@agent-native/core 0.7.13 → 0.7.15

package/dist/mcp-client/remote-store.d.ts

@@ -9,6 +9,15 @@
  * Both scopes store the same shape — a list of `StoredRemoteMcpServer`
  * records. The running MCP manager merges this list with the file-based
  * `mcp.config.json` on startup and after every mutation.
+ *
+ * SECURITY: HTTP MCP servers commonly require a bearer token in the
+ * `Authorization` header. Those values are written to the encrypted
+ * `app_secrets` table (AES-256-GCM via writeAppSecret). The settings row
+ * stores only the secret-key reference (`headerSecretKey`), not the raw
+ * value. Callers retrieving headers must call `materializeHeaders` to
+ * fetch the cleartext at request time. Legacy rows that wrote headers
+ * cleartext into `headers` continue to work read-only — they should be
+ * re-saved to migrate.
  */
 import type { McpHttpServerConfig } from "./config.js";
 export type RemoteMcpScope = "user" | "org";
@@ -19,8 +28,21 @@ export interface StoredRemoteMcpServer {
     name: string;
     /** Streamable HTTP MCP server URL. */
     url: string;
-    /** Optional headers to pass (e.g. `Authorization: Bearer …`). */
+    /**
+     * Optional non-secret headers to pass to the MCP server. SECURITY: secret
+     * material (Authorization, X-Api-Key, …) is moved out of this field at
+     * write time and stored encrypted in `app_secrets`; see
+     * `headerSecretKey`. Legacy rows may still contain cleartext headers and
+     * are honored read-only.
+     */
     headers?: Record<string, string>;
+    /**
+     * Reference to the encrypted secret holding the JSON-stringified secret
+     * headers map (e.g. `{"Authorization":"Bearer …"}`). Resolved at request
+     * time via `readAppSecret`. Undefined when no secret-class headers were
+     * supplied (or for legacy cleartext rows).
+     */
+    headerSecretKey?: string;
     /** Optional description shown in the UI. */
     description?: string;
     /** ms since epoch. */
@@ -62,13 +84,39 @@ export declare function addRemoteServer(scope: RemoteMcpScope, scopeId: string,
     error: string;
 }>;
 export declare function removeRemoteServer(scope: RemoteMcpScope, scopeId: string, id: string): Promise<boolean>;
+/**
+ * Resolve the full headers map (cleartext + decrypted secret headers) for a
+ * stored MCP server. Used when projecting the stored record into the
+ * runtime `McpHttpServerConfig` shape that `McpClientManager` consumes.
+ *
+ * For legacy rows that wrote secrets cleartext into `headers`, this
+ * returns those cleartext values unchanged — they should be re-saved
+ * through `addRemoteServer` to migrate to encrypted storage.
+ */
+export declare function materializeHeaders(scope: RemoteMcpScope, scopeId: string, stored: StoredRemoteMcpServer): Promise<Record<string, string> | undefined>;
 /**
  * Project a stored server into the runtime `McpHttpServerConfig` shape that
  * `McpClientManager` consumes. The merged-config key is the scope + name
  * so a user-scope and org-scope server can both share a readable name
  * without clobbering each other.
+ *
+ * SECURITY: when the stored row references encrypted headers
+ * (`headerSecretKey`), callers should use `toHttpServerConfigAsync`
+ * instead — this synchronous variant returns ONLY the cleartext headers
+ * already present on the row. Returning the row's literal headers without
+ * the secret material means the runtime client would call the MCP server
+ * without auth (request will fail), but never leaks the encrypted secret.
  */
 export declare function toHttpServerConfig(stored: StoredRemoteMcpServer): McpHttpServerConfig;
+/**
+ * Async variant of `toHttpServerConfig` that resolves any encrypted
+ * `headerSecretKey` reference from `app_secrets` and returns the full
+ * cleartext headers map for use at runtime. Use this when actually
+ * configuring an MCP client; use the sync variant only when serializing
+ * stored data (e.g. for read-only listings that shouldn't disclose
+ * secrets).
+ */
+export declare function toHttpServerConfigAsync(scope: RemoteMcpScope, scopeId: string, stored: StoredRemoteMcpServer): Promise<McpHttpServerConfig>;
 /**
  * Build the merged-config key for a stored server.
  *

package/dist/mcp-client/remote-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-store.d.ts","sourceRoot":"","sources":["../../src/mcp-client/remote-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,CAAC;AAE5C,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAUD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/C;AAUD,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAC9C,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAgBA;AA4BD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAElC;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CACR;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAC3E,CAwBA;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,qBAAqB,GAC5B,mBAAmB,CAOrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,MAAM,GACd,MAAM,CAGR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,MAAM,GACpB;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkB/D"}
+{"version":3,"file":"remote-store.d.ts","sourceRoot":"","sources":["../../src/mcp-client/remote-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAmBH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,CAAC;AAM5C,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAgDD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK/C;AAgGD,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAC9C,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAwBA;AA4BD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAElC;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CACR;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAC3E,CA8CA;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,OAAO,CAAC,CAgClB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,CAuB7C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,qBAAqB,GAC5B,mBAAmB,CAOrB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAO9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,MAAM,GACd,MAAM,CAGR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,MAAM,GACpB;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkB/D"}

package/dist/mcp-client/remote-store.js

@@ -9,11 +9,60 @@
  * Both scopes store the same shape — a list of `StoredRemoteMcpServer`
  * records. The running MCP manager merges this list with the file-based
  * `mcp.config.json` on startup and after every mutation.
+ *
+ * SECURITY: HTTP MCP servers commonly require a bearer token in the
+ * `Authorization` header. Those values are written to the encrypted
+ * `app_secrets` table (AES-256-GCM via writeAppSecret). The settings row
+ * stores only the secret-key reference (`headerSecretKey`), not the raw
+ * value. Callers retrieving headers must call `materializeHeaders` to
+ * fetch the cleartext at request time. Legacy rows that wrote headers
+ * cleartext into `headers` continue to work read-only — they should be
+ * re-saved to migrate.
  */
 import { createHash } from "node:crypto";
 import { getUserSetting, putUserSetting, deleteUserSetting, } from "../settings/user-settings.js";
 import { getOrgSetting, putOrgSetting, deleteOrgSetting, } from "../settings/org-settings.js";
+import { writeAppSecret, readAppSecret, deleteAppSecret, } from "../secrets/storage.js";
 const SETTINGS_KEY = "mcp-servers-remote";
+function toSecretScope(scope) {
+    return scope === "user" ? "user" : "workspace";
+}
+/**
+ * Header names that are routed through the encrypted-at-rest secrets store
+ * instead of being written to the plaintext `settings` row. Match is
+ * case-insensitive and substring-based to catch one-off names like
+ * `x-zapier-api-key`.
+ */
+const SECRET_HEADER_NAME_PATTERNS = [
+    /authorization/i,
+    /api[-_]?key/i,
+    /token/i,
+    /secret/i,
+    /bearer/i,
+    /x-.*-key/i,
+];
+function isSecretHeaderName(name) {
+    return SECRET_HEADER_NAME_PATTERNS.some((re) => re.test(name));
+}
+/** Split a headers map into (cleartext, secret) buckets. */
+function partitionHeaders(headers) {
+    if (!headers)
+        return { cleartext: undefined, secret: undefined };
+    const cleartext = {};
+    const secret = {};
+    for (const [k, v] of Object.entries(headers)) {
+        if (typeof v !== "string")
+            continue;
+        if (isSecretHeaderName(k))
+            secret[k] = v;
+        else
+            cleartext[k] = v;
+    }
+    return {
+        cleartext: Object.keys(cleartext).length > 0 ? cleartext : undefined,
+        secret: Object.keys(secret).length > 0 ? secret : undefined,
+    };
+}
 /** Tiny nanoid — matches the inline helper used elsewhere in this package. */
 function shortId() {
     const rand = globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
@@ -54,6 +103,102 @@ export function hashEmail(email) {
 function sanitiseOrgId(orgId) {
     return orgId.toLowerCase().replace(/[^a-z0-9-]/g, "-");
 }
+/**
+ * Hostname patterns that are always rejected to prevent SSRF via DNS rebinding
+ * or well-known internal service names.
+ */
+const BLOCKED_HOSTNAME_PATTERNS = [
+    /^localhost$/i,
+    /\.localhost$/i,
+    /\.local$/i,
+    /\.internal$/i,
+    // DNS rebind services
+    /\.nip\.io$/i,
+    /\.sslip\.io$/i,
+    /\.xip\.io$/i,
+    /\.localtest\.me$/i,
+    /\.lvh\.me$/i,
+    // Cloud metadata hosts
+    /^metadata\.google\.internal$/i,
+    /^instance-data$/i,
+];
+/** Literal IPs that are always rejected (cloud metadata endpoints). */
+const BLOCKED_IPS = new Set([
+    "169.254.169.254", // AWS/GCP/Azure IMDS
+    "100.100.100.200", // Alibaba Cloud metadata
+    "::1",
+]);
+/** Parse a dotted-decimal IPv4 string to a 32-bit integer for range checks. */
+function ipv4ToInt(ip) {
+    const parts = ip.split(".");
+    if (parts.length !== 4)
+        return null;
+    let n = 0;
+    for (const part of parts) {
+        const byte = parseInt(part, 10);
+        if (isNaN(byte) || byte < 0 || byte > 255)
+            return null;
+        n = (n << 8) | byte;
+    }
+    return n >>> 0;
+}
+function isPrivateIpv4(hostname) {
+    const n = ipv4ToInt(hostname);
+    if (n === null)
+        return false;
+    // 10.0.0.0/8
+    if ((n & 0xff000000) >>> 0 === 0x0a000000)
+        return true;
+    // 172.16.0.0/12
+    if ((n & 0xfff00000) >>> 0 === 0xac100000)
+        return true;
+    // 192.168.0.0/16
+    if ((n & 0xffff0000) >>> 0 === 0xc0a80000)
+        return true;
+    // 169.254.0.0/16 (link-local, includes AWS/GCP metadata)
+    if ((n & 0xffff0000) >>> 0 === 0xa9fe0000)
+        return true;
+    // 127.0.0.0/8 (loopback)
+    if ((n & 0xff000000) >>> 0 === 0x7f000000)
+        return true;
+    return false;
+}
+function isBlockedHostname(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (BLOCKED_IPS.has(normalized))
+        return true;
+    if (isPrivateIpv4(normalized))
+        return true;
+    // IPv6 ULA (fc00::/7) and link-local (fe80::/10)
+    if (normalized === "::1")
+        return true;
+    if (normalized.startsWith("fc") || normalized.startsWith("fd"))
+        return true;
+    if (normalized.startsWith("fe80"))
+        return true;
+    if (normalized.startsWith("::ffff:")) {
+        const mapped = normalized.slice("::ffff:".length);
+        if (isPrivateIpv4(mapped))
+            return true;
+        const hexMatch = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(mapped);
+        if (hexMatch) {
+            const value = (parseInt(hexMatch[1], 16) << 16) | parseInt(hexMatch[2], 16);
+            const dotted = [
+                (value >>> 24) & 0xff,
+                (value >>> 16) & 0xff,
+                (value >>> 8) & 0xff,
+                value & 0xff,
+            ].join(".");
+            if (isPrivateIpv4(dotted))
+                return true;
+        }
+    }
+    for (const pattern of BLOCKED_HOSTNAME_PATTERNS) {
+        if (pattern.test(normalized))
+            return true;
+    }
+    return false;
+}
 /** Reject obviously-wrong URLs. Allows http only for localhost. */
 export function validateRemoteUrl(raw) {
     let url;
@@ -63,11 +208,18 @@ export function validateRemoteUrl(raw) {
     catch {
         return { ok: false, error: "Not a valid URL" };
     }
-    if (url.protocol === "https:")
+    if (url.protocol === "https:") {
+        if (isBlockedHostname(url.hostname)) {
+            return {
+                ok: false,
+                error: `Host "${url.hostname}" is not allowed (private/internal address)`,
+            };
+        }
         return { ok: true, url };
+    }
     if (url.protocol === "http:") {
         const host = url.hostname;
-        if (host === "localhost" || host === "127.0.0.1" || host === "::1") {
+        if (host === "localhost" || host === "127.0.0.1") {
             return { ok: true, url };
         }
         return { ok: false, error: "Plain http is only allowed for localhost" };
@@ -104,13 +256,35 @@ export async function addRemoteServer(scope, scopeId, input) {
     if (existing.some((s) => s.name === name)) {
         return { ok: false, error: `A server named "${name}" already exists` };
     }
+    const id = `mcps_${shortId()}`;
+    const { cleartext, secret } = partitionHeaders(input.headers);
+    // Persist secret-class headers in the encrypted secrets table; the
+    // settings row only references the secret key, never the cleartext.
+    let headerSecretKey;
+    if (secret) {
+        headerSecretKey = `mcp_headers:${id}`;
+        try {
+            await writeAppSecret({
+                key: headerSecretKey,
+                value: JSON.stringify(secret),
+                scope: toSecretScope(scope),
+                scopeId,
+                description: `Encrypted MCP headers for ${name}`,
+            });
+        }
+        catch (err) {
+            return {
+                ok: false,
+                error: `Failed to encrypt MCP headers: ${err?.message ?? err}`,
+            };
+        }
+    }
     const server = {
-        id: `mcps_${shortId()}`,
+        id,
         name,
         url: urlCheck.url.toString(),
-        headers: input.headers && Object.keys(input.headers).length > 0
-            ? { ...input.headers }
-            : undefined,
+        headers: cleartext,
+        headerSecretKey,
         description: input.description?.trim() || undefined,
         createdAt: Date.now(),
     };
@@ -119,6 +293,7 @@ export async function addRemoteServer(scope, scopeId, input) {
 }
 export async function removeRemoteServer(scope, scopeId, id) {
     const existing = await readList(scope, scopeId);
+    const removed = existing.find((s) => s.id === id);
     const next = existing.filter((s) => s.id !== id);
     if (next.length === existing.length)
         return false;
@@ -133,13 +308,69 @@ export async function removeRemoteServer(scope, scopeId, id) {
     else {
         await writeList(scope, scopeId, next);
     }
+    // Best-effort: drop the encrypted-headers secret too. Errors are logged
+    // but don't fail the deletion — the settings row is already gone, so a
+    // dangling secret is harmless (it just can't be read back).
+    if (removed?.headerSecretKey) {
+        try {
+            await deleteAppSecret({
+                key: removed.headerSecretKey,
+                scope: toSecretScope(scope),
+                scopeId,
+            });
+        }
+        catch (err) {
+            // eslint-disable-next-line no-console
+            console.warn(`[mcp-client] Failed to delete MCP header secret ${removed.headerSecretKey}: ${err?.message ?? err}`);
+        }
+    }
     return true;
 }
+/**
+ * Resolve the full headers map (cleartext + decrypted secret headers) for a
+ * stored MCP server. Used when projecting the stored record into the
+ * runtime `McpHttpServerConfig` shape that `McpClientManager` consumes.
+ *
+ * For legacy rows that wrote secrets cleartext into `headers`, this
+ * returns those cleartext values unchanged — they should be re-saved
+ * through `addRemoteServer` to migrate to encrypted storage.
+ */
+export async function materializeHeaders(scope, scopeId, stored) {
+    const merged = { ...(stored.headers ?? {}) };
+    if (stored.headerSecretKey) {
+        try {
+            const secret = await readAppSecret({
+                key: stored.headerSecretKey,
+                scope: toSecretScope(scope),
+                scopeId,
+            });
+            if (secret) {
+                const parsed = JSON.parse(secret.value);
+                for (const [k, v] of Object.entries(parsed)) {
+                    if (typeof v === "string")
+                        merged[k] = v;
+                }
+            }
+        }
+        catch (err) {
+            // eslint-disable-next-line no-console
+            console.warn(`[mcp-client] Failed to decrypt MCP headers for ${stored.name}: ${err?.message ?? err}`);
+        }
+    }
+    return Object.keys(merged).length > 0 ? merged : undefined;
+}
 /**
  * Project a stored server into the runtime `McpHttpServerConfig` shape that
  * `McpClientManager` consumes. The merged-config key is the scope + name
  * so a user-scope and org-scope server can both share a readable name
  * without clobbering each other.
+ *
+ * SECURITY: when the stored row references encrypted headers
+ * (`headerSecretKey`), callers should use `toHttpServerConfigAsync`
+ * instead — this synchronous variant returns ONLY the cleartext headers
+ * already present on the row. Returning the row's literal headers without
+ * the secret material means the runtime client would call the MCP server
+ * without auth (request will fail), but never leaks the encrypted secret.
  */
 export function toHttpServerConfig(stored) {
     return {
@@ -149,6 +380,22 @@ export function toHttpServerConfig(stored) {
         description: stored.description,
     };
 }
+/**
+ * Async variant of `toHttpServerConfig` that resolves any encrypted
+ * `headerSecretKey` reference from `app_secrets` and returns the full
+ * cleartext headers map for use at runtime. Use this when actually
+ * configuring an MCP client; use the sync variant only when serializing
+ * stored data (e.g. for read-only listings that shouldn't disclose
+ * secrets).
+ */
+export async function toHttpServerConfigAsync(scope, scopeId, stored) {
+    return {
+        type: "http",
+        url: stored.url,
+        headers: await materializeHeaders(scope, scopeId, stored),
+        description: stored.description,
+    };
+}
 /**
  * Build the merged-config key for a stored server.
  *

package/dist/mcp-client/remote-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-store.js","sourceRoot":"","sources":["../../src/mcp-client/remote-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAmB1C,8EAA8E;AAC9E,SAAS,OAAO;IACd,MAAM,IAAI,GACR,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,KAAK;SACT,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAK3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAqB,EACrB,OAAe;IAEf,MAAM,GAAG,GACP,KAAK,KAAK,MAAM;QACd,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC;QAC7C,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,GAAW,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5D,OAAS,GAAW,CAAC,OAAmC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,KAAqB,EACrB,OAAe,EACf,OAAgC;IAEhC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAqB,EACrB,OAAe;IAEf,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAqB,EACrB,OAAe,EACf,KAKC;IAID,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;IAE3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,IAAI,kBAAkB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,MAAM,GAA0B;QACpC,EAAE,EAAE,QAAQ,OAAO,EAAE,EAAE;QACvB,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;QAC7B,OAAO,EACL,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YACpD,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;YACtB,CAAC,CAAC,SAAS;QACf,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS;QACnD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAqB,EACrB,OAAe,EACf,EAAU;IAEV,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,MAA6B,EAC7B,OAAe;IAEf,MAAM,KAAK,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,GAAG,KAAK,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,aAAqB;IAErB,IAAI,GAAG,GAAG,aAAa,CAAC;IACxB,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,KAAK,GAAmB,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,OAAO;QACL,KAAK;QACL,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"remote-store.js","sourceRoot":"","sources":["../../src/mcp-client/remote-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAI/B,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAI1C,SAAS,aAAa,CAAC,KAAqB;IAC1C,OAAO,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;AACjD,CAAC;AA8BD;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG;IAClC,gBAAgB;IAChB,cAAc;IACd,QAAQ;IACR,SAAS;IACT,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,SAAS,gBAAgB,CAAC,OAA2C;IAInE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjE,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,IAAI,kBAAkB,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;;YACpC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACpE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,OAAO;IACd,MAAM,IAAI,GACR,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,KAAK;SACT,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,yBAAyB,GAAa;IAC1C,cAAc;IACd,eAAe;IACf,WAAW;IACX,cAAc;IACd,sBAAsB;IACtB,aAAa;IACb,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,aAAa;IACb,uBAAuB;IACvB,+BAA+B;IAC/B,kBAAkB;CACnB,CAAC;AAEF,uEAAuE;AACvE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,iBAAiB,EAAE,qBAAqB;IACxC,iBAAiB,EAAE,yBAAyB;IAC5C,KAAK;CACN,CAAC,CAAC;AAEH,+EAA+E;AAC/E,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QACvD,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,aAAa;IACb,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACvD,gBAAgB;IAChB,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACvD,iBAAiB;IACjB,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACvD,yDAAyD;IACzD,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACvD,yBAAyB;IACzB,IAAI,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,aAAa,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,iDAAiD;IACjD,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,QAAQ,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GACT,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG;gBACb,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI;gBACrB,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI;gBACrB,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,IAAI;gBACpB,KAAK,GAAG,IAAI;aACb,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,IAAI,aAAa,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAK3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,SAAS,GAAG,CAAC,QAAQ,6CAA6C;aAC1E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAqB,EACrB,OAAe;IAEf,MAAM,GAAG,GACP,KAAK,KAAK,MAAM;QACd,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC;QAC7C,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,GAAW,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5D,OAAS,GAAW,CAAC,OAAmC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAClE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,KAAqB,EACrB,OAAe,EACf,OAAgC;IAEhC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAqB,EACrB,OAAe;IAEf,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAqB,EACrB,OAAe,EACf,KAKC;IAID,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;IAE3E,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,IAAI,kBAAkB,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,EAAE,GAAG,QAAQ,OAAO,EAAE,EAAE,CAAC;IAC/B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE9D,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,eAAmC,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,eAAe,GAAG,eAAe,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,cAAc,CAAC;gBACnB,GAAG,EAAE,eAAe;gBACpB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAC7B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC3B,OAAO;gBACP,WAAW,EAAE,6BAA6B,IAAI,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE;aAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA0B;QACpC,EAAE;QACF,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,GAAI,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,SAAS;QAClB,eAAe;QACf,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS;QACnD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAqB,EACrB,OAAe,EACf,EAAU;IAEV,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,wEAAwE;IACxE,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,eAAe,CAAC;gBACpB,GAAG,EAAE,OAAO,CAAC,eAAe;gBAC5B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC3B,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,mDAAmD,OAAO,CAAC,eAAe,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAqB,EACrB,OAAe,EACf,MAA6B;IAE7B,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;gBACjC,GAAG,EAAE,MAAM,CAAC,eAAe;gBAC3B,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;gBAC3B,OAAO;aACR,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAA2B,CAAC;gBAClE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,kDAAkD,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAqB,EACrB,OAAe,EACf,MAA6B;IAE7B,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,MAAM,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACzD,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,MAA6B,EAC7B,OAAe;IAEf,MAAM,KAAK,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,GAAG,KAAK,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,aAAqB;IAErB,IAAI,GAAG,GAAG,aAAa,CAAC;IACxB,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,KAAK,GAAmB,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,OAAO;QACL,KAAK;QACL,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;KACX,CAAC;AACJ,CAAC"}

package/dist/mcp-client/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,aAAa,CAAC;AAE9D,OAAO,EAOL,KAAK,cAAc,EAEpB,MAAM,mBAAmB,CAAC;AAgC3B,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,KAAK,YAAY,GACb;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAiBzB;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA4CnE;AAoCD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAiDN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,aAAa,CAAC;AAE9D,OAAO,EAOL,KAAK,cAAc,EAEpB,MAAM,mBAAmB,CAAC;AAgC3B,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,KAAK,YAAY,GACb;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAiBzB;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CA+CnE;AAmCD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,GAAG,EACb,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAoDN"}

package/dist/mcp-client/routes.js

@@ -18,7 +18,7 @@ import { getOrgContext } from "../org/context.js";
 import { getSession } from "../server/auth.js";
 import { getAllSettings } from "../settings/store.js";
 import { loadMcpConfig, autoDetectMcpConfig } from "./config.js";
-import { addRemoteServer, listRemoteServers, mergedConfigKey, removeRemoteServer, toHttpServerConfig, validateRemoteUrl, } from "./remote-store.js";
+import { addRemoteServer, listRemoteServers, mergedConfigKey, removeRemoteServer, toHttpServerConfigAsync, validateRemoteUrl, } from "./remote-store.js";
 import { fetchHubServers } from "./hub-client.js";
 /** Redact obvious auth header values before sending to the client. */
 function redactHeaders(headers) {
@@ -93,8 +93,11 @@ export async function buildMergedConfig() {
         for (const stored of list) {
             if (!stored || typeof stored.url !== "string" || !stored.name)
                 continue;
+            // Async resolve: decrypts `headerSecretKey` from app_secrets so the
+            // running MCP client gets the cleartext bearer at request time.
+            // Stored row contains only the secret-key reference, never the value.
             servers[mergedConfigKey(scope, stored, ownerId)] =
-                toHttpServerConfig(stored);
+                await toHttpServerConfigAsync(scope, ownerId, stored);
         }
     }
     // Hub-consume: if this app is configured to consume from a remote hub
@@ -135,11 +138,9 @@ async function resolveContextForRequest(event) {
     catch {
         // ignore — no org context
     }
-    // In solo/dev mode `getSession` can return nothing but getOrgContext still
-    // yields the fallback email. Keep that as the user-scope id so single-user
-    // desktop installs work without a login flow.
-    if (!email)
-        email = "local@localhost";
+    // No silent `local@localhost` fallback — if `getSession` returns nothing in
+    // production (misconfigured deploy, expired token), the caller must reject
+    // rather than silently pool every unauthenticated request under one identity.
     return { email, orgId, role };
 }
 async function reconfigureManager(manager) {
@@ -147,9 +148,10 @@ async function reconfigureManager(manager) {
     await manager.reconfigure(merged);
 }
 export function mountMcpServersRoutes(nitroApp, manager) {
-    if (globalThis.__agentNativeMcpServersMounted)
+    const mountedApps = (globalThis.__agentNativeMcpServersMountedApps ??= new WeakSet());
+    if (mountedApps.has(nitroApp))
         return;
-    globalThis.__agentNativeMcpServersMounted = true;
+    mountedApps.add(nitroApp);
     try {
         getH3App(nitroApp).use("/_agent-native/mcp/servers", defineEventHandler(async (event) => {
             const method = getMethod(event);

package/dist/mcp-client/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,sEAAsE;AACtE,SAAS,aAAa,CACpB,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA6B,EAC7B,KAAqB,EACrB,OAAe,EACf,MAAoB;IAEpB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC;AAoBD,SAAS,SAAS,CAAC,OAAyB,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,KAA+C,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS;YACxE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAc;IAKpD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,iBAAiB,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,OAAyB;IAEzB,IAAK,UAAkB,CAAC,8BAA8B;QAAE,OAAO;IAC9D,UAAkB,CAAC,8BAA8B,GAAG,IAAI,CAAC;IAE1D,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAE7D,+DAA+D;YAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,4DAA4D,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAc,EACd,OAAyB;IAOzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,gBAAgB,CACd,CAAC,EACD,MAAM,EACN,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC5D,CACF;QACD,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB,gBAAgB,CACd,CAAC,EACD,KAAK,EACL,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC3D,CACF;QACD,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,OAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAMpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+DAA+D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE;QACnD,IAAI;QACJ,GAAG;QACH,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,gBAAgB,CACtB,MAAM,CAAC,MAAM,EACb,KAAK,EACL,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,yDAAyD;aACjE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,OAAgC;IAKhC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,6BAA6B,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,MAAM,CAAC,2CAA2C,CAAC;YACnD,MAAM,CAAC,oDAAoD,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA6B,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/mcp-client/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,GAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,sEAAsE;AACtE,SAAS,aAAa,CACpB,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA6B,EAC7B,KAAqB,EACrB,OAAe,EACf,MAAoB;IAEpB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC;AAoBD,SAAS,SAAS,CAAC,OAAyB,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,mBAAmB,EAAE,CAAC;IACtD,MAAM,OAAO,GAAoC,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAE9E,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,KAAK,GAA0B,IAAI,CAAC;QACxC,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,MAAM,CAAC;YACf,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACjC,MAAM,IAAI,GAAI,KAA+C,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,SAAS;YACxE,oEAAoE;YACpE,gEAAgE;YAChE,sEAAsE;YACtE,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC9C,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,2DAA2D;IAC3D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,kCAAkC,GAAG,EAAE,OAAO,IAAI,GAAG,iCAAiC,CACvF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,KAAc;IAKpD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAyB;IACzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAa,EACb,OAAyB;IAEzB,MAAM,WAAW,GAAoB,CACnC,UACD,CAAC,kCAAkC,KAAK,IAAI,OAAO,EAAU,CAAC,CAAC;IAChE,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACtC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE1B,IAAI,CAAC;QACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,4BAA4B,EAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;iBACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAElD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAE7D,+DAA+D;YAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACnE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,kBAAkB;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACxD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,4DAA4D,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAc,EACd,OAAyB;IAOzB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,gBAAgB,CACd,CAAC,EACD,MAAM,EACN,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC5D,CACF;QACD,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB,gBAAgB,CACd,CAAC,EACD,KAAK,EACL,KAAK,IAAI,EAAE,EACX,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAC3D,CACF;QACD,KAAK;QACL,IAAI;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAc,EAAE,OAAyB;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAMpD,CAAC;IACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+DAA+D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE;QACnD,IAAI;QACJ,GAAG;QACH,OAAO;QACP,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,gBAAgB,CACtB,MAAM,CAAC,MAAM,EACb,KAAK,EACL,OAAO,EACP,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC7B;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAErE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACzC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,yDAAyD;aACjE,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,OAAyB,EACzB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;IACpC,MAAM,WAAW,GACf,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,OAAgC;IAKhC,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,6BAA6B,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxE,MAAM,CAAC,2CAA2C,CAAC;YACnD,MAAM,CAAC,oDAAoD,CAAC;SAC7D,CAAC,CAAC;QACH,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE;YAChE,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1D,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QACF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA6B,CAAC,GAAG,CAClE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CACd,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,SAAS;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/mcp-client/visibility.d.ts

@@ -8,9 +8,13 @@
  *   tool's owner component.
  * - Org-scope tools are only visible to requests whose active org matches.
  *
- * Falls back to "visible" when there is no request context (CLI scripts,
- * startup-time tool enumeration) — the runtime gate in `mcpToolToActionEntry`
- * still prevents execution from a mismatched request.
+ * SECURITY: when there is no request context (CLI scripts, MCP server
+ * endpoint without `runWithRequestContext`, etc.) we DENY by default in
+ * production — the runtime gate elsewhere is not a safe substitute when
+ * the gate runs without a context either. In development we still allow
+ * for ergonomics (tool enumeration at startup, ad-hoc CLI runs).
+ *
+ * See finding #5 in /tmp/security-audit/12-mcp-a2a-agent.md.
  */
 export declare function isMcpToolAllowedForRequest(toolName: string): boolean;
 //# sourceMappingURL=visibility.d.ts.map

package/dist/mcp-client/visibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"visibility.d.ts","sourceRoot":"","sources":["../../src/mcp-client/visibility.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAYpE"}
+{"version":3,"file":"visibility.d.ts","sourceRoot":"","sources":["../../src/mcp-client/visibility.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAmBpE"}

package/dist/mcp-client/visibility.js

@@ -22,9 +22,13 @@ import { parseMergedKey, hashEmail } from "./remote-store.js";
  *   tool's owner component.
  * - Org-scope tools are only visible to requests whose active org matches.
  *
- * Falls back to "visible" when there is no request context (CLI scripts,
- * startup-time tool enumeration) — the runtime gate in `mcpToolToActionEntry`
- * still prevents execution from a mismatched request.
+ * SECURITY: when there is no request context (CLI scripts, MCP server
+ * endpoint without `runWithRequestContext`, etc.) we DENY by default in
+ * production — the runtime gate elsewhere is not a safe substitute when
+ * the gate runs without a context either. In development we still allow
+ * for ergonomics (tool enumeration at startup, ad-hoc CLI runs).
+ *
+ * See finding #5 in /tmp/security-audit/12-mcp-a2a-agent.md.
  */
 export function isMcpToolAllowedForRequest(toolName) {
     const parsed = parseMergedKey(toolName);
@@ -32,14 +36,19 @@ export function isMcpToolAllowedForRequest(toolName) {
         return true;
     const email = getRequestUserEmail();
     const orgId = getRequestOrgId();
+    const inProduction = process.env.NODE_ENV === "production";
     if (parsed.scope === "user") {
-        if (!email)
-            return true; // no context → leave the runtime gate to block
+        if (!email) {
+            // No identity in this call chain — block in production, allow in dev
+            // where this commonly happens during startup tool enumeration.
+            return !inProduction;
+        }
         return hashEmail(email) === parsed.owner;
     }
     // scope === "org"
-    if (!orgId)
-        return true;
+    if (!orgId) {
+        return !inProduction;
+    }
     return orgId.toLowerCase().replace(/[^a-z0-9-]/g, "-") === parsed.owner;
 }
 //# sourceMappingURL=visibility.js.map