ownerId: string,\n  status: ServerStatus,\n): ClientServer {\n  return {\n    id: stored.id,\n    scope,\n    name: stored.name,\n    url: stored.url,\n    headers: redactHeaders(stored.headers),\n    description: stored.description,\n    createdAt: stored.createdAt,\n    mergedId: mergedConfigKey(scope, stored, ownerId),\n    status,\n  };\n}\n\nexport interface ClientServer {\n  id: string;\n  scope: RemoteMcpScope;\n  name: string;\n  url: string;\n  headers?: Record<string, { set: true }>;\n  description?: string;\n  createdAt: number;\n  /** The key under which this server is registered in the running MCP manager. */\n  mergedId: string;\n  status: ServerStatus;\n}\n\nexport interface ClientBuiltinCapability {\n  id: BuiltinMcpCapabilityId;\n  serverId: string;\n  name: string;\n  description: string;\n  command: string;\n  args: string[];\n  exclusiveGroup?: string;\n  available: boolean;\n  unavailableReason?: string;\n  notes?: string;\n  enabled: { user: boolean; org: boolean };\n  mergedIds: { user?: string; org?: string };\n  status: { user?: ServerStatus; org?: ServerStatus };\n}\n\ntype ServerStatus =\n  | { state: \"connected\"; toolCount: number }\n  | { state: \"error\"; error: string }\n  | { state: \"unknown\" };\n\nfunction statusFor(manager: McpClientManager, mergedId: string): ServerStatus {\n  const snap = manager.getStatus();\n  if (snap.connectedServers.includes(mergedId)) {\n    const toolCount = snap.tools.filter((t) => t.source === mergedId).length;\n    return { state: \"connected\", toolCount };\n  }\n  if (snap.errors[mergedId]) {\n    return { state: \"error\", error: snap.errors[mergedId] };\n  }\n  if (snap.configuredServers.includes(mergedId)) {\n    return { state: \"unknown\" };\n  }\n  return { state: \"unknown\" };\n}\n\nfunction pseudoStoredBuiltin(\n  capability: BuiltinMcpCapability,\n): StoredRemoteMcpServer {\n  return {\n    id: `builtin_${capability.id}`,\n    name: capability.serverId,\n    url: `builtin:${capability.id}`,\n    description: capability.description,\n    createdAt: 0,\n  };\n}\n\nexport function builtinMergedConfigKey(\n  scope: RemoteMcpScope,\n  capability: BuiltinMcpCapability,\n  ownerId: string,\n): string {\n  return mergedConfigKey(scope, pseudoStoredBuiltin(capability), ownerId);\n}\n\n/**\n * Build the merged MCP config the manager should run with: file/env config\n * plus **every** user-scope and org-scope remote server persisted in the\n * settings store. Scanning all scopes means a mutation from one user's\n * session never drops another user's servers from the running manager.\n *\n * Each persisted server's merged key includes its owner discriminator\n * (`user_<emailhash>_<name>` or `org_<orgId>_<name>`) so two users' servers\n * with the same name coexist; the request-time gate in\n * `isMcpToolAllowedForRequest` then scopes tool visibility back down to the\n * calling user.\n */\nexport async function buildMergedConfig(): Promise<McpConfig | null> {\n  const base = loadMcpConfig() ?? autoDetectMcpConfig();\n  const servers: Record<string, McpServerConfig> = { ...(base?.servers ?? {}) };\n\n  const all = await getAllSettings().catch(() => ({}));\n  for (const [fullKey, value] of Object.entries(all)) {\n    const userMatch = /^u:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    const orgMatch = /^o:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    let scope: RemoteMcpScope | null = null;\n    let ownerId: string | null = null;\n    if (userMatch) {\n      scope = \"user\";\n      ownerId = userMatch[1];\n    } else if (orgMatch) {\n      scope = \"org\";\n      ownerId = orgMatch[1];\n    }\n    if (!scope || !ownerId) continue;\n    const list = (value as { servers?: StoredRemoteMcpServer[] }).servers;\n    if (!Array.isArray(list)) continue;\n    for (const stored of list) {\n      if (!stored || typeof stored.url !== \"string\" || !stored.name) continue;\n      // Async resolve: decrypts `headerSecretKey` from app_secrets so the\n      // running MCP client gets the cleartext bearer at request time.\n      // Stored row contains only the secret-key reference, never the value.\n      servers[mergedConfigKey(scope, stored, ownerId)] =\n        await toHttpServerConfigAsync(scope, ownerId, stored);\n    }\n  }\n  if (areBuiltinMcpCapabilitiesSupported()) {\n    for (const [fullKey, value] of Object.entries(all)) {\n      const settingsKey = builtinMcpCapabilitiesSettingsKey();\n      const userMatch = new RegExp(`^u:([^:]+):${settingsKey}$`).exec(fullKey);\n      const orgMatch = new RegExp(`^o:([^:]+):${settingsKey}$`).exec(fullKey);\n      let scope: RemoteMcpScope | null = null;\n      let ownerId: string | null = null;\n      if (userMatch) {\n        scope = \"user\";\n        ownerId = userMatch[1];\n      } else if (orgMatch) {\n        scope = \"org\";\n        ownerId = orgMatch[1];\n      }\n      if (!scope || !ownerId) continue;\n      const enabledIds = normalizeBuiltinMcpCapabilityIds(\n        Array.isArray((value as any).enabledIds)\n          ? (value as any).enabledIds.map(String)\n          : [],\n      );\n      for (const id of enabledIds) {\n        const capability = getBuiltinMcpCapability(id);\n        if (!capability || !isBuiltinMcpCapabilityAvailable(capability)) {\n          continue;\n        }\n        servers[builtinMergedConfigKey(scope, capability, ownerId)] =\n          toBuiltinMcpServerConfig(capability);\n      }\n    }\n  }\n\n  try {\n    const workspaceServers = await loadWorkspaceMcpServers();\n    for (const [mergedKey, cfg] of Object.entries(workspaceServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] workspace MCP resource merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  // Hub-consume: if this app is configured to consume from a remote hub\n  // (AGENT_NATIVE_MCP_HUB_URL + AGENT_NATIVE_MCP_HUB_TOKEN), pull its\n  // org-scope servers and merge. Hub entries use `hub_<orgId>_<name>` so\n  // they never collide with local `org_<orgId>_<name>` rows.\n  try {\n    const hubServers = await fetchHubServers();\n    for (const [mergedKey, cfg] of Object.entries(hubServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] hub merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  if (Object.keys(servers).length === 0) return null;\n  return { servers, source: base?.source ?? \"merged\" };\n}\n\nfunction sortedConfigSignature(config: McpConfig | null): string {\n  const entries = Object.entries(config?.servers ?? {}).sort(([a], [b]) =>\n    a.localeCompare(b),\n  );\n  return JSON.stringify(entries);\n}\n\nfunction mcpConfigRefreshIntervalMs(): number {\n  const raw = process.env.AGENT_NATIVE_MCP_CONFIG_REFRESH_MS;\n  if (raw?.trim() === \"0\") return 0;\n  const parsed = raw ? Number(raw) : NaN;\n  if (Number.isFinite(parsed) && parsed >= 5_000) return parsed;\n  return 60_000;\n}\n\nexport function startMcpConfigRefresh(\n  manager: McpClientManager,\n): (() => void) | null {\n  const intervalMs = mcpConfigRefreshIntervalMs();\n  if (intervalMs <= 0 || typeof setInterval !== \"function\") return null;\n\n  let currentSignature = sortedConfigSignature(manager.getConfig());\n  let refreshing = false;\n  const refresh = async () => {\n    if (refreshing) return;\n    refreshing = true;\n    try {\n      const next = await buildMergedConfig();\n      const nextSignature = sortedConfigSignature(next);\n      if (nextSignature !== currentSignature) {\n        await manager.reconfigure(next);\n        currentSignature = nextSignature;\n      }\n    } catch (err: any) {\n      console.warn(\n        `[mcp-client] config refresh failed: ${err?.message ?? err}`,\n      );\n    } finally {\n      refreshing = false;\n    }\n  };\n\n  const timer = setInterval(refresh, intervalMs);\n  (timer as { unref?: () => void }).unref?.();\n  return () => clearInterval(timer);\n}\n\nasync function resolveContextForRequest(event: H3Event): Promise<{\n  email: string | null;\n  orgId: string | null;\n  role: string | null;\n}> {\n  let email: string | null = null;\n  try {\n    const session = await getSession(event);\n    email = session?.email ?? null;\n  } catch {\n    email = null;\n  }\n  let orgId: string | null = null;\n  let role: string | null = null;\n  try {\n    const ctx = await getOrgContext(event);\n    orgId = ctx.orgId;\n    role = ctx.role;\n    if (!email) email = ctx.email;\n  } catch {\n    // ignore — no org context\n  }\n  // No silent `local@localhost` fallback — if `getSession` returns nothing in\n  // production (misconfigured deploy, expired token), the caller must reject\n  // rather than silently pool every unauthenticated request under one identity.\n  return { email, orgId, role };\n}\n\nasync function reconfigureManager(manager: McpClientManager): Promise<void> {\n  const merged = await buildMergedConfig();\n  await manager.reconfigure(merged);\n}\n\nexport function mountMcpServersRoutes(\n  nitroApp: any,\n  manager: McpClientManager,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpServersMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  try {\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/servers\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n        // POST /servers/test — dry-run a URL+headers before persisting\n        if (method === \"POST\" && parts.length === 1 && parts[0] === \"test\") {\n          return handleTestUrl(event);\n        }\n\n        // Collection root\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleList(event, manager);\n          if (method === \"POST\") return handleAdd(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // /:id  /  /:id/test\n        if (parts.length === 1 || parts.length === 2) {\n          const id = parts[0];\n          if (parts.length === 2 && parts[1] === \"test\" && method === \"POST\") {\n            return handleTestExisting(event, manager, id);\n          }\n          if (parts.length === 1 && method === \"DELETE\") {\n            return handleDelete(event, manager, id);\n          }\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/builtin\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleBuiltinList(event, manager);\n          if (method === \"POST\") return handleBuiltinUpdate(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/apps\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (method !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        if (parts.length === 1 && parts[0] === \"call-tool\") {\n          return handleMcpAppCallTool(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"list-tools\") {\n          return handleMcpAppListTools(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"read-resource\") {\n          return handleMcpAppReadResource(event, manager);\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] Failed to mount MCP routes: ${err?.message ?? err}`,\n    );\n  }\n}\n\nasync function withMcpAppRequestContext<T>(\n  event: H3Event,\n  fn: () => Promise<T>,\n): Promise<T | { error: string }> {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  return runWithRequestContext(\n    {\n      userEmail: email ?? undefined,\n      orgId: orgId ?? undefined,\n    },\n    fn,\n  ) as Promise<T>;\n}\n\nfunction serverHasVisibleTools(\n  manager: McpClientManager,\n  serverId: string,\n): boolean {\n  return manager\n    .getToolsForServer(serverId)\n    .some(\n      (tool) =>\n        isMcpToolAllowedForRequest(tool.name) && isVisibleToMcpApp(tool),\n    );\n}\n\nfunction normalizeSameServerToolName(\n  serverId: string,\n  rawName: unknown,\n): string | null {\n  if (typeof rawName !== \"string\" || !rawName.trim()) return null;\n  const name = rawName.trim();\n  const parsed = parseMcpToolName(name);\n  if (!parsed) return name;\n  if (parsed.serverId !== serverId) return null;\n  return parsed.toolName;\n}\n\nfunction isVisibleToMcpApp(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityModelOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nfunction mcpToolForClient(tool: McpTool) {\n  return {\n    name: tool.originalName,\n    ...(tool.title ? { title: tool.title } : {}),\n    description: tool.description,\n    inputSchema: tool.inputSchema,\n    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),\n    ...(tool.annotations ? { annotations: tool.annotations } : {}),\n    ...(tool._meta ? { _meta: tool._meta } : {}),\n  };\n}\n\nfunction mcpAppCallableTool(\n  manager: McpClientManager,\n  serverId: string,\n  originalToolName: string,\n): McpTool | null {\n  const prefixedName = buildMcpToolName(serverId, originalToolName);\n  const tool =\n    manager\n      .getToolsForServer(serverId)\n      .find(\n        (candidate) =>\n          candidate.name === prefixedName ||\n          candidate.originalName === originalToolName,\n      ) ?? null;\n  if (!tool) return null;\n  if (!isMcpToolAllowedForRequest(tool.name) || !isVisibleToMcpApp(tool)) {\n    return null;\n  }\n  return tool;\n}\n\nasync function handleMcpAppCallTool(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    toolName?: unknown;\n    arguments?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const originalToolName = normalizeSameServerToolName(serverId, body.toolName);\n  if (!serverId || !originalToolName) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and same-server toolName are required\" };\n  }\n\n  return withMcpAppRequestContext(event, async () => {\n    const tool = mcpAppCallableTool(manager, serverId, originalToolName);\n    if (!tool) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP tool is not available in this request scope\" };\n    }\n    try {\n      return await manager.callTool(\n        tool.name,\n        body.arguments && typeof body.arguments === \"object\"\n          ? (body.arguments as Record<string, unknown>)\n          : {},\n      );\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP tool call failed\" };\n    }\n  });\n}\n\nasync function handleMcpAppListTools(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  if (!serverId) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId is required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    return {\n      tools: manager\n        .getToolsForServer(serverId)\n        .filter((tool) => isMcpToolAllowedForRequest(tool.name))\n        .filter(isVisibleToMcpApp)\n        .map(mcpToolForClient),\n    };\n  });\n}\n\nasync function handleMcpAppReadResource(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    uri?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const uri = typeof body.uri === \"string\" ? body.uri : \"\";\n  if (!serverId || !uri.startsWith(\"ui://\")) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and ui:// uri are required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    try {\n      return await manager.readResource(serverId, uri);\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP resource read failed\" };\n    }\n  });\n}\n\nasync function handleBuiltinList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  capabilities: ClientBuiltinCapability[];\n  user: { enabledIds: BuiltinMcpCapabilityId[] };\n  org: {\n    enabledIds: BuiltinMcpCapabilityId[];\n    orgId: string | null;\n    role: string | null;\n  };\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const supported = areBuiltinMcpCapabilitiesSupported();\n  const userEnabled =\n    supported && email\n      ? await listEnabledBuiltinMcpCapabilities(\"user\", email)\n      : [];\n  const orgEnabled =\n    supported && orgId\n      ? await listEnabledBuiltinMcpCapabilities(\"org\", orgId)\n      : [];\n\n  return {\n    capabilities: (supported ? BUILTIN_MCP_CAPABILITIES : []).map(\n      (capability) => {\n        const available = isBuiltinMcpCapabilityAvailable(capability);\n        const userMergedId = email\n          ? builtinMergedConfigKey(\"user\", capability, email)\n          : undefined;\n        const orgMergedId = orgId\n          ? builtinMergedConfigKey(\"org\", capability, orgId)\n          : undefined;\n        return {\n          id: capability.id,\n          serverId: capability.serverId,\n          name: capability.name,\n          description: capability.description,\n          command: capability.command,\n          args: capability.args,\n          exclusiveGroup: capability.exclusiveGroup,\n          available,\n          unavailableReason: available\n            ? undefined\n            : `Only available on ${capability.platforms?.join(\", \")}`,\n          notes: capability.notes,\n          enabled: {\n            user: userEnabled.includes(capability.id),\n            org: orgEnabled.includes(capability.id),\n          },\n          mergedIds: {\n            user: userMergedId,\n            org: orgMergedId,\n          },\n          status: {\n            user:\n              userMergedId && userEnabled.includes(capability.id)\n                ? statusFor(manager, userMergedId)\n                : undefined,\n            org:\n              orgMergedId && orgEnabled.includes(capability.id)\n                ? statusFor(manager, orgMergedId)\n                : undefined,\n          },\n        };\n      },\n    ),\n    user: { enabledIds: userEnabled },\n    org: { enabledIds: orgEnabled, orgId, role },\n  };\n}\n\nasync function handleBuiltinUpdate(event: H3Event, manager: McpClientManager) {\n  if (!areBuiltinMcpCapabilitiesSupported()) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"Built-in local MCP capabilities are only available in local development.\",\n    };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    enabledIds?: unknown;\n    id?: unknown;\n    enabled?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error:\n          \"You must belong to an organization to change org-scope built-ins\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can change org-scope MCP built-ins\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  if (Array.isArray(body.enabledIds)) {\n    for (const rawId of body.enabledIds) {\n      const error = validateBuiltinCapabilityForEnable(String(rawId));\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    }\n    await setEnabledBuiltinMcpCapabilities(\n      scope,\n      scopeId,\n      body.enabledIds.map(String),\n    );\n  } else if (typeof body.id === \"string\" && typeof body.enabled === \"boolean\") {\n    if (body.enabled) {\n      const error = validateBuiltinCapabilityForEnable(body.id);\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    } else if (!getBuiltinMcpCapability(body.id)) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n    const result = await setBuiltinMcpCapabilityEnabled(\n      scope,\n      scopeId,\n      body.id,\n      body.enabled,\n    );\n    if (!result) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n  } else {\n    setResponseStatus(event, 400);\n    return { error: \"Provide enabledIds or id + enabled\" };\n  }\n\n  await reconfigureManager(manager);\n  return handleBuiltinList(event, manager);\n}\n\nfunction validateBuiltinCapabilityForEnable(id: string): string | null {\n  const capability = getBuiltinMcpCapability(id);\n  if (!capability) return `Unknown built-in MCP capability \"${id}\"`;\n  if (!listSupportedBuiltinMcpCapabilities().includes(capability)) {\n    if (!areBuiltinMcpCapabilitiesSupported()) {\n      return \"Built-in local MCP capabilities are only available in local development.\";\n    }\n    return `${capability.name} is only available on ${capability.platforms?.join(\", \")}`;\n  }\n  return null;\n}\n\nasync function handleList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  user: ClientServer[];\n  org: ClientServer[];\n  orgId: string | null;\n  role: string | null;\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const userServers = email ? await listRemoteServers(\"user\", email) : [];\n  const orgServers = orgId ? await listRemoteServers(\"org\", orgId) : [];\n  return {\n    user: userServers.map((s) =>\n      projectForClient(\n        s,\n        \"user\",\n        email ?? \"\",\n        statusFor(manager, mergedConfigKey(\"user\", s, email ?? \"\")),\n      ),\n    ),\n    org: orgServers.map((s) =>\n      projectForClient(\n        s,\n        \"org\",\n        orgId ?? \"\",\n        statusFor(manager, mergedConfigKey(\"org\", s, orgId ?? \"\")),\n      ),\n    ),\n    orgId,\n    role,\n  };\n}\n\nasync function handleAdd(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    name?: unknown;\n    url?: unknown;\n    headers?: unknown;\n    description?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n  const name = typeof body.name === \"string\" ? body.name : \"\";\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  if (!name.trim() || !url.trim()) {\n    setResponseStatus(event, 400);\n    return { error: \"name and url are required\" };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const description =\n    typeof body.description === \"string\" ? body.description : undefined;\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error: \"You must belong to an organization to add an org-scope server\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return { error: \"Only owners and admins can add org-scope MCP servers\" };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const result = await addRemoteServer(scope, scopeId, {\n    name,\n    url,\n    headers,\n    description,\n  });\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { error: result.error };\n  }\n\n  await reconfigureManager(manager);\n  const mergedId = mergedConfigKey(scope, result.server, scopeId);\n  return {\n    ok: true,\n    server: projectForClient(\n      result.server,\n      scope,\n      scopeId,\n      statusFor(manager, mergedId),\n    ),\n  };\n}\n\nasync function handleDelete(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (parsedScope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"No active organization\" };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can remove org-scope MCP servers\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const removed = await removeRemoteServer(parsedScope, scopeId, id);\n  if (!removed) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  await reconfigureManager(manager);\n  return { ok: true };\n}\n\nasync function handleTestUrl(event: H3Event) {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email && !orgId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    url?: unknown;\n    headers?: unknown;\n  };\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  const check = validateRemoteUrl(url);\n  if (!check.ok) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: check.error };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const result = await tryConnect(check.url!.toString(), headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function handleTestExisting(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId } = await resolveContextForRequest(event);\n  const scopeId = parsedScope === \"user\" ? email : orgId;\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  const list = await listRemoteServers(parsedScope, scopeId);\n  const server = list.find((s) => s.id === id);\n  if (!server) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  // `server.headers` holds only the cleartext (non-secret) subset; auth headers\n  // (Authorization, API keys) live encrypted in app_secrets and are resolved by\n  // toHttpServerConfigAsync. Testing with cleartext-only headers would fail for\n  // any server that uses encrypted credentials.\n  const config = await toHttpServerConfigAsync(parsedScope, scopeId, server);\n  const result = await tryConnect(server.url, config.headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function tryConnect(\n  url: string,\n  headers?: Record<string, string>,\n): Promise<\n  | { ok: true; toolCount: number; tools: string[] }\n  | { ok: false; error: string }\n> {\n  try {\n    const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([\n      import(\"@modelcontextprotocol/sdk/client/index.js\"),\n      import(\"@modelcontextprotocol/sdk/client/streamableHttp.js\"),\n    ]);\n    const requestInit: Record<string, unknown> = {};\n    if (headers && Object.keys(headers).length > 0) {\n      requestInit.headers = headers;\n    }\n    const transport = new StreamableHTTPClientTransport(new URL(url), {\n      requestInit,\n    });\n    const client = new Client(\n      { name: \"agent-native-mcp-client-test\", version: \"1.0.0\" },\n      { capabilities: {} },\n    );\n    try {\n      await client.connect(transport);\n      const listed = await client.listTools();\n      const names = ((listed?.tools ?? []) as Array<{ name: string }>).map(\n        (t) => t.name,\n      );\n      return { ok: true, toolCount: names.length, tools: names };\n    } finally {\n      try {\n        await client.close();\n      } catch {}\n      try {\n        await transport.close();\n      } catch {}\n    }\n  } catch (err: any) {\n    return { ok: false, error: formatMcpConnectError(err) };\n  }\n}\n\nfunction normalizeHeaders(input: unknown): Record<string, string> | undefined {\n  if (!input || typeof input !== \"object\") return undefined;\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input as Record<string, unknown>)) {\n    if (typeof k !== \"string\" || !k.trim()) continue;\n    if (typeof v !== \"string\") continue;\n    out[k.trim()] = v;\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n"]}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,kCAAkC,EAClC,wBAAwB,EACxB,uBAAuB,EACvB,+BAA+B,EAC/B,mCAAmC,EACnC,gCAAgC,EAChC,wBAAwB,GAGzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,sEAAsE;AACtE,SAAS,aAAa,CACpB,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA6B,EAC7B,KAAqB,EACrB,OAAe,EACf,MAAoB;IAEpB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC;AAoCD,SAAS,SAAS,CAAC,OAAyB,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgC;IAEhC,OAAO;QACL,EAAE,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC9B,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,GAAG,EAAE,WAAW,UAAU,CAAC,EAAE,EAAE;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,CAAC;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAqB,EACrB,UAAgC,EAChC,OAAe;IAEf,OAAO,eAAe,CAAC,KAAK,EAAE,mBAAmB,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,KAA+C,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS;YACxE,oEAAoE;YACpE,gEAAgE;YAChE,sEAAsE;YACtE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,kCAAkC,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,WAAW,GAAG,iCAAiC,EAAE,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,cAAc,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,KAAK,GAA0B,IAAI,CAAC;YACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,GAAG,MAAM,CAAC;gBACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,KAAK,GAAG,KAAK,CAAC;gBACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;gBAAE,SAAS;YACjC,MAAM,UAAU,GAAG,gCAAgC,CACjD,KAAK,CAAC,OAAO,CAAE,KAAa,CAAC,UAAU,CAAC;gBACtC,CAAC,CAAE,KAAa,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,CAAC,CAAC,EAAE,CACP,CAAC;YACF,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChE,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;oBACzD,wBAAwB,CAAC,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,MAAM,uBAAuB,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChE,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,qDAAqD,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CAC1G,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAwB;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IAC3D,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAyB;IAEzB,MAAM,UAAU,GAAG,0BAA0B,EAAE,CAAC;IAChD,IAAI,UAAU,IAAI,CAAC,IAAI,OAAO,WAAW,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAEtE,IAAI,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,UAAU;YAAE,OAAO;QACvB,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAChC,gBAAgB,GAAG,aAAa,CAAC;YACnC,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,uCAAuC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC7D,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAc;IAKpD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,OAAyB;IAEzB,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,kCAAkC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAE7D,+DAA+D;YAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/D,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAClE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACnD,OAAO,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACpD,OAAO,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACvD,OAAO,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,4CAA4C,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,EAAoB;IAEpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,qBAAqB,CAC1B;QACE,SAAS,EAAE,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,KAAK,IAAI,SAAS;KAC1B,EACD,EAAE,CACW,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAyB,EACzB,QAAgB;IAEhB,OAAO,OAAO;SACX,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CACnE,CAAC;AACN,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAgB,EAChB,OAAgB;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAU,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACrC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,YAAY;QACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAyB,EACzB,QAAgB,EAChB,gBAAwB;IAExB,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,IAAI,GACR,OAAO;SACJ,iBAAiB,CAAC,QAAQ,CAAC;SAC3B,IAAI,CACH,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,YAAY;QAC/B,SAAS,CAAC,YAAY,KAAK,gBAAgB,CAC9C,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAc,EAAE,OAAyB;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAIpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClD,CAAC,CAAE,IAAI,CAAC,SAAqC;gBAC7C,CAAC,CAAC,EAAE,CACP,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,OAAO;YACL,KAAK,EAAE,OAAO;iBACX,iBAAiB,CAAC,QAAQ,CAAC;iBAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACvD,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,gBAAgB,CAAC;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,wBAAwB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QAChD,IACE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC5B,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACzC,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,0BAA0B,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAc,EACd,OAAyB;IAUzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,kCAAkC,EAAE,CAAC;IACvD,MAAM,WAAW,GACf,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,MAAM,EAAE,KAAK,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GACd,SAAS,IAAI,KAAK;QAChB,CAAC,CAAC,MAAM,iCAAiC,CAAC,KAAK,EAAE,KAAK,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,YAAY,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAC3D,CAAC,UAAU,EAAE,EAAE;YACb,MAAM,SAAS,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;YAC9D,MAAM,YAAY,GAAG,KAAK;gBACxB,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,KAAK;gBACvB,CAAC,CAAC,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;gBAClD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,SAAS;gBACT,iBAAiB,EAAE,SAAS;oBAC1B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,qBAAqB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3D,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;iBACxC;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,YAAY;oBAClB,GAAG,EAAE,WAAW;iBACjB;gBACD,MAAM,EAAE;oBACN,IAAI,EACF,YAAY,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjD,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC;wBAClC,CAAC,CAAC,SAAS;oBACf,GAAG,EACD,WAAW,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC/C,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;wBACjC,CAAC,CAAC,SAAS;iBAChB;aACF,CAAC;QACJ,CAAC,CACF;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;QACjC,GAAG,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAc,EAAE,OAAyB;IAC1E,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,0EAA0E;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAKpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,kEAAkE;aACrE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,2DAA2D;aACnE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,gCAAgC,CACpC,KAAK,EACL,OAAO,EACP,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAC5B,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CACjD,KAAK,EACL,OAAO,EACP,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,OAAO,CACb,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kCAAkC,CAAC,EAAU;IACpD,MAAM,UAAU,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,oCAAoC,EAAE,GAAG,CAAC;IAClE,IAAI,CAAC,mCAAmC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC;YAC1C,OAAO,0EAA0E,CAAC;QACpF,CAAC;QACD,OAAO,GAAG,UAAU,CAAC,IAAI,yBAAyB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAc,EACd,OAAyB;IAOzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,gBAAgB,CACd,CAAC,EACD,MAAM,EACN,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC5D,CACF;QACD,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB,gBAAgB,CACd,CAAC,EACD,KAAK,EACL,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC3D,CACF;QACD,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,OAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAMpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+DAA+D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE;QACnD,IAAI;QACJ,GAAG;QACH,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,gBAAgB,CACtB,MAAM,CAAC,MAAM,EACb,KAAK,EACL,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,yDAAyD;aACjE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,QAA0B,EAC1B,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,OAAgC;IAKhC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,6BAA6B,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,MAAM,CAAC,2CAA2C,CAAC;YACnD,MAAM,CAAC,oDAAoD,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA6B,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC","sourcesContent":["/**\n * HTTP routes for user- and org-scope remote MCP server management.\n *\n * Mounted under `/_agent-native/mcp/servers` by `agent-chat-plugin` —\n * requires a reference to the running `McpClientManager` so mutations can\n * hot-reload the configured server set.\n *\n *   GET    /_agent-native/mcp/servers           list user + org servers\n *   POST   /_agent-native/mcp/servers           add a server\n *   DELETE /_agent-native/mcp/servers/:id       remove a server (scope via ?scope=)\n *   POST   /_agent-native/mcp/servers/:id/test  dry-run connect (no persist)\n *   POST   /_agent-native/mcp/servers/test      dry-run a URL before persisting\n *   GET    /_agent-native/mcp/builtin           list built-in capability toggles\n *   POST   /_agent-native/mcp/builtin           update built-in capability toggles\n *   POST   /_agent-native/mcp/apps/call-tool    mediated same-server app tool call\n *   POST   /_agent-native/mcp/apps/list-tools   list tools visible to an app iframe\n *   POST   /_agent-native/mcp/apps/read-resource read a ui:// app resource\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getQuery,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { runWithRequestContext } from \"../server/request-context.js\";\nimport { getAllSettings } from \"../settings/store.js\";\nimport {\n  buildMcpToolName,\n  parseMcpToolName,\n  type McpClientManager,\n  type McpTool,\n} from \"./manager.js\";\nimport type { McpConfig, McpServerConfig } from \"./config.js\";\nimport { loadMcpConfig, autoDetectMcpConfig } from \"./config.js\";\nimport { formatMcpConnectError } from \"./errors.js\";\nimport {\n  areBuiltinMcpCapabilitiesSupported,\n  BUILTIN_MCP_CAPABILITIES,\n  getBuiltinMcpCapability,\n  isBuiltinMcpCapabilityAvailable,\n  listSupportedBuiltinMcpCapabilities,\n  normalizeBuiltinMcpCapabilityIds,\n  toBuiltinMcpServerConfig,\n  type BuiltinMcpCapability,\n  type BuiltinMcpCapabilityId,\n} from \"./builtin-capabilities.js\";\nimport {\n  builtinMcpCapabilitiesSettingsKey,\n  listEnabledBuiltinMcpCapabilities,\n  setBuiltinMcpCapabilityEnabled,\n  setEnabledBuiltinMcpCapabilities,\n} from \"./builtin-store.js\";\nimport {\n  addRemoteServer,\n  listRemoteServers,\n  mergedConfigKey,\n  removeRemoteServer,\n  toHttpServerConfigAsync,\n  validateRemoteUrl,\n  type RemoteMcpScope,\n  type StoredRemoteMcpServer,\n} from \"./remote-store.js\";\nimport { fetchHubServers } from \"./hub-client.js\";\nimport { loadWorkspaceMcpServers } from \"./workspace-servers.js\";\nimport { isMcpToolAllowedForRequest } from \"./visibility.js\";\nimport { isToolVisibilityModelOnly } from \"@modelcontextprotocol/ext-apps/app-bridge\";\n\nexport { formatMcpConnectError } from \"./errors.js\";\n\n/** Redact obvious auth header values before sending to the client. */\nfunction redactHeaders(\n  headers?: Record<string, string>,\n): Record<string, { set: true }> | undefined {\n  if (!headers) return undefined;\n  const out: Record<string, { set: true }> = {};\n  for (const k of Object.keys(headers)) out[k] = { set: true };\n  return out;\n}\n\nfunction projectForClient(\n  stored: StoredRemoteMcpServer,\n  scope: RemoteMcpScope,\n  ownerId: string,\n  status: ServerStatus,\n): ClientServer {\n  return {\n    id: stored.id,\n    scope,\n    name: stored.name,\n    url: stored.url,\n    headers: redactHeaders(stored.headers),\n    description: stored.description,\n    createdAt: stored.createdAt,\n    mergedId: mergedConfigKey(scope, stored, ownerId),\n    status,\n  };\n}\n\nexport interface ClientServer {\n  id: string;\n  scope: RemoteMcpScope;\n  name: string;\n  url: string;\n  headers?: Record<string, { set: true }>;\n  description?: string;\n  createdAt: number;\n  /** The key under which this server is registered in the running MCP manager. */\n  mergedId: string;\n  status: ServerStatus;\n}\n\nexport interface ClientBuiltinCapability {\n  id: BuiltinMcpCapabilityId;\n  serverId: string;\n  name: string;\n  description: string;\n  command: string;\n  args: string[];\n  exclusiveGroup?: string;\n  available: boolean;\n  unavailableReason?: string;\n  notes?: string;\n  enabled: { user: boolean; org: boolean };\n  mergedIds: { user?: string; org?: string };\n  status: { user?: ServerStatus; org?: ServerStatus };\n}\n\ntype ServerStatus =\n  | { state: \"connected\"; toolCount: number }\n  | { state: \"error\"; error: string }\n  | { state: \"unknown\" };\n\nfunction statusFor(manager: McpClientManager, mergedId: string): ServerStatus {\n  const snap = manager.getStatus();\n  if (snap.connectedServers.includes(mergedId)) {\n    const toolCount = snap.tools.filter((t) => t.source === mergedId).length;\n    return { state: \"connected\", toolCount };\n  }\n  if (snap.errors[mergedId]) {\n    return { state: \"error\", error: snap.errors[mergedId] };\n  }\n  if (snap.configuredServers.includes(mergedId)) {\n    return { state: \"unknown\" };\n  }\n  return { state: \"unknown\" };\n}\n\nfunction pseudoStoredBuiltin(\n  capability: BuiltinMcpCapability,\n): StoredRemoteMcpServer {\n  return {\n    id: `builtin_${capability.id}`,\n    name: capability.serverId,\n    url: `builtin:${capability.id}`,\n    description: capability.description,\n    createdAt: 0,\n  };\n}\n\nexport function builtinMergedConfigKey(\n  scope: RemoteMcpScope,\n  capability: BuiltinMcpCapability,\n  ownerId: string,\n): string {\n  return mergedConfigKey(scope, pseudoStoredBuiltin(capability), ownerId);\n}\n\n/**\n * Build the merged MCP config the manager should run with: file/env config\n * plus **every** user-scope and org-scope remote server persisted in the\n * settings store. Scanning all scopes means a mutation from one user's\n * session never drops another user's servers from the running manager.\n *\n * Each persisted server's merged key includes its owner discriminator\n * (`user_<emailhash>_<name>` or `org_<orgId>_<name>`) so two users' servers\n * with the same name coexist; the request-time gate in\n * `isMcpToolAllowedForRequest` then scopes tool visibility back down to the\n * calling user.\n */\nexport async function buildMergedConfig(): Promise<McpConfig | null> {\n  const base = loadMcpConfig() ?? autoDetectMcpConfig();\n  const servers: Record<string, McpServerConfig> = { ...(base?.servers ?? {}) };\n\n  const all = await getAllSettings().catch(() => ({}));\n  for (const [fullKey, value] of Object.entries(all)) {\n    const userMatch = /^u:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    const orgMatch = /^o:([^:]+):mcp-servers-remote$/.exec(fullKey);\n    let scope: RemoteMcpScope | null = null;\n    let ownerId: string | null = null;\n    if (userMatch) {\n      scope = \"user\";\n      ownerId = userMatch[1];\n    } else if (orgMatch) {\n      scope = \"org\";\n      ownerId = orgMatch[1];\n    }\n    if (!scope || !ownerId) continue;\n    const list = (value as { servers?: StoredRemoteMcpServer[] }).servers;\n    if (!Array.isArray(list)) continue;\n    for (const stored of list) {\n      if (!stored || typeof stored.url !== \"string\" || !stored.name) continue;\n      // Async resolve: decrypts `headerSecretKey` from app_secrets so the\n      // running MCP client gets the cleartext bearer at request time.\n      // Stored row contains only the secret-key reference, never the value.\n      servers[mergedConfigKey(scope, stored, ownerId)] =\n        await toHttpServerConfigAsync(scope, ownerId, stored);\n    }\n  }\n  if (areBuiltinMcpCapabilitiesSupported()) {\n    for (const [fullKey, value] of Object.entries(all)) {\n      const settingsKey = builtinMcpCapabilitiesSettingsKey();\n      const userMatch = new RegExp(`^u:([^:]+):${settingsKey}$`).exec(fullKey);\n      const orgMatch = new RegExp(`^o:([^:]+):${settingsKey}$`).exec(fullKey);\n      let scope: RemoteMcpScope | null = null;\n      let ownerId: string | null = null;\n      if (userMatch) {\n        scope = \"user\";\n        ownerId = userMatch[1];\n      } else if (orgMatch) {\n        scope = \"org\";\n        ownerId = orgMatch[1];\n      }\n      if (!scope || !ownerId) continue;\n      const enabledIds = normalizeBuiltinMcpCapabilityIds(\n        Array.isArray((value as any).enabledIds)\n          ? (value as any).enabledIds.map(String)\n          : [],\n      );\n      for (const id of enabledIds) {\n        const capability = getBuiltinMcpCapability(id);\n        if (!capability || !isBuiltinMcpCapabilityAvailable(capability)) {\n          continue;\n        }\n        servers[builtinMergedConfigKey(scope, capability, ownerId)] =\n          toBuiltinMcpServerConfig(capability);\n      }\n    }\n  }\n\n  try {\n    const workspaceServers = await loadWorkspaceMcpServers();\n    for (const [mergedKey, cfg] of Object.entries(workspaceServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] workspace MCP resource merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  // Hub-consume: if this app is configured to consume from a remote hub\n  // (AGENT_NATIVE_MCP_HUB_URL + AGENT_NATIVE_MCP_HUB_TOKEN), pull its\n  // org-scope servers and merge. Hub entries use `hub_<orgId>_<name>` so\n  // they never collide with local `org_<orgId>_<name>` rows.\n  try {\n    const hubServers = await fetchHubServers();\n    for (const [mergedKey, cfg] of Object.entries(hubServers)) {\n      servers[mergedKey] = cfg;\n    }\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] hub merge failed: ${err?.message ?? err}. Continuing with local config.`,\n    );\n  }\n\n  if (Object.keys(servers).length === 0) return null;\n  return { servers, source: base?.source ?? \"merged\" };\n}\n\nfunction sortedConfigSignature(config: McpConfig | null): string {\n  const entries = Object.entries(config?.servers ?? {}).sort(([a], [b]) =>\n    a.localeCompare(b),\n  );\n  return JSON.stringify(entries);\n}\n\nfunction mcpConfigRefreshIntervalMs(): number {\n  const raw = process.env.AGENT_NATIVE_MCP_CONFIG_REFRESH_MS;\n  if (raw?.trim() === \"0\") return 0;\n  const parsed = raw ? Number(raw) : NaN;\n  if (Number.isFinite(parsed) && parsed >= 5_000) return parsed;\n  return 60_000;\n}\n\nexport function startMcpConfigRefresh(\n  manager: McpClientManager,\n): (() => void) | null {\n  const intervalMs = mcpConfigRefreshIntervalMs();\n  if (intervalMs <= 0 || typeof setInterval !== \"function\") return null;\n\n  let currentSignature = sortedConfigSignature(manager.getConfig());\n  let refreshing = false;\n  const refresh = async () => {\n    if (refreshing) return;\n    refreshing = true;\n    try {\n      const next = await buildMergedConfig();\n      const nextSignature = sortedConfigSignature(next);\n      if (nextSignature !== currentSignature) {\n        await manager.reconfigure(next);\n        currentSignature = nextSignature;\n      }\n    } catch (err: any) {\n      console.warn(\n        `[mcp-client] config refresh failed: ${err?.message ?? err}`,\n      );\n    } finally {\n      refreshing = false;\n    }\n  };\n\n  const timer = setInterval(refresh, intervalMs);\n  (timer as { unref?: () => void }).unref?.();\n  return () => clearInterval(timer);\n}\n\nasync function resolveContextForRequest(event: H3Event): Promise<{\n  email: string | null;\n  orgId: string | null;\n  role: string | null;\n}> {\n  let email: string | null = null;\n  try {\n    const session = await getSession(event);\n    email = session?.email ?? null;\n  } catch {\n    email = null;\n  }\n  let orgId: string | null = null;\n  let role: string | null = null;\n  try {\n    const ctx = await getOrgContext(event);\n    orgId = ctx.orgId;\n    role = ctx.role;\n    if (!email) email = ctx.email;\n  } catch {\n    // ignore — no org context\n  }\n  // No silent `local@localhost` fallback — if `getSession` returns nothing in\n  // production (misconfigured deploy, expired token), the caller must reject\n  // rather than silently pool every unauthenticated request under one identity.\n  return { email, orgId, role };\n}\n\nasync function reconfigureManager(manager: McpClientManager): Promise<void> {\n  const merged = await buildMergedConfig();\n  await manager.reconfigure(merged);\n}\n\nexport function mountMcpServersRoutes(\n  nitroApp: any,\n  manager: McpClientManager,\n): void {\n  const mountedApps: WeakSet<object> = ((\n    globalThis as any\n  ).__agentNativeMcpServersMountedApps ??= new WeakSet<object>());\n  if (mountedApps.has(nitroApp)) return;\n  mountedApps.add(nitroApp);\n\n  try {\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/servers\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n\n        // POST /servers/test — dry-run a URL+headers before persisting\n        if (method === \"POST\" && parts.length === 1 && parts[0] === \"test\") {\n          return handleTestUrl(event);\n        }\n\n        // Collection root\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleList(event, manager);\n          if (method === \"POST\") return handleAdd(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // /:id  /  /:id/test\n        if (parts.length === 1 || parts.length === 2) {\n          const id = parts[0];\n          if (parts.length === 2 && parts[1] === \"test\" && method === \"POST\") {\n            return handleTestExisting(event, manager, id);\n          }\n          if (parts.length === 1 && method === \"DELETE\") {\n            return handleDelete(event, manager, id);\n          }\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/builtin\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (parts.length === 0) {\n          if (method === \"GET\") return handleBuiltinList(event, manager);\n          if (method === \"POST\") return handleBuiltinUpdate(event, manager);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n    getH3App(nitroApp).use(\n      \"/_agent-native/mcp/apps\",\n      defineEventHandler(async (event: H3Event) => {\n        const method = getMethod(event);\n        const pathname = (event.url?.pathname || \"\")\n          .replace(/^\\/+/, \"\")\n          .replace(/\\/+$/, \"\");\n        const parts = pathname ? pathname.split(\"/\") : [];\n\n        setResponseHeader(event, \"Content-Type\", \"application/json\");\n        if (method !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        if (parts.length === 1 && parts[0] === \"call-tool\") {\n          return handleMcpAppCallTool(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"list-tools\") {\n          return handleMcpAppListTools(event, manager);\n        }\n        if (parts.length === 1 && parts[0] === \"read-resource\") {\n          return handleMcpAppReadResource(event, manager);\n        }\n\n        setResponseStatus(event, 404);\n        return { error: \"Not found\" };\n      }),\n    );\n  } catch (err: any) {\n    console.warn(\n      `[mcp-client] Failed to mount MCP routes: ${err?.message ?? err}`,\n    );\n  }\n}\n\nasync function withMcpAppRequestContext<T>(\n  event: H3Event,\n  fn: () => Promise<T>,\n): Promise<T | { error: string }> {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  return runWithRequestContext(\n    {\n      userEmail: email ?? undefined,\n      orgId: orgId ?? undefined,\n    },\n    fn,\n  ) as Promise<T>;\n}\n\nfunction serverHasVisibleTools(\n  manager: McpClientManager,\n  serverId: string,\n): boolean {\n  return manager\n    .getToolsForServer(serverId)\n    .some(\n      (tool) =>\n        isMcpToolAllowedForRequest(tool.name) && isVisibleToMcpApp(tool),\n    );\n}\n\nfunction normalizeSameServerToolName(\n  serverId: string,\n  rawName: unknown,\n): string | null {\n  if (typeof rawName !== \"string\" || !rawName.trim()) return null;\n  const name = rawName.trim();\n  const parsed = parseMcpToolName(name);\n  if (!parsed) return name;\n  if (parsed.serverId !== serverId) return null;\n  return parsed.toolName;\n}\n\nfunction isVisibleToMcpApp(tool: McpTool): boolean {\n  try {\n    return !isToolVisibilityModelOnly(tool.raw as any);\n  } catch {\n    return true;\n  }\n}\n\nfunction mcpToolForClient(tool: McpTool) {\n  return {\n    name: tool.originalName,\n    ...(tool.title ? { title: tool.title } : {}),\n    description: tool.description,\n    inputSchema: tool.inputSchema,\n    ...(tool.outputSchema ? { outputSchema: tool.outputSchema } : {}),\n    ...(tool.annotations ? { annotations: tool.annotations } : {}),\n    ...(tool._meta ? { _meta: tool._meta } : {}),\n  };\n}\n\nfunction mcpAppCallableTool(\n  manager: McpClientManager,\n  serverId: string,\n  originalToolName: string,\n): McpTool | null {\n  const prefixedName = buildMcpToolName(serverId, originalToolName);\n  const tool =\n    manager\n      .getToolsForServer(serverId)\n      .find(\n        (candidate) =>\n          candidate.name === prefixedName ||\n          candidate.originalName === originalToolName,\n      ) ?? null;\n  if (!tool) return null;\n  if (!isMcpToolAllowedForRequest(tool.name) || !isVisibleToMcpApp(tool)) {\n    return null;\n  }\n  return tool;\n}\n\nasync function handleMcpAppCallTool(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    toolName?: unknown;\n    arguments?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const originalToolName = normalizeSameServerToolName(serverId, body.toolName);\n  if (!serverId || !originalToolName) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and same-server toolName are required\" };\n  }\n\n  return withMcpAppRequestContext(event, async () => {\n    const tool = mcpAppCallableTool(manager, serverId, originalToolName);\n    if (!tool) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP tool is not available in this request scope\" };\n    }\n    try {\n      return await manager.callTool(\n        tool.name,\n        body.arguments && typeof body.arguments === \"object\"\n          ? (body.arguments as Record<string, unknown>)\n          : {},\n      );\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP tool call failed\" };\n    }\n  });\n}\n\nasync function handleMcpAppListTools(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  if (!serverId) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId is required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    return {\n      tools: manager\n        .getToolsForServer(serverId)\n        .filter((tool) => isMcpToolAllowedForRequest(tool.name))\n        .filter(isVisibleToMcpApp)\n        .map(mcpToolForClient),\n    };\n  });\n}\n\nasync function handleMcpAppReadResource(\n  event: H3Event,\n  manager: McpClientManager,\n) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    serverId?: unknown;\n    uri?: unknown;\n  };\n  const serverId = typeof body.serverId === \"string\" ? body.serverId : \"\";\n  const uri = typeof body.uri === \"string\" ? body.uri : \"\";\n  if (!serverId || !uri.startsWith(\"ui://\")) {\n    setResponseStatus(event, 400);\n    return { error: \"serverId and ui:// uri are required\" };\n  }\n  return withMcpAppRequestContext(event, async () => {\n    if (\n      !manager.hasServer(serverId) ||\n      !serverHasVisibleTools(manager, serverId)\n    ) {\n      setResponseStatus(event, 403);\n      return { error: \"MCP server is not available in this request scope\" };\n    }\n    try {\n      return await manager.readResource(serverId, uri);\n    } catch (err: any) {\n      setResponseStatus(event, 400);\n      return { error: err?.message ?? \"MCP resource read failed\" };\n    }\n  });\n}\n\nasync function handleBuiltinList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  capabilities: ClientBuiltinCapability[];\n  user: { enabledIds: BuiltinMcpCapabilityId[] };\n  org: {\n    enabledIds: BuiltinMcpCapabilityId[];\n    orgId: string | null;\n    role: string | null;\n  };\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const supported = areBuiltinMcpCapabilitiesSupported();\n  const userEnabled =\n    supported && email\n      ? await listEnabledBuiltinMcpCapabilities(\"user\", email)\n      : [];\n  const orgEnabled =\n    supported && orgId\n      ? await listEnabledBuiltinMcpCapabilities(\"org\", orgId)\n      : [];\n\n  return {\n    capabilities: (supported ? BUILTIN_MCP_CAPABILITIES : []).map(\n      (capability) => {\n        const available = isBuiltinMcpCapabilityAvailable(capability);\n        const userMergedId = email\n          ? builtinMergedConfigKey(\"user\", capability, email)\n          : undefined;\n        const orgMergedId = orgId\n          ? builtinMergedConfigKey(\"org\", capability, orgId)\n          : undefined;\n        return {\n          id: capability.id,\n          serverId: capability.serverId,\n          name: capability.name,\n          description: capability.description,\n          command: capability.command,\n          args: capability.args,\n          exclusiveGroup: capability.exclusiveGroup,\n          available,\n          unavailableReason: available\n            ? undefined\n            : `Only available on ${capability.platforms?.join(\", \")}`,\n          notes: capability.notes,\n          enabled: {\n            user: userEnabled.includes(capability.id),\n            org: orgEnabled.includes(capability.id),\n          },\n          mergedIds: {\n            user: userMergedId,\n            org: orgMergedId,\n          },\n          status: {\n            user:\n              userMergedId && userEnabled.includes(capability.id)\n                ? statusFor(manager, userMergedId)\n                : undefined,\n            org:\n              orgMergedId && orgEnabled.includes(capability.id)\n                ? statusFor(manager, orgMergedId)\n                : undefined,\n          },\n        };\n      },\n    ),\n    user: { enabledIds: userEnabled },\n    org: { enabledIds: orgEnabled, orgId, role },\n  };\n}\n\nasync function handleBuiltinUpdate(event: H3Event, manager: McpClientManager) {\n  if (!areBuiltinMcpCapabilitiesSupported()) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"Built-in local MCP capabilities are only available in local development.\",\n    };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    enabledIds?: unknown;\n    id?: unknown;\n    enabled?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error:\n          \"You must belong to an organization to change org-scope built-ins\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can change org-scope MCP built-ins\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  if (Array.isArray(body.enabledIds)) {\n    for (const rawId of body.enabledIds) {\n      const error = validateBuiltinCapabilityForEnable(String(rawId));\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    }\n    await setEnabledBuiltinMcpCapabilities(\n      scope,\n      scopeId,\n      body.enabledIds.map(String),\n    );\n  } else if (typeof body.id === \"string\" && typeof body.enabled === \"boolean\") {\n    if (body.enabled) {\n      const error = validateBuiltinCapabilityForEnable(body.id);\n      if (error) {\n        setResponseStatus(event, 400);\n        return { error };\n      }\n    } else if (!getBuiltinMcpCapability(body.id)) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n    const result = await setBuiltinMcpCapabilityEnabled(\n      scope,\n      scopeId,\n      body.id,\n      body.enabled,\n    );\n    if (!result) {\n      setResponseStatus(event, 400);\n      return { error: `Unknown built-in MCP capability \"${body.id}\"` };\n    }\n  } else {\n    setResponseStatus(event, 400);\n    return { error: \"Provide enabledIds or id + enabled\" };\n  }\n\n  await reconfigureManager(manager);\n  return handleBuiltinList(event, manager);\n}\n\nfunction validateBuiltinCapabilityForEnable(id: string): string | null {\n  const capability = getBuiltinMcpCapability(id);\n  if (!capability) return `Unknown built-in MCP capability \"${id}\"`;\n  if (!listSupportedBuiltinMcpCapabilities().includes(capability)) {\n    if (!areBuiltinMcpCapabilitiesSupported()) {\n      return \"Built-in local MCP capabilities are only available in local development.\";\n    }\n    return `${capability.name} is only available on ${capability.platforms?.join(\", \")}`;\n  }\n  return null;\n}\n\nasync function handleList(\n  event: H3Event,\n  manager: McpClientManager,\n): Promise<{\n  user: ClientServer[];\n  org: ClientServer[];\n  orgId: string | null;\n  role: string | null;\n}> {\n  const { email, orgId, role } = await resolveContextForRequest(event);\n  const userServers = email ? await listRemoteServers(\"user\", email) : [];\n  const orgServers = orgId ? await listRemoteServers(\"org\", orgId) : [];\n  return {\n    user: userServers.map((s) =>\n      projectForClient(\n        s,\n        \"user\",\n        email ?? \"\",\n        statusFor(manager, mergedConfigKey(\"user\", s, email ?? \"\")),\n      ),\n    ),\n    org: orgServers.map((s) =>\n      projectForClient(\n        s,\n        \"org\",\n        orgId ?? \"\",\n        statusFor(manager, mergedConfigKey(\"org\", s, orgId ?? \"\")),\n      ),\n    ),\n    orgId,\n    role,\n  };\n}\n\nasync function handleAdd(event: H3Event, manager: McpClientManager) {\n  const body = (await readBody(event).catch(() => ({}))) as {\n    scope?: unknown;\n    name?: unknown;\n    url?: unknown;\n    headers?: unknown;\n    description?: unknown;\n  };\n  const scope =\n    body.scope === \"org\" ? \"org\" : body.scope === \"user\" ? \"user\" : null;\n  if (!scope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope must be \"user\" or \"org\"' };\n  }\n  const name = typeof body.name === \"string\" ? body.name : \"\";\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  if (!name.trim() || !url.trim()) {\n    setResponseStatus(event, 400);\n    return { error: \"name and url are required\" };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const description =\n    typeof body.description === \"string\" ? body.description : undefined;\n\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (scope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return {\n        error: \"You must belong to an organization to add an org-scope server\",\n      };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return { error: \"Only owners and admins can add org-scope MCP servers\" };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const result = await addRemoteServer(scope, scopeId, {\n    name,\n    url,\n    headers,\n    description,\n  });\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { error: result.error };\n  }\n\n  await reconfigureManager(manager);\n  const mergedId = mergedConfigKey(scope, result.server, scopeId);\n  return {\n    ok: true,\n    server: projectForClient(\n      result.server,\n      scope,\n      scopeId,\n      statusFor(manager, mergedId),\n    ),\n  };\n}\n\nasync function handleDelete(\n  event: H3Event,\n  manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId, role } = await resolveContextForRequest(event);\n\n  let scopeId: string | null = null;\n  if (parsedScope === \"user\") {\n    scopeId = email;\n  } else {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"No active organization\" };\n    }\n    if (role !== \"owner\" && role !== \"admin\") {\n      setResponseStatus(event, 403);\n      return {\n        error: \"Only owners and admins can remove org-scope MCP servers\",\n      };\n    }\n    scopeId = orgId;\n  }\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const removed = await removeRemoteServer(parsedScope, scopeId, id);\n  if (!removed) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  await reconfigureManager(manager);\n  return { ok: true };\n}\n\nasync function handleTestUrl(event: H3Event) {\n  const { email, orgId } = await resolveContextForRequest(event);\n  if (!email && !orgId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n\n  const body = (await readBody(event).catch(() => ({}))) as {\n    url?: unknown;\n    headers?: unknown;\n  };\n  const url = typeof body.url === \"string\" ? body.url : \"\";\n  const check = validateRemoteUrl(url);\n  if (!check.ok) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: check.error };\n  }\n  const headers = normalizeHeaders(body.headers);\n  const result = await tryConnect(check.url!.toString(), headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function handleTestExisting(\n  event: H3Event,\n  _manager: McpClientManager,\n  id: string,\n) {\n  const scope = getQuery(event).scope;\n  const parsedScope =\n    scope === \"org\" ? \"org\" : scope === \"user\" ? \"user\" : null;\n  if (!parsedScope) {\n    setResponseStatus(event, 400);\n    return { error: 'scope query param must be \"user\" or \"org\"' };\n  }\n  const { email, orgId } = await resolveContextForRequest(event);\n  const scopeId = parsedScope === \"user\" ? email : orgId;\n  if (!scopeId) {\n    setResponseStatus(event, 401);\n    return { error: \"Authentication required\" };\n  }\n  const list = await listRemoteServers(parsedScope, scopeId);\n  const server = list.find((s) => s.id === id);\n  if (!server) {\n    setResponseStatus(event, 404);\n    return { error: \"Server not found\" };\n  }\n  // `server.headers` holds only the cleartext (non-secret) subset; auth headers\n  // (Authorization, API keys) live encrypted in app_secrets and are resolved by\n  // toHttpServerConfigAsync. Testing with cleartext-only headers would fail for\n  // any server that uses encrypted credentials.\n  const config = await toHttpServerConfigAsync(parsedScope, scopeId, server);\n  const result = await tryConnect(server.url, config.headers);\n  if (result.ok !== true) {\n    setResponseStatus(event, 400);\n    return { ok: false, error: result.error };\n  }\n  return { ok: true, toolCount: result.toolCount, tools: result.tools };\n}\n\nasync function tryConnect(\n  url: string,\n  headers?: Record<string, string>,\n): Promise<\n  | { ok: true; toolCount: number; tools: string[] }\n  | { ok: false; error: string }\n> {\n  try {\n    const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([\n      import(\"@modelcontextprotocol/sdk/client/index.js\"),\n      import(\"@modelcontextprotocol/sdk/client/streamableHttp.js\"),\n    ]);\n    const requestInit: Record<string, unknown> = {};\n    if (headers && Object.keys(headers).length > 0) {\n      requestInit.headers = headers;\n    }\n    const transport = new StreamableHTTPClientTransport(new URL(url), {\n      requestInit,\n    });\n    const client = new Client(\n      { name: \"agent-native-mcp-client-test\", version: \"1.0.0\" },\n      { capabilities: {} },\n    );\n    try {\n      await client.connect(transport);\n      const listed = await client.listTools();\n      const names = ((listed?.tools ?? []) as Array<{ name: string }>).map(\n        (t) => t.name,\n      );\n      return { ok: true, toolCount: names.length, tools: names };\n    } finally {\n      try {\n        await client.close();\n      } catch {}\n      try {\n        await transport.close();\n      } catch {}\n    }\n  } catch (err: any) {\n    return { ok: false, error: formatMcpConnectError(err) };\n  }\n}\n\nfunction normalizeHeaders(input: unknown): Record<string, string> | undefined {\n  if (!input || typeof input !== \"object\") return undefined;\n  const out: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input as Record<string, unknown>)) {\n    if (typeof k !== \"string\" || !k.trim()) continue;\n    if (typeof v !== \"string\") continue;\n    out[k.trim()] = v;\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n}\n"]}

package/dist/org/context.d.ts

@@ -11,6 +11,10 @@ import type { OrgContext, OrgRole } from "./types.js";
  *   per deployment so templates that don't use orgs don't accrue phantom
  *   default orgs in their DB. The <RequireActiveOrg> client guard remains
  *   the safety net for pre-existing accounts or provisioning failures.
+ *
+ * Per-request memoized on `event.context` — mirrors the `getSession`
+ * pattern so multiple callers in the same request (e.g. ssr-handler +
+ * a loader) share a single org_members round trip.
  */
 export declare function getOrgContext(event: H3Event): Promise<OrgContext>;
 /**

package/dist/org/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAmBtD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAiGvE;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAiB,GACtB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAqBD;AAqLD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAepD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/org/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAmBtD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAOvE;AAqGD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,OAAiB,GACtB,OAAO,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC,CAqBD;AAqLD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAepD"}

package/dist/org/context.js

@@ -26,8 +26,18 @@ const nanoid = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
  *   per deployment so templates that don't use orgs don't accrue phantom
  *   default orgs in their DB. The <RequireActiveOrg> client guard remains
  *   the safety net for pre-existing accounts or provisioning failures.
+ *
+ * Per-request memoized on `event.context` — mirrors the `getSession`
+ * pattern so multiple callers in the same request (e.g. ssr-handler +
+ * a loader) share a single org_members round trip.
  */
 export async function getOrgContext(event) {
+    // Per-request memoization. Multiple call sites per request (action wrappers,
+    // SSR handler, loaders) must not each pay a separate org_members query.
+    const ctx = event.context;
+    return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));
+}
+async function resolveOrgContextUncached(event) {
     const session = await getSession(event);
     const email = session?.email;
     if (!email)