@agent-native/core 0.79.17 → 0.79.19

package/dist/file-upload/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/file-upload/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,8BAA8B,GAI/B,MAAM,6BAA6B,CAAC","sourcesContent":["export type {\n  FileUploadInput,\n  FileUploadProvider,\n  FileUploadResult,\n} from \"./types.js\";\nexport {\n  registerFileUploadProvider,\n  unregisterFileUploadProvider,\n  listFileUploadProviders,\n  getActiveFileUploadProvider,\n  uploadFile,\n} from \"./registry.js\";\nexport { builderFileUploadProvider } from \"./builder.js\";\nexport {\n  preUploadImageAttachments,\n  preUploadAttachments,\n  isFileUploadProviderConfigured,\n  type PreUploadAttachmentsResult,\n  type PreUploadedImageAttachment,\n  type PreUploadedFileAttachment,\n} from \"./pre-upload-attachments.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/file-upload/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,qCAAqC,EACrC,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,8BAA8B,GAI/B,MAAM,6BAA6B,CAAC","sourcesContent":["export type {\n  FileUploadInput,\n  FileUploadProvider,\n  FileUploadResult,\n} from \"./types.js\";\nexport {\n  registerFileUploadProvider,\n  unregisterFileUploadProvider,\n  listFileUploadProviders,\n  getActiveFileUploadProvider,\n  getActiveFileUploadProviderForRequest,\n  uploadFile,\n} from \"./registry.js\";\nexport { builderFileUploadProvider } from \"./builder.js\";\nexport {\n  preUploadImageAttachments,\n  preUploadAttachments,\n  isFileUploadProviderConfigured,\n  type PreUploadAttachmentsResult,\n  type PreUploadedImageAttachment,\n  type PreUploadedFileAttachment,\n} from \"./pre-upload-attachments.js\";\n"]}

package/dist/file-upload/registry.d.ts

@@ -13,6 +13,7 @@ export declare function listFileUploadProviders(): FileUploadProvider[];
  * SQL fallback.
  */
 export declare function getActiveFileUploadProvider(): FileUploadProvider | null;
+export declare function getActiveFileUploadProviderForRequest(): Promise<FileUploadProvider | null>;
 /**
  * Upload a file via the active provider, or `null` if no provider is
  * configured. Callers use `null` as the signal to fall back to SQL

package/dist/file-upload/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/file-upload/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAmBpB;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAE7E;AAED,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,uBAAuB,IAAI,kBAAkB,EAAE,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,kBAAkB,GAAG,IAAI,CAQvE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA4ClC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/file-upload/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAmBpB;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAE7E;AAED,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,uBAAuB,IAAI,kBAAkB,EAAE,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,kBAAkB,GAAG,IAAI,CAQvE;AAED,wBAAsB,qCAAqC,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgBhG;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA0ClC"}

package/dist/file-upload/registry.js

@@ -31,6 +31,26 @@ export function getActiveFileUploadProvider() {
     }
     return null;
 }
+export async function getActiveFileUploadProviderForRequest() {
+    for (const provider of providers.values()) {
+        if (provider.isConfigured())
+            return provider;
+        if (provider.isConfiguredForRequest) {
+            try {
+                if (await provider.isConfiguredForRequest())
+                    return provider;
+            }
+            catch {
+                // Treat failed scoped credential lookups as unavailable. The upload
+                // call will surface real provider errors after a provider is selected.
+            }
+        }
+    }
+    if (builderFileUploadProvider.isConfigured()) {
+        return builderFileUploadProvider;
+    }
+    return null;
+}
 /**
  * Upload a file via the active provider, or `null` if no provider is
  * configured. Callers use `null` as the signal to fall back to SQL
@@ -38,12 +58,10 @@ export function getActiveFileUploadProvider() {
  * storing files in SQL is not optimal for production.
  */
 export async function uploadFile(input) {
-    const provider = getActiveFileUploadProvider();
-    // Only trust user-registered providers (S3, etc.) from the sync check.
-    // The builder builtin's isConfigured() only checks process.env, which causes
-    // hard failures for authenticated non-local users on multi-tenant deployments
-    // where BUILDER_PRIVATE_KEY is set at the deploy level but the user has no
-    // personal credentials. Always resolve builder credentials asynchronously.
+    const provider = await getActiveFileUploadProviderForRequest();
+    // User-registered providers (S3, etc.) may be configured by sync runtime
+    // state or request-scoped DB secrets. Builder still gets an explicit async
+    // credential check below because its sync isConfigured() only checks env.
     if (provider && provider !== builderFileUploadProvider) {
         return provider.upload(input);
     }

package/dist/file-upload/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/file-upload/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAkBzD,MAAM,OAAO,GAAG,UAAmD,CAAC;AACpE,MAAM,SAAS,GACb,CAAC,OAAO,CAAC,gCAAgC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AAC3D,MAAM,iBAAiB,GACrB,CAAC,OAAO,CAAC,qCAAqC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA4B;IACrE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,EAAU;IACrD,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,YAAY,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC/C,CAAC;IACD,IAAI,yBAAyB,CAAC,YAAY,EAAE,EAAE,CAAC;QAC7C,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAsB;IAEtB,MAAM,QAAQ,GAAG,2BAA2B,EAAE,CAAC;IAC/C,uEAAuE;IACvE,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,QAAQ,IAAI,QAAQ,KAAK,yBAAyB,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACnD,UAAU,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,iDAAiD,EACjD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,oEAAoE;QACpE,oEAAoE;QACpE,OAAO,MAAM,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC7B,iBAAiB,CAAC,KAAK,GAAG,IAAI,CAAC;QAC/B,OAAO,CAAC,IAAI,CACV,qDAAqD;YACnD,8DAA8D;YAC9D,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { builderFileUploadProvider } from \"./builder.js\";\nimport type {\n  FileUploadInput,\n  FileUploadProvider,\n  FileUploadResult,\n} from \"./types.js\";\n\n// Why globalThis: in dev (Vite HMR) and in some Nitro/Rollup bundle splits,\n// this module can be evaluated more than once — the plugin file that\n// registers a provider lands in one module instance and the request handler\n// that reads providers lands in another, so the call site sees an empty map\n// even though `registerFileUploadProvider` succeeded. Pinning the singletons\n// on `globalThis` guarantees one set of providers per Node process,\n// independent of how the bundler split the chunks.\ninterface FileUploadGlobals {\n  __agentNativeFileUploadProviders?: Map<string, FileUploadProvider>;\n  __agentNativeFileUploadWarnedFallback?: { value: boolean };\n}\nconst globals = globalThis as typeof globalThis & FileUploadGlobals;\nconst providers: Map<string, FileUploadProvider> =\n  (globals.__agentNativeFileUploadProviders ??= new Map());\nconst warnedFallbackRef: { value: boolean } =\n  (globals.__agentNativeFileUploadWarnedFallback ??= { value: false });\n\n/**\n * Register a file upload provider. Call from a server plugin or app\n * bootstrap. Idempotent per id — later calls with the same id replace.\n */\nexport function registerFileUploadProvider(provider: FileUploadProvider): void {\n  providers.set(provider.id, provider);\n}\n\nexport function unregisterFileUploadProvider(id: string): void {\n  providers.delete(id);\n}\n\nexport function listFileUploadProviders(): FileUploadProvider[] {\n  return [...providers.values()];\n}\n\n/**\n * Returns the first configured provider, checking user-registered ones first\n * and falling back to the built-in Builder.io provider when its env is set.\n * Returns `null` when nothing is configured — callers should then use the\n * SQL fallback.\n */\nexport function getActiveFileUploadProvider(): FileUploadProvider | null {\n  for (const provider of providers.values()) {\n    if (provider.isConfigured()) return provider;\n  }\n  if (builderFileUploadProvider.isConfigured()) {\n    return builderFileUploadProvider;\n  }\n  return null;\n}\n\n/**\n * Upload a file via the active provider, or `null` if no provider is\n * configured. Callers use `null` as the signal to fall back to SQL\n * storage. On the first fallback we log a one-time warning because\n * storing files in SQL is not optimal for production.\n */\nexport async function uploadFile(\n  input: FileUploadInput,\n): Promise<FileUploadResult | null> {\n  const provider = getActiveFileUploadProvider();\n  // Only trust user-registered providers (S3, etc.) from the sync check.\n  // The builder builtin's isConfigured() only checks process.env, which causes\n  // hard failures for authenticated non-local users on multi-tenant deployments\n  // where BUILDER_PRIVATE_KEY is set at the deploy level but the user has no\n  // personal credentials. Always resolve builder credentials asynchronously.\n  if (provider && provider !== builderFileUploadProvider) {\n    return provider.upload(input);\n  }\n\n  // Resolve credentials asynchronously (works when request context is set\n  // via runWithRequestContext — actions always have one via action-routes.ts).\n  // Two separate try-catch blocks ensure a real upload failure is never\n  // silently swallowed as a \"no credentials\" case.\n  let builderKey: string | null = null;\n  try {\n    const { resolveBuilderPrivateKey } =\n      await import(\"../server/credential-provider.js\");\n    builderKey = await resolveBuilderPrivateKey();\n  } catch (err) {\n    // DB unavailable or credential store not ready — can't resolve key.\n    // Log and fall through to the SQL fallback below.\n    console.warn(\n      \"[agent-native] Builder credential check failed:\",\n      err instanceof Error ? err.message : String(err),\n    );\n  }\n\n  if (builderKey) {\n    // Credentials confirmed — attempt the upload. Real errors (network,\n    // API, rate-limit) propagate to the caller; do NOT catch them here.\n    return await builderFileUploadProvider.upload(input);\n  }\n\n  if (!warnedFallbackRef.value) {\n    warnedFallbackRef.value = true;\n    console.warn(\n      \"[agent-native] No file upload provider configured. \" +\n        \"Connect or reconnect Builder.io in Settings → File uploads, \" +\n        \"or register a custom provider (S3, R2, GCS, …) via registerFileUploadProvider().\",\n    );\n  }\n  return null;\n}\n"]}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/file-upload/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAkBzD,MAAM,OAAO,GAAG,UAAmD,CAAC;AACpE,MAAM,SAAS,GACb,CAAC,OAAO,CAAC,gCAAgC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AAC3D,MAAM,iBAAiB,GACrB,CAAC,OAAO,CAAC,qCAAqC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAA4B;IACrE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,EAAU;IACrD,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B;IACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,YAAY,EAAE;YAAE,OAAO,QAAQ,CAAC;IAC/C,CAAC;IACD,IAAI,yBAAyB,CAAC,YAAY,EAAE,EAAE,CAAC;QAC7C,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC;IACzD,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,YAAY,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC7C,IAAI,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,IAAI,MAAM,QAAQ,CAAC,sBAAsB,EAAE;oBAAE,OAAO,QAAQ,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,uEAAuE;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,yBAAyB,CAAC,YAAY,EAAE,EAAE,CAAC;QAC7C,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,qCAAqC,EAAE,CAAC;IAC/D,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,QAAQ,KAAK,yBAAyB,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACnD,UAAU,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,kDAAkD;QAClD,OAAO,CAAC,IAAI,CACV,iDAAiD,EACjD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,oEAAoE;QACpE,oEAAoE;QACpE,OAAO,MAAM,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC7B,iBAAiB,CAAC,KAAK,GAAG,IAAI,CAAC;QAC/B,OAAO,CAAC,IAAI,CACV,qDAAqD;YACnD,8DAA8D;YAC9D,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { builderFileUploadProvider } from \"./builder.js\";\nimport type {\n  FileUploadInput,\n  FileUploadProvider,\n  FileUploadResult,\n} from \"./types.js\";\n\n// Why globalThis: in dev (Vite HMR) and in some Nitro/Rollup bundle splits,\n// this module can be evaluated more than once — the plugin file that\n// registers a provider lands in one module instance and the request handler\n// that reads providers lands in another, so the call site sees an empty map\n// even though `registerFileUploadProvider` succeeded. Pinning the singletons\n// on `globalThis` guarantees one set of providers per Node process,\n// independent of how the bundler split the chunks.\ninterface FileUploadGlobals {\n  __agentNativeFileUploadProviders?: Map<string, FileUploadProvider>;\n  __agentNativeFileUploadWarnedFallback?: { value: boolean };\n}\nconst globals = globalThis as typeof globalThis & FileUploadGlobals;\nconst providers: Map<string, FileUploadProvider> =\n  (globals.__agentNativeFileUploadProviders ??= new Map());\nconst warnedFallbackRef: { value: boolean } =\n  (globals.__agentNativeFileUploadWarnedFallback ??= { value: false });\n\n/**\n * Register a file upload provider. Call from a server plugin or app\n * bootstrap. Idempotent per id — later calls with the same id replace.\n */\nexport function registerFileUploadProvider(provider: FileUploadProvider): void {\n  providers.set(provider.id, provider);\n}\n\nexport function unregisterFileUploadProvider(id: string): void {\n  providers.delete(id);\n}\n\nexport function listFileUploadProviders(): FileUploadProvider[] {\n  return [...providers.values()];\n}\n\n/**\n * Returns the first configured provider, checking user-registered ones first\n * and falling back to the built-in Builder.io provider when its env is set.\n * Returns `null` when nothing is configured — callers should then use the\n * SQL fallback.\n */\nexport function getActiveFileUploadProvider(): FileUploadProvider | null {\n  for (const provider of providers.values()) {\n    if (provider.isConfigured()) return provider;\n  }\n  if (builderFileUploadProvider.isConfigured()) {\n    return builderFileUploadProvider;\n  }\n  return null;\n}\n\nexport async function getActiveFileUploadProviderForRequest(): Promise<FileUploadProvider | null> {\n  for (const provider of providers.values()) {\n    if (provider.isConfigured()) return provider;\n    if (provider.isConfiguredForRequest) {\n      try {\n        if (await provider.isConfiguredForRequest()) return provider;\n      } catch {\n        // Treat failed scoped credential lookups as unavailable. The upload\n        // call will surface real provider errors after a provider is selected.\n      }\n    }\n  }\n  if (builderFileUploadProvider.isConfigured()) {\n    return builderFileUploadProvider;\n  }\n  return null;\n}\n\n/**\n * Upload a file via the active provider, or `null` if no provider is\n * configured. Callers use `null` as the signal to fall back to SQL\n * storage. On the first fallback we log a one-time warning because\n * storing files in SQL is not optimal for production.\n */\nexport async function uploadFile(\n  input: FileUploadInput,\n): Promise<FileUploadResult | null> {\n  const provider = await getActiveFileUploadProviderForRequest();\n  // User-registered providers (S3, etc.) may be configured by sync runtime\n  // state or request-scoped DB secrets. Builder still gets an explicit async\n  // credential check below because its sync isConfigured() only checks env.\n  if (provider && provider !== builderFileUploadProvider) {\n    return provider.upload(input);\n  }\n\n  // Resolve credentials asynchronously (works when request context is set\n  // via runWithRequestContext — actions always have one via action-routes.ts).\n  // Two separate try-catch blocks ensure a real upload failure is never\n  // silently swallowed as a \"no credentials\" case.\n  let builderKey: string | null = null;\n  try {\n    const { resolveBuilderPrivateKey } =\n      await import(\"../server/credential-provider.js\");\n    builderKey = await resolveBuilderPrivateKey();\n  } catch (err) {\n    // DB unavailable or credential store not ready — can't resolve key.\n    // Log and fall through to the SQL fallback below.\n    console.warn(\n      \"[agent-native] Builder credential check failed:\",\n      err instanceof Error ? err.message : String(err),\n    );\n  }\n\n  if (builderKey) {\n    // Credentials confirmed — attempt the upload. Real errors (network,\n    // API, rate-limit) propagate to the caller; do NOT catch them here.\n    return await builderFileUploadProvider.upload(input);\n  }\n\n  if (!warnedFallbackRef.value) {\n    warnedFallbackRef.value = true;\n    console.warn(\n      \"[agent-native] No file upload provider configured. \" +\n        \"Connect or reconnect Builder.io in Settings → File uploads, \" +\n        \"or register a custom provider (S3, R2, GCS, …) via registerFileUploadProvider().\",\n    );\n  }\n  return null;\n}\n"]}

package/dist/file-upload/types.d.ts

@@ -29,8 +29,13 @@ export interface FileUploadProvider {
     id: string;
     /** Human-readable name. */
     name: string;
-    /** Returns true if this provider is currently configured (env vars etc.). */
+    /** Returns true if this provider is configured from synchronous runtime state. */
     isConfigured: () => boolean;
+    /**
+     * Returns true if this provider is configured for the active request.
+     * Use for DB-backed user/org/workspace secrets that require request context.
+     */
+    isConfiguredForRequest?: () => Promise<boolean>;
     /** Upload a file and return a URL. Throw on failure. */
     upload: (input: FileUploadInput) => Promise<FileUploadResult>;
 }

package/dist/file-upload/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/file-upload/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,eAAe;IAC9B,qBAAqB;IACrB,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,YAAY,EAAE,MAAM,OAAO,CAAC;IAC5B,wDAAwD;IACxD,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC/D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/file-upload/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,eAAe;IAC9B,qBAAqB;IACrB,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,YAAY,EAAE,MAAM,OAAO,CAAC;IAC5B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,wDAAwD;IACxD,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC/D"}

package/dist/file-upload/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/file-upload/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG","sourcesContent":["/**\n * File upload framework primitive.\n *\n * Templates call `uploadFile()` to upload a file and get back a URL.\n * The framework dispatches to whichever provider is registered (Builder.io\n * built-in, or a user-supplied one). If no provider is active, it falls back\n * to the SQL resources store — fine for dev, not recommended for production.\n */\n\nexport interface FileUploadInput {\n  /** File contents. */\n  data: Uint8Array | Buffer;\n  /** Original filename, used for extension/display. */\n  filename?: string;\n  /** MIME type, e.g. \"image/png\". */\n  mimeType?: string;\n  /** Optional owner email for per-user scoping in fallback storage. */\n  ownerEmail?: string;\n}\n\nexport interface FileUploadResult {\n  /** Public URL where the file can be fetched. */\n  url: string;\n  /** Optional provider-specific id (e.g. resource id, Builder asset id). */\n  id?: string;\n  /** The provider that handled the upload. */\n  provider: string;\n}\n\nexport interface FileUploadProvider {\n  /** Unique id, e.g. \"builder\", \"s3\". */\n  id: string;\n  /** Human-readable name. */\n  name: string;\n  /** Returns true if this provider is currently configured (env vars etc.). */\n  isConfigured: () => boolean;\n  /** Upload a file and return a URL. Throw on failure. */\n  upload: (input: FileUploadInput) => Promise<FileUploadResult>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/file-upload/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG","sourcesContent":["/**\n * File upload framework primitive.\n *\n * Templates call `uploadFile()` to upload a file and get back a URL.\n * The framework dispatches to whichever provider is registered (Builder.io\n * built-in, or a user-supplied one). If no provider is active, it falls back\n * to the SQL resources store — fine for dev, not recommended for production.\n */\n\nexport interface FileUploadInput {\n  /** File contents. */\n  data: Uint8Array | Buffer;\n  /** Original filename, used for extension/display. */\n  filename?: string;\n  /** MIME type, e.g. \"image/png\". */\n  mimeType?: string;\n  /** Optional owner email for per-user scoping in fallback storage. */\n  ownerEmail?: string;\n}\n\nexport interface FileUploadResult {\n  /** Public URL where the file can be fetched. */\n  url: string;\n  /** Optional provider-specific id (e.g. resource id, Builder asset id). */\n  id?: string;\n  /** The provider that handled the upload. */\n  provider: string;\n}\n\nexport interface FileUploadProvider {\n  /** Unique id, e.g. \"builder\", \"s3\". */\n  id: string;\n  /** Human-readable name. */\n  name: string;\n  /** Returns true if this provider is configured from synchronous runtime state. */\n  isConfigured: () => boolean;\n  /**\n   * Returns true if this provider is configured for the active request.\n   * Use for DB-backed user/org/workspace secrets that require request context.\n   */\n  isConfiguredForRequest?: () => Promise<boolean>;\n  /** Upload a file and return a URL. Throw on failure. */\n  upload: (input: FileUploadInput) => Promise<FileUploadResult>;\n}\n"]}

package/dist/integrations/adapters/email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/email.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAoCrB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,IAAI,eAAe,CAwR9C"}
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/email.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAoCrB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,IAAI,eAAe,CA4R9C"}

package/dist/integrations/adapters/email.js

@@ -1,6 +1,7 @@
 import { timingSafeEqual } from "node:crypto";
 import { getHeader, readRawBody as h3ReadRawBody } from "h3";
 import { getDbExec } from "../../db/client.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import { sendEmail, isEmailConfigured, getEmailProvider, } from "../../server/email.js";
 import { getIntegrationConfig } from "../config-store.js";
 /** Max body length before truncation */
@@ -84,8 +85,8 @@ export function emailAdapter() {
             return { handled: false };
         },
         async verifyWebhook(event) {
-            const secret = process.env.EMAIL_INBOUND_WEBHOOK_SECRET;
-            const provider = getEmailProvider();
+            const secret = (await resolveSecret("EMAIL_INBOUND_WEBHOOK_SECRET")) ?? undefined;
+            const provider = await getEmailProvider();
             if (provider === "resend") {
                 return verifyResendWebhook(event, secret);
             }
@@ -97,8 +98,8 @@ export function emailAdapter() {
             return false;
         },
         async parseIncomingMessage(event) {
-            const provider = getEmailProvider();
-            const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();
+            const provider = await getEmailProvider();
+            const agentAddress = (await resolveSecret("EMAIL_AGENT_ADDRESS"))?.toLowerCase();
             if (!agentAddress) {
                 console.warn("[email] EMAIL_AGENT_ADDRESS not configured");
                 return null;
@@ -190,7 +191,7 @@ export function emailAdapter() {
             };
         },
         async sendResponse(message, context) {
-            const agentAddress = process.env.EMAIL_AGENT_ADDRESS;
+            const agentAddress = await resolveSecret("EMAIL_AGENT_ADDRESS");
             if (!agentAddress) {
                 console.error("[email] EMAIL_AGENT_ADDRESS not configured");
                 return;
@@ -200,9 +201,8 @@ export function emailAdapter() {
             // EMAIL_FROM overrides the from-address — required when the receiving
             // address is on a sub-domain that can't be a verified sender (e.g.
             // *.resend.app). Inbound and outbound addresses can differ.
-            const fromAddress = process.env.EMAIL_FROM
-                ? process.env.EMAIL_FROM
-                : `${displayName} <${agentAddress}>`;
+            const emailFrom = await resolveSecret("EMAIL_FROM");
+            const fromAddress = emailFrom || `${displayName} <${agentAddress}>`;
             const subject = context.platformContext.subject;
             const reSubject = subject.startsWith("Re: ") ? subject : `Re: ${subject}`;
             try {
@@ -215,7 +215,7 @@ export function emailAdapter() {
                     inReplyTo: context.platformContext.messageId,
                     references: buildReferencesHeader(context.platformContext),
                     cc: context.platformContext.isCC
-                        ? buildReplyAllCc(context)
+                        ? buildReplyAllCc(context, agentAddress)
                         : undefined,
                 });
             }
@@ -224,7 +224,7 @@ export function emailAdapter() {
             }
         },
         async sendMessageToTarget(message, target) {
-            const agentAddress = process.env.EMAIL_AGENT_ADDRESS;
+            const agentAddress = await resolveSecret("EMAIL_AGENT_ADDRESS");
             if (!agentAddress) {
                 console.error("[email] EMAIL_AGENT_ADDRESS not configured");
                 return;
@@ -257,9 +257,9 @@ export function emailAdapter() {
             return { text: html, platformContext: {} };
         },
         async getStatus(_baseUrl) {
-            const hasAgentAddress = !!process.env.EMAIL_AGENT_ADDRESS;
-            const hasEmailProvider = isEmailConfigured();
-            const hasWebhookSecret = !!process.env.EMAIL_INBOUND_WEBHOOK_SECRET;
+            const hasAgentAddress = !!(await resolveSecret("EMAIL_AGENT_ADDRESS"));
+            const hasEmailProvider = await isEmailConfigured();
+            const hasWebhookSecret = !!(await resolveSecret("EMAIL_INBOUND_WEBHOOK_SECRET"));
             const configured = hasAgentAddress && hasEmailProvider;
             return {
                 platform: "email",
@@ -270,10 +270,10 @@ export function emailAdapter() {
                     hasAgentAddress,
                     hasEmailProvider,
                     hasWebhookSecret,
-                    provider: getEmailProvider(),
+                    provider: await getEmailProvider(),
                 },
                 error: !configured
-                    ? "Set EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY"
+                    ? "Save EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY in settings"
                     : undefined,
             };
         },
@@ -737,8 +737,8 @@ function buildReferencesHeader(ctx) {
  * Build CC list for reply-all when agent was CC'd.
  * Include original To addresses and other CC addresses, excluding the agent and the original sender.
  */
-function buildReplyAllCc(context) {
-    const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();
+function buildReplyAllCc(context, agentAddress) {
+    const normalizedAgentAddress = agentAddress.toLowerCase();
     const senderEmail = context.senderId?.toLowerCase();
     const toAddresses = context.platformContext.to || [];
     const ccAddresses = context.platformContext.cc || [];
@@ -746,7 +746,7 @@ function buildReplyAllCc(context) {
     for (const addr of [...toAddresses, ...ccAddresses]) {
         const normalized = addr.toLowerCase().trim();
         // Exclude agent address and original sender (sender goes in To)
-        if (normalized !== agentAddress && normalized !== senderEmail) {
+        if (normalized !== normalizedAgentAddress && normalized !== senderEmail) {
             allRecipients.add(normalized);
         }
     }

package/dist/integrations/adapters/email.js.map

@@ -1 +1 @@
-{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/integrations/adapters/email.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,IAAI,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAS1D,wCAAwC;AACxC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,0DAA0D;AAC1D,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,uCAAuC;AACvC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C;;;;;GAKG;AACH,IAAI,uBAAuB,GAAG,KAAK,CAAC;AACpC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,OAAO;QAEd,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,qBAAqB;oBAC1B,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,wIAAwI;iBAC3I;gBACD;oBACE,GAAG,EAAE,gBAAgB;oBACrB,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,uHAAuH;iBAC1H;gBACD;oBACE,GAAG,EAAE,kBAAkB;oBACvB,KAAK,EAAE,kBAAkB;oBACzB,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,qGAAqG;iBACxG;gBACD;oBACE,GAAG,EAAE,8BAA8B;oBACnC,KAAK,EAAE,wBAAwB;oBAC/B,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,uKAAuK;iBAC1K;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,MAAe;YAEf,iDAAiD;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YACxD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YAEpC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;YAED,kCAAkC;YAClC,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC;YACpE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,MAAM,GAAuB,IAAI,CAAC;YAEtC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACnC,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEzB,2EAA2E;YAC3E,yEAAyE;YACzE,gEAAgE;YAChE,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,MAAM,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CACV,gCAAgC,WAAW,MAAM,cAAc,MAAM,CACtE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,wBAAwB;YACxB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,cAA0B,CAAC;gBAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC/C,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;wBACrD,OAAO,CAAC,IAAI,CACV,+BAA+B,WAAW,gCAAgC,CAC3E,CAAC;wBACF,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,GACR,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACnC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAErC,yFAAyF;YACzF,+EAA+E;YAC/E,8EAA8E;YAC9E,yEAAyE;YACzE,gFAAgF;YAChF,6EAA6E;YAC7E,6CAA6C;YAC7C,MAAM,YAAY,GAAG,qBAAqB,CACxC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,EACpD,WAAW,CACZ,CAAC;YAEF,kBAAkB;YAClB,IAAI,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAEvE,qBAAqB;YACrB,IAAI,QAAQ,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC5C,QAAQ;oBACN,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,GAAG,uBAAuB,CAAC;YACvE,CAAC;YAED,kCAAkC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,eAAe,GAAG,WAAW;qBAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC;qBACjC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,QAAQ;oBACN,0BAA0B,WAAW,QAAQ,eAAe,IAAI,QAAQ,KAAK;wBAC7E,YAAY,MAAM,CAAC,OAAO,MAAM;wBAChC,QAAQ,CAAC;YACb,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,gBAAgB,EAAE,YAAY;gBAC9B,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;gBAC5B,QAAQ,EAAE,WAAW;gBACrB,6DAA6D;gBAC7D,gEAAgE;gBAChE,+DAA+D;gBAC/D,oEAAoE;gBACpE,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE;oBACf,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,WAAW;oBACjB,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,IAAI;oBACJ,cAAc,EAAE,MAAM,CAAC,cAAc;iBACtC;gBACD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;aACtE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACrD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GACd,MAAM,EAAE,UAAU,EAAE,WAAsB,IAAI,gBAAgB,CAAC;YAElE,sEAAsE;YACtE,mEAAmE;YACnE,4DAA4D;YAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU;gBACxC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;gBACxB,CAAC,CAAC,GAAG,WAAW,KAAK,YAAY,GAAG,CAAC;YAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,OAAiB,CAAC;YAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC;YAE1E,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,OAAO,CAAC,QAAS;oBACrB,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,SAAS;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC;oBACzC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,SAAmB;oBACtD,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;oBAC1D,EAAE,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI;wBAC9B,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC;wBAC1B,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACrD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GACd,MAAM,EAAE,UAAU,EAAE,WAAsB,IAAI,gBAAgB,CAAC;YAElE,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,MAAM,CAAC,WAAW;oBACtB,IAAI,EAAE,GAAG,WAAW,KAAK,YAAY,GAAG;oBACxC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,6BAA6B;oBACtD,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC;oBACzC,GAAG,CAAC,MAAM,CAAC,SAAS;wBAClB,CAAC,CAAC;4BACE,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,UAAU,EAAE,MAAM,CAAC,SAAS;yBAC7B;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAChE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,eAAe,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAC1D,MAAM,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;YAC7C,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;YACpE,MAAM,UAAU,GAAG,eAAe,IAAI,gBAAgB,CAAC;YAEvD,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,eAAe;oBACf,gBAAgB;oBAChB,gBAAgB;oBAChB,QAAQ,EAAE,gBAAgB,EAAE;iBAC7B;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,uEAAuE;oBACzE,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AA4BD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,KAAK,UAAU,mBAAmB,CAChC,KAAc,EACd,MAAe;IAEf,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC7B,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,OAAO,CAAC,KAAK,CACX,wFAAwF;oBACtF,2GAA2G,CAC9G,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,uBAAuB,GAAG,IAAI,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAEzD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2DAA2D;IAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAE3C,oDAAoD;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAErD,MAAM,aAAa,GAAG,GAAG,MAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;IAC3D,MAAM,iBAAiB,GAAG,MAAM;SAC7B,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;SACjC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpB,+EAA+E;IAC/E,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,IAAI,CAAC;YACH,IACE,MAAM,CAAC,eAAe,CACpB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CACtB,EACD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,EAAE,CAAS;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAc,EACd,MAAe;IAEf,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBAC/B,yBAAyB,GAAG,IAAI,CAAC;gBACjC,OAAO,CAAC,KAAK,CACX,0FAA0F;oBACxF,2GAA2G,CAC9G,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,yBAAyB,GAAG,IAAI,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,iEAAiE;QACjE,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5E,OAAO,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,KAAK,UAAU,kBAAkB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAA0B,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAmC,CAAC;IACvD,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAmC,CAAC;IACvD,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAEvC,wDAAwD;IACxD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GACb,OAAO,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAEnE,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,WAAW,EAAE,OAAO,CAAC,wBAAwB,CAAC;QAC9C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC3D,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACzD,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,OAAO,EAAG,IAAI,CAAC,OAAkB,IAAI,cAAc;QACnD,IAAI;QACJ,EAAE;QACF,EAAE,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClC,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,SAAS;QAC9C,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,EAAG,IAAI,CAAC,UAAqB,IAAI,SAAS;QAC9C,cAAc;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAc;IAEd,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,sDAAsD;IACtD,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAA0B,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAwB,CAAC;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,EAAwB,CAAC;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,2BAA2B;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,OAA6B,CAAC;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAEpE,8EAA8E;IAC9E,wDAAwD;IACxD,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,WAAW,EAAE,OAAO,CAAC,wBAAwB,CAAC;QAC9C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC3D,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACzD,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,OAAO,EAAG,IAAI,CAAC,OAAkB,IAAI,cAAc;QACnD,IAAI;QACJ,EAAE;QACF,EAAE,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClC,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,SAAS;QAC9C,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS;QAClC,cAAc;KACf,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,CAAC;QACZ,CAAC,CAAC,KAAK;aACF,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;aACb,IAAI,EAAE;aACN,WAAW,EAAE;QAClB,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAE,aAAqB;IAC7D,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,UAAU,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC;QACxC,aAAa,CAAC,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAAC,KAK9B;IACC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,mEAAmE;IACnE,iDAAiD;IACjD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CACrC,8EAA8E,CAC/E,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,UAAU,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IAED,2EAA2E;IAC3E,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAC3C,+BAA+B;QAC/B,MAAM,MAAM,GAAG,qDAAqD,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpD,CAAC;QACD,wDAAwD;QACxD,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;;;;;;OAMJ;YACD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;SACrE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CACjB,IAAI,CAAC,CAAC,CAAyC,EAAE,CAAC,IAAI,CAAC,CACzD,CAAC;QACF,OAAO,KAAK,IAAI,cAAc,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,kEAAkE;AAClE,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;YAC9D,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/B,CAAC;AAED,qGAAqG;AACrG,SAAS,oBAAoB,CAAC,GAAkC;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAE5B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAE,CAAC,CAAC,IAAe,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,KAAe,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACvC,OAAkC,CACnC,EAAE,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,GAAuB;IACjD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IAExB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,YAAY,GAAG,EAAE,CAAC;IAEtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,6CAA6C;QAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,YAAY,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,uBAAuB;QACvB,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC;QAClD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,EAAE,CAAC;YAChB,YAAY,GAAG,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IACD,mBAAmB;IACnB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAC5B,UAA8B;IAE9B,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAAiB,EAAE,UAAqB;IAC/D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,WAAmB,EACnB,WAAmB;IAEnB,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,GAA4B;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,8BAA8B;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAkC,CAAC;IACpD,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,gCAAgC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAA+B,CAAC;IACtD,IAAI,SAAS,EAAE,CAAC;QACd,mBAAmB;QACnB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,EAAE,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACpD,MAAM,WAAW,GAAI,OAAO,CAAC,eAAe,CAAC,EAAe,IAAI,EAAE,CAAC;IACnE,MAAM,WAAW,GAAI,OAAO,CAAC,eAAe,CAAC,EAAe,IAAI,EAAE,CAAC;IAEnE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,WAAW,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC7C,gEAAgE;QAChE,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YAC9D,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,4DAA4D;AAC5D,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;SAC1B,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC;SACzB,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC;SAC5B,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;SAC/B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAS;IACxC,OAAO,CAAC;SACL,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAW;IAI9C,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE7C,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CACxB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC/B,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;QACpC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,QAAQ,GAAG,GAAG,GAAG,QAAQ,CAAC;QAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,YAAY,UAAU,CAAC,IAAI,CAAC,sDAAsD,UAAU,CACjG,WAAW,CAAC,GAAG,CAAC,CACjB,OAAO,QAAQ,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,SAAS,cAAc,CAAC,EAAU;IAChC,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,kEAAkE;IAClE,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAExB,6BAA6B;IAC7B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IAC7D,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAEzD,mEAAmE;IACnE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;IAE/D,qBAAqB;IACrB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrE,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACvE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC,CAAC,KAAK,CAAC;QACV,OAAO,YAAY,UAAU,CAC3B,uBAAuB,CAAC,GAAG,CAAC,CAC7B,sDAAsD,YAAY,MAAM,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,YAAY,EACZ,+FAA+F,CAChG,CAAC;IAEF,4EAA4E;IAC5E,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAEnC,oDAAoD;IACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACtD,gCAAgC;IAChC,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,sBAAsB,EACtB,qDAAqD,CACtD,CAAC;IAEF,uDAAuD;IACvD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACrD,oDAAoD;IACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,KAAK,EAAE,EAAE;QAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,+CAA+C,KAAK,OAAO,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,cAAc,EACd,wDAAwD,CACzD,CAAC;IACF,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,aAAa,EACb,yDAAyD,CAC1D,CAAC;IACF,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,YAAY,EACZ,wDAAwD,CACzD,CAAC;IAEF,+BAA+B;IAC/B,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IAEF,8BAA8B;IAC9B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,yBAAyB;IACzB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEnC,yBAAyB;IACzB,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC;IACxB,4BAA4B;IAC5B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAExC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO;;;;;;;;EAQP,QAAQ;;;QAGF,CAAC;AACT,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\n\nimport type { H3Event } from \"h3\";\nimport { getHeader, readRawBody as h3ReadRawBody } from \"h3\";\n\nimport { getDbExec } from \"../../db/client.js\";\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport {\n  sendEmail,\n  isEmailConfigured,\n  getEmailProvider,\n} from \"../../server/email.js\";\nimport { getIntegrationConfig } from \"../config-store.js\";\nimport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  OutboundTarget,\n} from \"../types.js\";\n\n/** Max body length before truncation */\nconst EMAIL_MAX_BODY_LENGTH = 15000;\n\n/** Rate limit: max emails per sender within the window */\nconst RATE_LIMIT_MAX = 20;\n/** Rate limit window in ms (1 hour) */\nconst RATE_LIMIT_WINDOW_MS = 60 * 60 * 1000;\n\n/**\n * One-shot warning flags so we don't spam logs on every webhook.\n * Cleared per process — one warning per cold start is enough to surface\n * a misconfiguration without leaking config status to anyone with log access\n * (M6 in the webhook security audit).\n */\nlet _resendUnverifiedWarned = false;\nlet _sendgridUnverifiedWarned = false;\n\nfunction escapeLike(value: string): string {\n  return value.replace(/([\\\\%_])/g, \"\\\\$1\");\n}\n\n/**\n * Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose signature can't\n * be verified — accepting them with attacker-controlled `from:` addresses\n * lets the dispatch owner-resolution path run as the victim (C1 in the\n * webhook security audit).\n */\nfunction shouldRefuseWhenSecretMissing(): boolean {\n  if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n  return process.env.NODE_ENV === \"production\";\n}\n\n/**\n * Create an Email platform adapter for inbound/outbound email via\n * Resend or SendGrid webhooks.\n *\n * Required env vars:\n * - EMAIL_AGENT_ADDRESS — The email address the agent receives mail at\n *\n * One of these must also be set (checked via isEmailConfigured()):\n * - RESEND_API_KEY — For sending/receiving via Resend\n * - SENDGRID_API_KEY — For sending/receiving via SendGrid\n *\n * Optional:\n * - EMAIL_INBOUND_WEBHOOK_SECRET — Webhook signature verification secret\n */\nexport function emailAdapter(): PlatformAdapter {\n  return {\n    platform: \"email\",\n    label: \"Email\",\n\n    getRequiredEnvKeys(): EnvKeyConfig[] {\n      return [\n        {\n          key: \"EMAIL_AGENT_ADDRESS\",\n          label: \"Agent Email Address\",\n          required: true,\n          helpText:\n            \"The email address people will use to message your agent (e.g. `agent@yourcompany.com`, or pick from your `<slug>.resend.app` sandbox).\",\n        },\n        {\n          key: \"RESEND_API_KEY\",\n          label: \"Resend API Key\",\n          required: false,\n          helpText:\n            \"From resend.com → API keys (starts with `re_`). Either Resend or SendGrid is required for sending and receiving mail.\",\n        },\n        {\n          key: \"SENDGRID_API_KEY\",\n          label: \"SendGrid API Key\",\n          required: false,\n          helpText:\n            \"From sendgrid.com → Settings → API Keys (starts with `SG.`). Either Resend or SendGrid is required.\",\n        },\n        {\n          key: \"EMAIL_INBOUND_WEBHOOK_SECRET\",\n          label: \"Inbound Webhook Secret\",\n          required: false,\n          helpText:\n            \"Optional. From Resend (Webhooks → Signing Secret, starts with `whsec_`) or your SendGrid Inbound Parse basic-auth password. Used to verify inbound webhooks are real.\",\n        },\n      ];\n    },\n\n    async handleVerification(\n      _event: H3Event,\n    ): Promise<{ handled: boolean; response?: unknown }> {\n      // Email webhooks don't need challenge handshakes\n      return { handled: false };\n    },\n\n    async verifyWebhook(event: H3Event): Promise<boolean> {\n      const secret = process.env.EMAIL_INBOUND_WEBHOOK_SECRET;\n      const provider = getEmailProvider();\n\n      if (provider === \"resend\") {\n        return verifyResendWebhook(event, secret);\n      }\n\n      if (provider === \"sendgrid\") {\n        return verifySendGridWebhook(event, secret);\n      }\n\n      // No provider configured — reject\n      console.warn(\"[email] No email provider configured, rejecting webhook\");\n      return false;\n    },\n\n    async parseIncomingMessage(\n      event: H3Event,\n    ): Promise<IncomingMessage | null> {\n      const provider = getEmailProvider();\n      const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();\n      if (!agentAddress) {\n        console.warn(\"[email] EMAIL_AGENT_ADDRESS not configured\");\n        return null;\n      }\n\n      let parsed: ParsedEmail | null = null;\n\n      if (provider === \"resend\") {\n        parsed = await parseResendWebhook(event);\n      } else if (provider === \"sendgrid\") {\n        parsed = await parseSendGridWebhook(event);\n      }\n\n      if (!parsed) return null;\n\n      // Rate limiting (SQL-backed heuristic — counts the sender's already-queued\n      // tasks within the last hour). The previous in-memory map reset on every\n      // serverless cold start, so the actual ceiling per attacker was\n      // RATE_LIMIT_MAX × number_of_active_instances. SQL-backed counting holds\n      // across instances. See H4 in the webhook security audit.\n      const senderEmail = parsed.from.email.toLowerCase();\n      if (await isRateLimited(senderEmail)) {\n        console.warn(\n          `[email] Rate limited sender: ${senderEmail} (>${RATE_LIMIT_MAX}/hr)`,\n        );\n        return null;\n      }\n\n      // Check allowed domains\n      const config = await getIntegrationConfig(\"email\");\n      if (config?.configData?.allowedDomains) {\n        const allowed = config.configData.allowedDomains as string[];\n        if (allowed.length > 0) {\n          const senderDomain = senderEmail.split(\"@\")[1];\n          if (!senderDomain || !allowed.includes(senderDomain)) {\n            console.warn(\n              `[email] Rejected email from ${senderEmail}: domain not in allowedDomains`,\n            );\n            return null;\n          }\n        }\n      }\n\n      // Determine if agent was CC'd (not in To, but in CC)\n      const toAddresses = parsed.to.map((a) => a.toLowerCase());\n      const ccAddresses = (parsed.cc ?? []).map((a) => a.toLowerCase());\n      const isCC =\n        !toAddresses.includes(agentAddress) &&\n        ccAddresses.includes(agentAddress);\n\n      // Build thread ID from References chain (Gmail-style: oldest Message-ID is thread root).\n      // Scope the thread root by sender so an attacker who can forge a `References:`\n      // header pointing at someone else's thread root can't graft into that thread.\n      // Without this scoping, a third party could craft an inbound email whose\n      // References chain matches a known victim's Message-ID and inject messages into\n      // the victim's existing conversation — leaking prior content via the agent's\n      // reply (M1 in the webhooks security audit).\n      const threadRootId = scopeThreadIdToSender(\n        getThreadRootId(parsed.messageId, parsed.references),\n        senderEmail,\n      );\n\n      // Build body text\n      let bodyText = parsed.text || stripHtmlForPlainText(parsed.html || \"\");\n\n      // Truncate if needed\n      if (bodyText.length > EMAIL_MAX_BODY_LENGTH) {\n        bodyText =\n          bodyText.slice(0, EMAIL_MAX_BODY_LENGTH) + \"\\n[Message truncated]\";\n      }\n\n      // Prefix CC'd emails with context\n      if (isCC) {\n        const otherRecipients = toAddresses\n          .filter((a) => a !== agentAddress)\n          .join(\", \");\n        bodyText =\n          `[CC'd on email between ${senderEmail} and ${otherRecipients || \"others\"}]\\n` +\n          `Subject: ${parsed.subject}\\n\\n` +\n          bodyText;\n      }\n\n      return {\n        platform: \"email\",\n        externalThreadId: threadRootId,\n        text: bodyText,\n        senderName: parsed.from.name,\n        senderId: senderEmail,\n        // Carry the message-authentication verdict downstream. Owner\n        // resolution (dispatch) must NOT grant a real user's identity /\n        // credentials unless the sender is verified — an unverified or\n        // spoofed `From:` falls back to a synthetic, credential-less owner.\n        senderVerified: parsed.senderVerified,\n        platformContext: {\n          messageId: parsed.messageId,\n          subject: parsed.subject,\n          from: senderEmail,\n          to: parsed.to,\n          cc: parsed.cc,\n          inReplyTo: parsed.inReplyTo,\n          references: parsed.references,\n          isCC,\n          senderVerified: parsed.senderVerified,\n        },\n        timestamp: parsed.date ? new Date(parsed.date).getTime() : Date.now(),\n      };\n    },\n\n    async sendResponse(\n      message: OutgoingMessage,\n      context: IncomingMessage,\n    ): Promise<void> {\n      const agentAddress = process.env.EMAIL_AGENT_ADDRESS;\n      if (!agentAddress) {\n        console.error(\"[email] EMAIL_AGENT_ADDRESS not configured\");\n        return;\n      }\n\n      const config = await getIntegrationConfig(\"email\");\n      const displayName =\n        (config?.configData?.displayName as string) || \"Dispatch Agent\";\n\n      // EMAIL_FROM overrides the from-address — required when the receiving\n      // address is on a sub-domain that can't be a verified sender (e.g.\n      // *.resend.app). Inbound and outbound addresses can differ.\n      const fromAddress = process.env.EMAIL_FROM\n        ? process.env.EMAIL_FROM\n        : `${displayName} <${agentAddress}>`;\n\n      const subject = context.platformContext.subject as string;\n      const reSubject = subject.startsWith(\"Re: \") ? subject : `Re: ${subject}`;\n\n      try {\n        await sendEmail({\n          to: context.senderId!,\n          from: fromAddress,\n          subject: reSubject,\n          html: message.text,\n          text: stripHtmlForPlainText(message.text),\n          inReplyTo: context.platformContext.messageId as string,\n          references: buildReferencesHeader(context.platformContext),\n          cc: context.platformContext.isCC\n            ? buildReplyAllCc(context)\n            : undefined,\n        });\n      } catch (err) {\n        console.error(\"[email] Failed to send response:\", err);\n      }\n    },\n\n    async sendMessageToTarget(\n      message: OutgoingMessage,\n      target: OutboundTarget,\n    ): Promise<void> {\n      const agentAddress = process.env.EMAIL_AGENT_ADDRESS;\n      if (!agentAddress) {\n        console.error(\"[email] EMAIL_AGENT_ADDRESS not configured\");\n        return;\n      }\n\n      const config = await getIntegrationConfig(\"email\");\n      const displayName =\n        (config?.configData?.displayName as string) || \"Dispatch Agent\";\n\n      try {\n        await sendEmail({\n          to: target.destination,\n          from: `${displayName} <${agentAddress}>`,\n          subject: target.label || \"Message from Dispatch Agent\",\n          html: message.text,\n          text: stripHtmlForPlainText(message.text),\n          ...(target.threadRef\n            ? {\n                inReplyTo: target.threadRef,\n                references: target.threadRef,\n              }\n            : {}),\n        });\n      } catch (err) {\n        console.error(\"[email] Failed to send proactive message:\", err);\n        throw err;\n      }\n    },\n\n    formatAgentResponse(text: string): OutgoingMessage {\n      const bodyHtml = markdownToHtml(text);\n      const html = wrapInEmailTemplate(bodyHtml);\n      return { text: html, platformContext: {} };\n    },\n\n    async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n      const hasAgentAddress = !!process.env.EMAIL_AGENT_ADDRESS;\n      const hasEmailProvider = isEmailConfigured();\n      const hasWebhookSecret = !!process.env.EMAIL_INBOUND_WEBHOOK_SECRET;\n      const configured = hasAgentAddress && hasEmailProvider;\n\n      return {\n        platform: \"email\",\n        label: \"Email\",\n        enabled: false, // overridden by plugin\n        configured,\n        details: {\n          hasAgentAddress,\n          hasEmailProvider,\n          hasWebhookSecret,\n          provider: getEmailProvider(),\n        },\n        error: !configured\n          ? \"Set EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY\"\n          : undefined,\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Parsed email shape\n// ---------------------------------------------------------------------------\n\ninterface ParsedEmail {\n  messageId: string;\n  subject: string;\n  from: { name?: string; email: string };\n  to: string[];\n  cc?: string[];\n  text?: string;\n  html?: string;\n  inReplyTo?: string;\n  references?: string[];\n  date?: string;\n  /**\n   * True when the provider's message-authentication results show that the\n   * mail genuinely originated from the From domain: DKIM `pass` aligned with\n   * the From domain, or an aligned SPF `pass`. False when results are absent\n   * or fail — we fail closed so a spoofed `From:` can never be treated as\n   * verified. See FINDING 3 (inbound-email impersonation) in the webhook\n   * security audit.\n   */\n  senderVerified: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Webhook verification\n// ---------------------------------------------------------------------------\n\nasync function verifyResendWebhook(\n  event: H3Event,\n  secret?: string,\n): Promise<boolean> {\n  if (!secret) {\n    if (shouldRefuseWhenSecretMissing()) {\n      if (!_resendUnverifiedWarned) {\n        _resendUnverifiedWarned = true;\n        console.error(\n          \"[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — refusing Resend webhook in production. \" +\n            \"Set EMAIL_INBOUND_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n        );\n      }\n      return false;\n    }\n    if (!_resendUnverifiedWarned) {\n      _resendUnverifiedWarned = true;\n      console.warn(\n        \"[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — accepting Resend webhook without verification (dev mode)\",\n      );\n    }\n    return true;\n  }\n\n  const svixId = getHeader(event, \"svix-id\");\n  const svixTimestamp = getHeader(event, \"svix-timestamp\");\n  const svixSignature = getHeader(event, \"svix-signature\");\n\n  if (!svixId || !svixTimestamp || !svixSignature) {\n    console.warn(\"[email] Missing Svix signature headers\");\n    return false;\n  }\n\n  // Reject requests older than 5 minutes (replay protection)\n  const ts = parseInt(svixTimestamp, 10);\n  if (Math.abs(Date.now() / 1000 - ts) > 300) {\n    console.warn(\"[email] Svix timestamp too old, rejecting\");\n    return false;\n  }\n\n  const body = await readRawBody(event);\n  const crypto = await import(\"node:crypto\");\n\n  // Svix signing secret may be prefixed with \"whsec_\"\n  const rawSecret = secret.startsWith(\"whsec_\") ? secret.slice(6) : secret;\n  const secretBytes = Buffer.from(rawSecret, \"base64\");\n\n  const signedContent = `${svixId}.${svixTimestamp}.${body}`;\n  const expectedSignature = crypto\n    .createHmac(\"sha256\", secretBytes)\n    .update(signedContent)\n    .digest(\"base64\");\n\n  // Svix sends multiple signatures separated by spaces, each prefixed with \"v1,\"\n  const signatures = svixSignature.split(\" \");\n  for (const sig of signatures) {\n    const sigValue = sig.startsWith(\"v1,\") ? sig.slice(3) : sig;\n    try {\n      if (\n        crypto.timingSafeEqual(\n          Buffer.from(expectedSignature),\n          Buffer.from(sigValue),\n        )\n      ) {\n        return true;\n      }\n    } catch {\n      // Length mismatch — try next signature\n    }\n  }\n\n  console.warn(\"[email] Svix signature verification failed\");\n  return false;\n}\n\nfunction safeEq(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a);\n  const bBuf = Buffer.from(b);\n  if (aBuf.length !== bBuf.length) return false;\n  return timingSafeEqual(aBuf, bBuf);\n}\n\nasync function verifySendGridWebhook(\n  event: H3Event,\n  secret?: string,\n): Promise<boolean> {\n  if (!secret) {\n    if (shouldRefuseWhenSecretMissing()) {\n      if (!_sendgridUnverifiedWarned) {\n        _sendgridUnverifiedWarned = true;\n        console.error(\n          \"[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — refusing SendGrid webhook in production. \" +\n            \"Set EMAIL_INBOUND_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n        );\n      }\n      return false;\n    }\n    if (!_sendgridUnverifiedWarned) {\n      _sendgridUnverifiedWarned = true;\n      console.warn(\n        \"[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — accepting SendGrid webhook without verification (dev mode)\",\n      );\n    }\n    return true;\n  }\n\n  // Check for the secret in a custom header or basic auth\n  const authHeader = getHeader(event, \"authorization\");\n  if (authHeader) {\n    // Basic auth: \"Basic base64(user:pass)\" — secret is the password\n    if (authHeader.startsWith(\"Basic \")) {\n      const decoded = Buffer.from(authHeader.slice(6), \"base64\").toString();\n      const password = decoded.split(\":\")[1];\n      if (password !== undefined && safeEq(password, secret)) return true;\n    }\n  }\n\n  // Also check a custom header (common SendGrid Inbound Parse pattern)\n  const customSecret = getHeader(event, \"x-webhook-secret\");\n  if (customSecret !== undefined && safeEq(customSecret, secret)) return true;\n\n  console.warn(\"[email] SendGrid webhook secret verification failed\");\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// Inbound email parsing\n// ---------------------------------------------------------------------------\n\nasync function parseResendWebhook(event: H3Event): Promise<ParsedEmail | null> {\n  const raw = await readRawBody(event);\n  const body = JSON.parse(raw);\n  if (!body || body.type !== \"email.received\") return null;\n\n  const data = body.data;\n  if (!data) return null;\n\n  // Resend webhook payload provides email metadata directly in data\n  // Fields: from, to, cc, subject, text, html, headers, created_at\n  const fromRaw = data.from as string | undefined;\n  const from = fromRaw ? parseEmailAddress(fromRaw) : null;\n  if (!from) return null;\n\n  const toRaw = data.to as string | string[] | undefined;\n  const to = normalizeAddressList(toRaw);\n  const ccRaw = data.cc as string | string[] | undefined;\n  const cc = normalizeAddressList(ccRaw);\n\n  // Parse headers for Message-ID, In-Reply-To, References\n  const headers = parseHeadersObject(data.headers);\n  const messageId =\n    headers[\"message-id\"] || data.email_id || `resend-${Date.now()}`;\n\n  // Resend forwards the raw `Authentication-Results` header (and may also\n  // surface explicit `dkim`/`spf` fields). Derive a verified verdict from\n  // whichever is present; absent results fail closed (unverified).\n  const senderVerified = computeSenderVerified({\n    fromEmail: from.email,\n    authResults: headers[\"authentication-results\"],\n    dkim: typeof data.dkim === \"string\" ? data.dkim : undefined,\n    spf: typeof data.spf === \"string\" ? data.spf : undefined,\n  });\n\n  return {\n    messageId,\n    subject: (data.subject as string) || \"(no subject)\",\n    from,\n    to,\n    cc: cc.length > 0 ? cc : undefined,\n    text: data.text as string | undefined,\n    html: data.html as string | undefined,\n    inReplyTo: headers[\"in-reply-to\"] || undefined,\n    references: parseReferencesHeader(headers[\"references\"]),\n    date: (data.created_at as string) || undefined,\n    senderVerified,\n  };\n}\n\nasync function parseSendGridWebhook(\n  event: H3Event,\n): Promise<ParsedEmail | null> {\n  const raw = await readRawBody(event);\n  const body = JSON.parse(raw);\n  if (!body) return null;\n\n  // SendGrid Inbound Parse sends form data with fields:\n  // from, to, cc, subject, text, html, headers, envelope\n  const fromRaw = body.from as string | undefined;\n  const from = fromRaw ? parseEmailAddress(fromRaw) : null;\n  if (!from) return null;\n\n  const toRaw = body.to as string | undefined;\n  const to = toRaw ? toRaw.split(\",\").map((a: string) => a.trim()) : [];\n  const ccRaw = body.cc as string | undefined;\n  const cc = ccRaw ? ccRaw.split(\",\").map((a: string) => a.trim()) : [];\n\n  // Parse raw headers string\n  const headersStr = body.headers as string | undefined;\n  const headers = parseHeadersString(headersStr);\n  const messageId = headers[\"message-id\"] || `sendgrid-${Date.now()}`;\n\n  // SendGrid Inbound Parse posts explicit `dkim` (e.g. `{@example.com : pass}`)\n  // and `SPF` (e.g. `pass`) form fields, and also carries\n  // `Authentication-Results` inside the raw headers blob. Use all available\n  // signals; absent results fail closed (unverified).\n  const senderVerified = computeSenderVerified({\n    fromEmail: from.email,\n    authResults: headers[\"authentication-results\"],\n    dkim: typeof body.dkim === \"string\" ? body.dkim : undefined,\n    spf: typeof body.SPF === \"string\" ? body.SPF : undefined,\n  });\n\n  return {\n    messageId,\n    subject: (body.subject as string) || \"(no subject)\",\n    from,\n    to,\n    cc: cc.length > 0 ? cc : undefined,\n    text: body.text as string | undefined,\n    html: body.html as string | undefined,\n    inReplyTo: headers[\"in-reply-to\"] || undefined,\n    references: parseReferencesHeader(headers[\"references\"]),\n    date: headers[\"date\"] || undefined,\n    senderVerified,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — sender authentication (DKIM / SPF)\n// ---------------------------------------------------------------------------\n\n/**\n * Extract the registrable-ish domain from an email address (lowercased).\n * We keep the full host rather than collapsing to an eTLD+1 — exact-domain\n * alignment is the conservative choice here, and avoids bundling a public\n * suffix list. Subdomain senders that legitimately DKIM-sign with the parent\n * domain are handled by the suffix check in `domainsAlign`.\n */\nfunction emailDomain(email: string): string {\n  const at = email.lastIndexOf(\"@\");\n  return at >= 0\n    ? email\n        .slice(at + 1)\n        .trim()\n        .toLowerCase()\n    : \"\";\n}\n\n/**\n * True when `signingDomain` is the From domain or a parent of it (e.g.\n * From `user@mail.example.com` aligned with a `d=example.com` signature).\n * Both directions of subdomain nesting are accepted because senders sign\n * with either the exact From host or the organizational parent.\n */\nfunction domainsAlign(fromDomain: string, signingDomain: string): boolean {\n  if (!fromDomain || !signingDomain) return false;\n  if (fromDomain === signingDomain) return true;\n  return (\n    fromDomain.endsWith(`.${signingDomain}`) ||\n    signingDomain.endsWith(`.${fromDomain}`)\n  );\n}\n\n/**\n * Compute whether an inbound email is authenticated as genuinely coming from\n * its `From:` domain. Returns true only when DKIM passes for an aligned\n * domain, or SPF passes for an aligned domain. Anything else — missing\n * results, `fail`, `softfail`, `none`, `neutral`, `temperror`, `permerror`\n * — returns false (fail closed).\n *\n * Inputs may come from provider-specific fields (`dkim`, `spf`) and/or the\n * RFC 8601 `Authentication-Results` header, in any combination. We treat the\n * union: if ANY source shows an aligned pass, the sender is verified.\n */\nfunction computeSenderVerified(input: {\n  fromEmail: string;\n  authResults?: string;\n  dkim?: string;\n  spf?: string;\n}): boolean {\n  const fromDomain = emailDomain(input.fromEmail);\n  if (!fromDomain) return false;\n\n  // 1. Provider DKIM field, e.g. SendGrid `{@example.com : pass}` or\n  //    `{@example.com : pass; @other.com : fail}`.\n  if (input.dkim) {\n    const dkimEntries = input.dkim.matchAll(\n      /@([a-z0-9.-]+)\\s*:\\s*(pass|fail|none|neutral|softfail|temperror|permerror)/gi,\n    );\n    for (const m of dkimEntries) {\n      const domain = m[1].toLowerCase();\n      const verdict = m[2].toLowerCase();\n      if (verdict === \"pass\" && domainsAlign(fromDomain, domain)) return true;\n    }\n  }\n\n  // 2. Provider SPF field. SendGrid posts a bare verdict (e.g. `pass`); since\n  //    SPF authenticates the envelope/MailFrom rather than the header From,\n  //    a bare `pass` with no domain only counts when we can't tell it's\n  //    misaligned. We accept a bare `pass` as an aligned SPF pass — this is\n  //    the same trust level Gmail-style routing assigns to a plain SPF pass.\n  if (input.spf) {\n    const spfVerdict = input.spf.trim().toLowerCase();\n    if (spfVerdict === \"pass\") return true;\n  }\n\n  // 3. RFC 8601 `Authentication-Results` header (may list multiple methods).\n  if (input.authResults) {\n    const ar = input.authResults.toLowerCase();\n    // DKIM with an aligned domain.\n    const dkimRe = /dkim=pass[^;]*?(?:header\\.(?:d|i)=|@)([a-z0-9.-]+)/g;\n    for (const m of ar.matchAll(dkimRe)) {\n      const domain = m[1].replace(/^@/, \"\");\n      if (domainsAlign(fromDomain, domain)) return true;\n    }\n    // SPF pass (envelope auth) — accept as an aligned pass.\n    if (/spf=pass\\b/.test(ar)) return true;\n  }\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// Rate limiting\n// ---------------------------------------------------------------------------\n\n/**\n * Rate-limit heuristic backed by the `integration_pending_tasks` queue.\n *\n * Counts how many tasks this sender has produced in the last hour. The count\n * INCLUDES tasks already processed (status = completed/failed) because the\n * rows aren't deleted on completion — that's enough signal to throttle a\n * single noisy/abusive sender without needing a dedicated counter table.\n *\n * Two trade-offs worth knowing:\n *   - This is a coarse heuristic, not exact metering. Within one hour the\n *     count is correct; rows produced more than an hour ago naturally drop\n *     off. We don't try to be precise, only to raise the bar past the\n *     \"send 10K emails through one Lambda burst\" failure mode.\n *   - The query relies on the `idx_pending_tasks_status_created` index plus\n *     a sender substring match. A targeted attacker could amortise the cost\n *     by reusing one sender address — that's fine, the goal here is to bound\n *     the attack within a single attacker identity, not to detect spoofing.\n *\n * If the table doesn't yet exist on this deployment (no inbound webhook has\n * been processed before), we silently allow the message — the schema is\n * provisioned on first task insert. See H4 in the webhook security audit.\n */\nasync function isRateLimited(senderEmail: string): Promise<boolean> {\n  const cutoff = Date.now() - RATE_LIMIT_WINDOW_MS;\n  try {\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `\n        SELECT COUNT(*) AS c\n          FROM integration_pending_tasks\n         WHERE platform = ?\n           AND created_at >= ?\n           AND payload LIKE ? ESCAPE '\\\\'\n      `,\n      args: [\"email\", cutoff, `%\"senderId\":\"${escapeLike(senderEmail)}\"%`],\n    });\n    const count = Number(\n      (rows[0] as Record<string, unknown> | undefined)?.c ?? 0,\n    );\n    return count >= RATE_LIMIT_MAX;\n  } catch {\n    // Table doesn't exist yet (first webhook on a fresh deployment) — allow.\n    return false;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — email address parsing\n// ---------------------------------------------------------------------------\n\n/** Parse \"Name <addr@example.com>\" or plain \"addr@example.com\" */\nfunction parseEmailAddress(raw: string): { name?: string; email: string } {\n  const match = raw.match(/^\\s*(.*?)\\s*<([^>]+)>\\s*$/);\n  if (match && match[2]) {\n    return {\n      name: match[1].replace(/^[\"']|[\"']$/g, \"\").trim() || undefined,\n      email: match[2].trim(),\n    };\n  }\n  return { email: raw.trim() };\n}\n\n/** Normalize a to/cc field that may be a string, array, or undefined into a string[] of addresses */\nfunction normalizeAddressList(raw: string | string[] | undefined): string[] {\n  if (!raw) return [];\n  if (Array.isArray(raw)) return raw.map((a) => a.trim());\n  return raw.split(\",\").map((a) => a.trim());\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — header parsing\n// ---------------------------------------------------------------------------\n\n/** Parse a headers object (Resend format: array of {name, value} or Record) */\nfunction parseHeadersObject(headers: unknown): Record<string, string> {\n  const result: Record<string, string> = {};\n  if (!headers) return result;\n\n  if (Array.isArray(headers)) {\n    for (const h of headers) {\n      if (h && typeof h === \"object\" && \"name\" in h && \"value\" in h) {\n        result[(h.name as string).toLowerCase()] = h.value as string;\n      }\n    }\n  } else if (typeof headers === \"object\") {\n    for (const [key, value] of Object.entries(\n      headers as Record<string, unknown>,\n    )) {\n      result[key.toLowerCase()] = String(value);\n    }\n  }\n  return result;\n}\n\n/** Parse a raw headers string (SendGrid format: \"Key: Value\\nKey: Value\\n...\") */\nfunction parseHeadersString(raw: string | undefined): Record<string, string> {\n  const result: Record<string, string> = {};\n  if (!raw) return result;\n\n  const lines = raw.split(/\\r?\\n/);\n  let currentKey = \"\";\n  let currentValue = \"\";\n\n  for (const line of lines) {\n    // Continuation line (starts with whitespace)\n    if (/^\\s/.test(line) && currentKey) {\n      currentValue += \" \" + line.trim();\n      continue;\n    }\n    // Save previous header\n    if (currentKey) {\n      result[currentKey.toLowerCase()] = currentValue;\n    }\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx > 0) {\n      currentKey = line.slice(0, colonIdx).trim();\n      currentValue = line.slice(colonIdx + 1).trim();\n    } else {\n      currentKey = \"\";\n      currentValue = \"\";\n    }\n  }\n  // Save last header\n  if (currentKey) {\n    result[currentKey.toLowerCase()] = currentValue;\n  }\n  return result;\n}\n\n/** Parse a References header value into an array of Message-IDs */\nfunction parseReferencesHeader(\n  references: string | undefined,\n): string[] | undefined {\n  if (!references) return undefined;\n  const ids = references.match(/<[^>]+>/g);\n  return ids && ids.length > 0 ? ids : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — threading\n// ---------------------------------------------------------------------------\n\n/**\n * Get the thread root ID using a Gmail-style approach:\n * the oldest Message-ID from the References chain is the thread root.\n * If no References, use the current Message-ID.\n */\nfunction getThreadRootId(messageId: string, references?: string[]): string {\n  if (references && references.length > 0) {\n    return references[0];\n  }\n  return messageId;\n}\n\n/**\n * Scope a raw thread root id by the sender's email address. Two different\n * senders crafting the same `References:` header value should NOT collide\n * onto the same internal thread mapping — that's the email-side fix for the\n * thread-injection finding (M1 in the webhook security audit).\n *\n * The returned id is opaque to callers and stays stable across messages\n * from the same sender on the same conversation thread, so reply behaviour\n * is unchanged.\n */\nfunction scopeThreadIdToSender(\n  rawThreadId: string,\n  senderEmail: string,\n): string {\n  return `${senderEmail.toLowerCase()}::${rawThreadId}`;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — reply building\n// ---------------------------------------------------------------------------\n\n/** Build a References header from the platform context */\nfunction buildReferencesHeader(ctx: Record<string, unknown>): string {\n  const parts: string[] = [];\n\n  // Include existing references\n  const refs = ctx.references as string[] | undefined;\n  if (refs) {\n    parts.push(...refs);\n  }\n\n  // Append the current message ID\n  const messageId = ctx.messageId as string | undefined;\n  if (messageId) {\n    // Avoid duplicates\n    if (!parts.includes(messageId)) {\n      parts.push(messageId);\n    }\n  }\n\n  return parts.join(\" \");\n}\n\n/**\n * Build CC list for reply-all when agent was CC'd.\n * Include original To addresses and other CC addresses, excluding the agent and the original sender.\n */\nfunction buildReplyAllCc(context: IncomingMessage): string[] | undefined {\n  const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();\n  const senderEmail = context.senderId?.toLowerCase();\n  const toAddresses = (context.platformContext.to as string[]) || [];\n  const ccAddresses = (context.platformContext.cc as string[]) || [];\n\n  const allRecipients = new Set<string>();\n  for (const addr of [...toAddresses, ...ccAddresses]) {\n    const normalized = addr.toLowerCase().trim();\n    // Exclude agent address and original sender (sender goes in To)\n    if (normalized !== agentAddress && normalized !== senderEmail) {\n      allRecipients.add(normalized);\n    }\n  }\n\n  return allRecipients.size > 0 ? Array.from(allRecipients) : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — text conversion\n// ---------------------------------------------------------------------------\n\n/** Strip HTML tags for a plain-text version of the email */\nfunction stripHtmlForPlainText(html: string): string {\n  return html\n    .replace(/<br\\s*\\/?>/gi, \"\\n\")\n    .replace(/<\\/p>/gi, \"\\n\\n\")\n    .replace(/<\\/div>/gi, \"\\n\")\n    .replace(/<\\/li>/gi, \"\\n\")\n    .replace(/<li[^>]*>/gi, \"- \")\n    .replace(/<\\/h[1-6]>/gi, \"\\n\\n\")\n    .replace(/<[^>]+>/g, \"\")\n    .replace(/&nbsp;/g, \" \")\n    .replace(/&amp;/g, \"&\")\n    .replace(/&lt;/g, \"<\")\n    .replace(/&gt;/g, \">\")\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .replace(/\\n{3,}/g, \"\\n\\n\")\n    .trim();\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\nfunction decodeBasicHtmlEntities(s: string): string {\n  return s\n    .replace(/&amp;/g, \"&\")\n    .replace(/&lt;/g, \"<\")\n    .replace(/&gt;/g, \">\")\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\");\n}\n\nfunction splitTrailingUrlPunctuation(raw: string): {\n  url: string;\n  trailing: string;\n} {\n  let url = raw;\n  let trailing = \"\";\n  const trailingEntities = [\"&quot;\", \"&#39;\"];\n\n  for (;;) {\n    const entity = trailingEntities.find((candidate) =>\n      url.endsWith(candidate),\n    );\n    if (!entity) break;\n    url = url.slice(0, -entity.length);\n    trailing = entity + trailing;\n  }\n\n  while (/[.,!?;:]$/.test(url)) {\n    trailing = url.slice(-1) + trailing;\n    url = url.slice(0, -1);\n  }\n\n  while (url.endsWith(\")\") && !url.includes(\"(\")) {\n    trailing = \")\" + trailing;\n    url = url.slice(0, -1);\n  }\n\n  return { url, trailing };\n}\n\nfunction labelForUrl(rawUrl: string): string {\n  try {\n    const parsed = new URL(decodeBasicHtmlEntities(rawUrl));\n    const host = parsed.hostname.replace(/^www\\./, \"\");\n    return host ? `Open ${host}` : \"Open link\";\n  } catch {\n    return \"Open link\";\n  }\n}\n\nfunction linkifyTextSegment(segment: string): string {\n  return segment.replace(/\\bhttps?:\\/\\/[^\\s<>\"']+/gi, (raw) => {\n    const { url, trailing } = splitTrailingUrlPunctuation(raw);\n    const href = decodeBasicHtmlEntities(url);\n    return `<a href=\"${escapeHtml(href)}\" style=\"color:#2563eb;text-decoration:underline;\">${escapeHtml(\n      labelForUrl(url),\n    )}</a>${trailing}`;\n  });\n}\n\nfunction linkifyBareUrlsInHtml(html: string): string {\n  const parts = html.split(/(<\\/?[^>]+>)/g);\n  let skipDepth = 0;\n\n  return parts\n    .map((part) => {\n      if (part.startsWith(\"<\") && part.endsWith(\">\")) {\n        if (/^<\\/\\s*(a|code)\\b/i.test(part)) {\n          skipDepth = Math.max(0, skipDepth - 1);\n        } else if (/^<\\s*(a|code)\\b/i.test(part)) {\n          skipDepth += 1;\n        }\n        return part;\n      }\n      return skipDepth > 0 ? part : linkifyTextSegment(part);\n    })\n    .join(\"\");\n}\n\n/** Convert basic markdown to HTML for email rendering */\nfunction markdownToHtml(md: string): string {\n  let html = md;\n\n  // Escape HTML entities in the source (but not our generated tags)\n  html = escapeHtml(html);\n\n  // Bold: **text** or __text__\n  html = html.replace(/\\*\\*(.+?)\\*\\*/g, \"<strong>$1</strong>\");\n  html = html.replace(/__(.+?)__/g, \"<strong>$1</strong>\");\n\n  // Italic: *text* or _text_ (but not inside words with underscores)\n  html = html.replace(/(?<!\\w)\\*([^*]+?)\\*(?!\\w)/g, \"<em>$1</em>\");\n  html = html.replace(/(?<!\\w)_([^_]+?)_(?!\\w)/g, \"<em>$1</em>\");\n\n  // Links: [text](url)\n  html = html.replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, (_match, label, url) => {\n    const visibleLabel = /^https?:\\/\\//i.test(decodeBasicHtmlEntities(label))\n      ? escapeHtml(labelForUrl(label))\n      : label;\n    return `<a href=\"${escapeHtml(\n      decodeBasicHtmlEntities(url),\n    )}\" style=\"color:#2563eb;text-decoration:underline;\">${visibleLabel}</a>`;\n  });\n\n  // Inline code: `code`\n  html = html.replace(\n    /`([^`]+)`/g,\n    '<code style=\"background:#f1f5f9;padding:1px 4px;border-radius:3px;font-size:0.9em;\">$1</code>',\n  );\n\n  // Bare URLs: keep the destination in href but avoid spelling long URLs out.\n  html = linkifyBareUrlsInHtml(html);\n\n  // Unordered lists: lines starting with \"- \" or \"* \"\n  html = html.replace(/^([*-]) (.+)$/gm, \"<li>$2</li>\");\n  // Wrap consecutive <li> in <ul>\n  html = html.replace(\n    /(<li>.*?<\\/li>\\n?)+/g,\n    '<ul style=\"margin:8px 0;padding-left:20px;\">$&</ul>',\n  );\n\n  // Ordered lists: lines starting with \"1. \", \"2. \" etc.\n  html = html.replace(/^\\d+\\. (.+)$/gm, \"<li>$1</li>\");\n  // Wrap consecutive <li> that aren't in <ul> in <ol>\n  html = html.replace(/(?<!<\\/ul>)(<li>.*?<\\/li>\\n?)+/g, (match) => {\n    if (match.includes(\"<ul\")) return match;\n    return `<ol style=\"margin:8px 0;padding-left:20px;\">${match}</ol>`;\n  });\n\n  // Headings: # through ###\n  html = html.replace(\n    /^### (.+)$/gm,\n    '<h3 style=\"margin:16px 0 8px;font-size:1.1em;\">$1</h3>',\n  );\n  html = html.replace(\n    /^## (.+)$/gm,\n    '<h2 style=\"margin:16px 0 8px;font-size:1.25em;\">$1</h2>',\n  );\n  html = html.replace(\n    /^# (.+)$/gm,\n    '<h1 style=\"margin:16px 0 8px;font-size:1.4em;\">$1</h1>',\n  );\n\n  // Horizontal rules: --- or ***\n  html = html.replace(\n    /^(-{3,}|\\*{3,})$/gm,\n    '<hr style=\"border:none;border-top:1px solid #e2e8f0;margin:16px 0;\">',\n  );\n\n  // Paragraphs: double newlines\n  html = html.replace(/\\n\\n/g, \"</p><p>\");\n  // Single newlines → <br>\n  html = html.replace(/\\n/g, \"<br>\");\n\n  // Wrap in paragraph tags\n  html = `<p>${html}</p>`;\n  // Clean up empty paragraphs\n  html = html.replace(/<p>\\s*<\\/p>/g, \"\");\n\n  return html;\n}\n\n/** Wrap body HTML in a minimal email template with inline styles */\nfunction wrapInEmailTemplate(bodyHtml: string): string {\n  return `<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n</head>\n<body style=\"margin:0;padding:0;background-color:#ffffff;\">\n<div style=\"max-width:600px;margin:0 auto;padding:20px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.6;color:#1a1a1a;\">\n${bodyHtml}\n</div>\n</body>\n</html>`;\n}\n\n// ---------------------------------------------------------------------------\n// Raw body reader (matches Slack adapter pattern)\n// ---------------------------------------------------------------------------\n\n/**\n * Read the raw request body as a string and cache on the event context.\n * Reads raw bytes from the request stream — never re-stringifies a parsed\n * body, since the Resend / Svix HMAC is computed over the exact bytes sent\n * (M2 in the webhook security audit).\n */\nasync function readRawBody(event: H3Event): Promise<string> {\n  const cached = event.context.__rawBody;\n  if (typeof cached === \"string\") return cached;\n  const raw = (await h3ReadRawBody(event)) ?? \"\";\n  event.context.__rawBody = raw;\n  return raw;\n}\n"]}
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/integrations/adapters/email.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,IAAI,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAS1D,wCAAwC;AACxC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,0DAA0D;AAC1D,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,uCAAuC;AACvC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C;;;;;GAKG;AACH,IAAI,uBAAuB,GAAG,KAAK,CAAC;AACpC,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,OAAO;QAEd,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,qBAAqB;oBAC1B,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,wIAAwI;iBAC3I;gBACD;oBACE,GAAG,EAAE,gBAAgB;oBACrB,KAAK,EAAE,gBAAgB;oBACvB,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,uHAAuH;iBAC1H;gBACD;oBACE,GAAG,EAAE,kBAAkB;oBACvB,KAAK,EAAE,kBAAkB;oBACzB,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,qGAAqG;iBACxG;gBACD;oBACE,GAAG,EAAE,8BAA8B;oBACnC,KAAK,EAAE,wBAAwB;oBAC/B,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,uKAAuK;iBAC1K;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,MAAe;YAEf,iDAAiD;YACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,MAAM,GACV,CAAC,MAAM,aAAa,CAAC,8BAA8B,CAAC,CAAC,IAAI,SAAS,CAAC;YACrE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAE1C,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5C,CAAC;YAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;YAED,kCAAkC;YAClC,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,CACnB,MAAM,aAAa,CAAC,qBAAqB,CAAC,CAC3C,EAAE,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,MAAM,GAAuB,IAAI,CAAC;YAEtC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBACnC,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEzB,2EAA2E;YAC3E,yEAAyE;YACzE,gEAAgE;YAChE,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,MAAM,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CACV,gCAAgC,WAAW,MAAM,cAAc,MAAM,CACtE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,wBAAwB;YACxB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;gBACvC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,cAA0B,CAAC;gBAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC/C,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;wBACrD,OAAO,CAAC,IAAI,CACV,+BAA+B,WAAW,gCAAgC,CAC3E,CAAC;wBACF,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1D,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAClE,MAAM,IAAI,GACR,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC;gBACnC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAErC,yFAAyF;YACzF,+EAA+E;YAC/E,8EAA8E;YAC9E,yEAAyE;YACzE,gFAAgF;YAChF,6EAA6E;YAC7E,6CAA6C;YAC7C,MAAM,YAAY,GAAG,qBAAqB,CACxC,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,EACpD,WAAW,CACZ,CAAC;YAEF,kBAAkB;YAClB,IAAI,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YAEvE,qBAAqB;YACrB,IAAI,QAAQ,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC5C,QAAQ;oBACN,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,GAAG,uBAAuB,CAAC;YACvE,CAAC;YAED,kCAAkC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,eAAe,GAAG,WAAW;qBAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC;qBACjC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,QAAQ;oBACN,0BAA0B,WAAW,QAAQ,eAAe,IAAI,QAAQ,KAAK;wBAC7E,YAAY,MAAM,CAAC,OAAO,MAAM;wBAChC,QAAQ,CAAC;YACb,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,gBAAgB,EAAE,YAAY;gBAC9B,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;gBAC5B,QAAQ,EAAE,WAAW;gBACrB,6DAA6D;gBAC7D,gEAAgE;gBAChE,+DAA+D;gBAC/D,oEAAoE;gBACpE,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,eAAe,EAAE;oBACf,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,WAAW;oBACjB,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,IAAI;oBACJ,cAAc,EAAE,MAAM,CAAC,cAAc;iBACtC;gBACD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;aACtE,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,CAAC;YAChE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GACd,MAAM,EAAE,UAAU,EAAE,WAAsB,IAAI,gBAAgB,CAAC;YAElE,sEAAsE;YACtE,mEAAmE;YACnE,4DAA4D;YAC5D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,SAAS,IAAI,GAAG,WAAW,KAAK,YAAY,GAAG,CAAC;YAEpE,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,OAAiB,CAAC;YAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC;YAE1E,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,OAAO,CAAC,QAAS;oBACrB,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,SAAS;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC;oBACzC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,SAAmB;oBACtD,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC;oBAC1D,EAAE,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI;wBAC9B,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC;wBACxC,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,CAAC;YAChE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GACd,MAAM,EAAE,UAAU,EAAE,WAAsB,IAAI,gBAAgB,CAAC;YAElE,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC;oBACd,EAAE,EAAE,MAAM,CAAC,WAAW;oBACtB,IAAI,EAAE,GAAG,WAAW,KAAK,YAAY,GAAG;oBACxC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,6BAA6B;oBACtD,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC;oBACzC,GAAG,CAAC,MAAM,CAAC,SAAS;wBAClB,CAAC,CAAC;4BACE,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,UAAU,EAAE,MAAM,CAAC,SAAS;yBAC7B;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAChE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QAC7C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,eAAe,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACvE,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACnD,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAC7C,8BAA8B,CAC/B,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,eAAe,IAAI,gBAAgB,CAAC;YAEvD,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,eAAe;oBACf,gBAAgB;oBAChB,gBAAgB;oBAChB,QAAQ,EAAE,MAAM,gBAAgB,EAAE;iBACnC;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,oFAAoF;oBACtF,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AA4BD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,KAAK,UAAU,mBAAmB,CAChC,KAAc,EACd,MAAe;IAEf,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC7B,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,OAAO,CAAC,KAAK,CACX,wFAAwF;oBACtF,2GAA2G,CAC9G,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,uBAAuB,GAAG,IAAI,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAEzD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2DAA2D;IAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAE3C,oDAAoD;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAErD,MAAM,aAAa,GAAG,GAAG,MAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;IAC3D,MAAM,iBAAiB,GAAG,MAAM;SAC7B,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;SACjC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpB,+EAA+E;IAC/E,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,IAAI,CAAC;YACH,IACE,MAAM,CAAC,eAAe,CACpB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CACtB,EACD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,EAAE,CAAS;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAc,EACd,MAAe;IAEf,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBAC/B,yBAAyB,GAAG,IAAI,CAAC;gBACjC,OAAO,CAAC,KAAK,CACX,0FAA0F;oBACxF,2GAA2G,CAC9G,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,yBAAyB,GAAG,IAAI,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACf,iEAAiE;QACjE,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;YACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC1D,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5E,OAAO,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,KAAK,UAAU,kBAAkB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAA0B,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAmC,CAAC;IACvD,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAmC,CAAC;IACvD,MAAM,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAEvC,wDAAwD;IACxD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GACb,OAAO,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAEnE,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,WAAW,EAAE,OAAO,CAAC,wBAAwB,CAAC;QAC9C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC3D,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACzD,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,OAAO,EAAG,IAAI,CAAC,OAAkB,IAAI,cAAc;QACnD,IAAI;QACJ,EAAE;QACF,EAAE,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClC,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,SAAS;QAC9C,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,EAAG,IAAI,CAAC,UAAqB,IAAI,SAAS;QAC9C,cAAc;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAc;IAEd,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,sDAAsD;IACtD,uDAAuD;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAA0B,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAwB,CAAC;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,EAAwB,CAAC;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtE,2BAA2B;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,OAA6B,CAAC;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAEpE,8EAA8E;IAC9E,wDAAwD;IACxD,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,WAAW,EAAE,OAAO,CAAC,wBAAwB,CAAC;QAC9C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC3D,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACzD,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,OAAO,EAAG,IAAI,CAAC,OAAkB,IAAI,cAAc;QACnD,IAAI;QACJ,EAAE;QACF,EAAE,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAClC,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,IAAI,EAAE,IAAI,CAAC,IAA0B;QACrC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,SAAS;QAC9C,UAAU,EAAE,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS;QAClC,cAAc;KACf,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,CAAC;QACZ,CAAC,CAAC,KAAK;aACF,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;aACb,IAAI,EAAE;aACN,WAAW,EAAE;QAClB,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAE,aAAqB;IAC7D,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,UAAU,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC;QACxC,aAAa,CAAC,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAAC,KAK9B;IACC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,mEAAmE;IACnE,iDAAiD;IACjD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CACrC,8EAA8E,CAC/E,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,UAAU,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IAED,2EAA2E;IAC3E,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAC3C,+BAA+B;QAC/B,MAAM,MAAM,GAAG,qDAAqD,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpD,CAAC;QACD,wDAAwD;QACxD,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;;;;;;OAMJ;YACD,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;SACrE,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CACjB,IAAI,CAAC,CAAC,CAAyC,EAAE,CAAC,IAAI,CAAC,CACzD,CAAC;QACF,OAAO,KAAK,IAAI,cAAc,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,kEAAkE;AAClE,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;YAC9D,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/B,CAAC;AAED,qGAAqG;AACrG,SAAS,oBAAoB,CAAC,GAAkC;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAE5B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBAC9D,MAAM,CAAE,CAAC,CAAC,IAAe,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,KAAe,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACvC,OAAkC,CACnC,EAAE,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,GAAuB;IACjD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IAExB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,YAAY,GAAG,EAAE,CAAC;IAEtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,6CAA6C;QAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACnC,YAAY,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,uBAAuB;QACvB,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC;QAClD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,EAAE,CAAC;YAChB,YAAY,GAAG,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IACD,mBAAmB;IACnB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,SAAS,qBAAqB,CAC5B,UAA8B;IAE9B,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,eAAe,CAAC,SAAiB,EAAE,UAAqB;IAC/D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,WAAmB,EACnB,WAAmB;IAEnB,OAAO,GAAG,WAAW,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,0DAA0D;AAC1D,SAAS,qBAAqB,CAAC,GAA4B;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,8BAA8B;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAkC,CAAC;IACpD,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,gCAAgC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAA+B,CAAC;IACtD,IAAI,SAAS,EAAE,CAAC;QACd,mBAAmB;QACnB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,OAAwB,EACxB,YAAoB;IAEpB,MAAM,sBAAsB,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACpD,MAAM,WAAW,GAAI,OAAO,CAAC,eAAe,CAAC,EAAe,IAAI,EAAE,CAAC;IACnE,MAAM,WAAW,GAAI,OAAO,CAAC,eAAe,CAAC,EAAe,IAAI,EAAE,CAAC;IAEnE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,WAAW,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC7C,gEAAgE;QAChE,IAAI,UAAU,KAAK,sBAAsB,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YACxE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,4DAA4D;AAC5D,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;SAC1B,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC;SACzB,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC;SAC5B,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;SAC/B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAS;IACxC,OAAO,CAAC;SACL,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAW;IAI9C,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE7C,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CACxB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM;QACnB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC/B,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;QACpC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,QAAQ,GAAG,GAAG,GAAG,QAAQ,CAAC;QAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,YAAY,UAAU,CAAC,IAAI,CAAC,sDAAsD,UAAU,CACjG,WAAW,CAAC,GAAG,CAAC,CACjB,OAAO,QAAQ,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,SAAS,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,SAAS,cAAc,CAAC,EAAU;IAChC,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,kEAAkE;IAClE,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAExB,6BAA6B;IAC7B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;IAC7D,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAEzD,mEAAmE;IACnE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;IAE/D,qBAAqB;IACrB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrE,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;YACvE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC,CAAC,KAAK,CAAC;QACV,OAAO,YAAY,UAAU,CAC3B,uBAAuB,CAAC,GAAG,CAAC,CAC7B,sDAAsD,YAAY,MAAM,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,YAAY,EACZ,+FAA+F,CAChG,CAAC;IAEF,4EAA4E;IAC5E,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAEnC,oDAAoD;IACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACtD,gCAAgC;IAChC,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,sBAAsB,EACtB,qDAAqD,CACtD,CAAC;IAEF,uDAAuD;IACvD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACrD,oDAAoD;IACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,KAAK,EAAE,EAAE;QAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,+CAA+C,KAAK,OAAO,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,cAAc,EACd,wDAAwD,CACzD,CAAC;IACF,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,aAAa,EACb,yDAAyD,CAC1D,CAAC;IACF,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,YAAY,EACZ,wDAAwD,CACzD,CAAC;IAEF,+BAA+B;IAC/B,IAAI,GAAG,IAAI,CAAC,OAAO,CACjB,oBAAoB,EACpB,sEAAsE,CACvE,CAAC;IAEF,8BAA8B;IAC9B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,yBAAyB;IACzB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEnC,yBAAyB;IACzB,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC;IACxB,4BAA4B;IAC5B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAExC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oEAAoE;AACpE,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO;;;;;;;;EAQP,QAAQ;;;QAGF,CAAC;AACT,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;;;GAKG;AACH,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\n\nimport type { H3Event } from \"h3\";\nimport { getHeader, readRawBody as h3ReadRawBody } from \"h3\";\n\nimport { getDbExec } from \"../../db/client.js\";\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { resolveSecret } from \"../../server/credential-provider.js\";\nimport {\n  sendEmail,\n  isEmailConfigured,\n  getEmailProvider,\n} from \"../../server/email.js\";\nimport { getIntegrationConfig } from \"../config-store.js\";\nimport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  OutboundTarget,\n} from \"../types.js\";\n\n/** Max body length before truncation */\nconst EMAIL_MAX_BODY_LENGTH = 15000;\n\n/** Rate limit: max emails per sender within the window */\nconst RATE_LIMIT_MAX = 20;\n/** Rate limit window in ms (1 hour) */\nconst RATE_LIMIT_WINDOW_MS = 60 * 60 * 1000;\n\n/**\n * One-shot warning flags so we don't spam logs on every webhook.\n * Cleared per process — one warning per cold start is enough to surface\n * a misconfiguration without leaking config status to anyone with log access\n * (M6 in the webhook security audit).\n */\nlet _resendUnverifiedWarned = false;\nlet _sendgridUnverifiedWarned = false;\n\nfunction escapeLike(value: string): string {\n  return value.replace(/([\\\\%_])/g, \"\\\\$1\");\n}\n\n/**\n * Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose signature can't\n * be verified — accepting them with attacker-controlled `from:` addresses\n * lets the dispatch owner-resolution path run as the victim (C1 in the\n * webhook security audit).\n */\nfunction shouldRefuseWhenSecretMissing(): boolean {\n  if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n  return process.env.NODE_ENV === \"production\";\n}\n\n/**\n * Create an Email platform adapter for inbound/outbound email via\n * Resend or SendGrid webhooks.\n *\n * Required env vars:\n * - EMAIL_AGENT_ADDRESS — The email address the agent receives mail at\n *\n * One of these must also be set (checked via isEmailConfigured()):\n * - RESEND_API_KEY — For sending/receiving via Resend\n * - SENDGRID_API_KEY — For sending/receiving via SendGrid\n *\n * Optional:\n * - EMAIL_INBOUND_WEBHOOK_SECRET — Webhook signature verification secret\n */\nexport function emailAdapter(): PlatformAdapter {\n  return {\n    platform: \"email\",\n    label: \"Email\",\n\n    getRequiredEnvKeys(): EnvKeyConfig[] {\n      return [\n        {\n          key: \"EMAIL_AGENT_ADDRESS\",\n          label: \"Agent Email Address\",\n          required: true,\n          helpText:\n            \"The email address people will use to message your agent (e.g. `agent@yourcompany.com`, or pick from your `<slug>.resend.app` sandbox).\",\n        },\n        {\n          key: \"RESEND_API_KEY\",\n          label: \"Resend API Key\",\n          required: false,\n          helpText:\n            \"From resend.com → API keys (starts with `re_`). Either Resend or SendGrid is required for sending and receiving mail.\",\n        },\n        {\n          key: \"SENDGRID_API_KEY\",\n          label: \"SendGrid API Key\",\n          required: false,\n          helpText:\n            \"From sendgrid.com → Settings → API Keys (starts with `SG.`). Either Resend or SendGrid is required.\",\n        },\n        {\n          key: \"EMAIL_INBOUND_WEBHOOK_SECRET\",\n          label: \"Inbound Webhook Secret\",\n          required: false,\n          helpText:\n            \"Optional. From Resend (Webhooks → Signing Secret, starts with `whsec_`) or your SendGrid Inbound Parse basic-auth password. Used to verify inbound webhooks are real.\",\n        },\n      ];\n    },\n\n    async handleVerification(\n      _event: H3Event,\n    ): Promise<{ handled: boolean; response?: unknown }> {\n      // Email webhooks don't need challenge handshakes\n      return { handled: false };\n    },\n\n    async verifyWebhook(event: H3Event): Promise<boolean> {\n      const secret =\n        (await resolveSecret(\"EMAIL_INBOUND_WEBHOOK_SECRET\")) ?? undefined;\n      const provider = await getEmailProvider();\n\n      if (provider === \"resend\") {\n        return verifyResendWebhook(event, secret);\n      }\n\n      if (provider === \"sendgrid\") {\n        return verifySendGridWebhook(event, secret);\n      }\n\n      // No provider configured — reject\n      console.warn(\"[email] No email provider configured, rejecting webhook\");\n      return false;\n    },\n\n    async parseIncomingMessage(\n      event: H3Event,\n    ): Promise<IncomingMessage | null> {\n      const provider = await getEmailProvider();\n      const agentAddress = (\n        await resolveSecret(\"EMAIL_AGENT_ADDRESS\")\n      )?.toLowerCase();\n      if (!agentAddress) {\n        console.warn(\"[email] EMAIL_AGENT_ADDRESS not configured\");\n        return null;\n      }\n\n      let parsed: ParsedEmail | null = null;\n\n      if (provider === \"resend\") {\n        parsed = await parseResendWebhook(event);\n      } else if (provider === \"sendgrid\") {\n        parsed = await parseSendGridWebhook(event);\n      }\n\n      if (!parsed) return null;\n\n      // Rate limiting (SQL-backed heuristic — counts the sender's already-queued\n      // tasks within the last hour). The previous in-memory map reset on every\n      // serverless cold start, so the actual ceiling per attacker was\n      // RATE_LIMIT_MAX × number_of_active_instances. SQL-backed counting holds\n      // across instances. See H4 in the webhook security audit.\n      const senderEmail = parsed.from.email.toLowerCase();\n      if (await isRateLimited(senderEmail)) {\n        console.warn(\n          `[email] Rate limited sender: ${senderEmail} (>${RATE_LIMIT_MAX}/hr)`,\n        );\n        return null;\n      }\n\n      // Check allowed domains\n      const config = await getIntegrationConfig(\"email\");\n      if (config?.configData?.allowedDomains) {\n        const allowed = config.configData.allowedDomains as string[];\n        if (allowed.length > 0) {\n          const senderDomain = senderEmail.split(\"@\")[1];\n          if (!senderDomain || !allowed.includes(senderDomain)) {\n            console.warn(\n              `[email] Rejected email from ${senderEmail}: domain not in allowedDomains`,\n            );\n            return null;\n          }\n        }\n      }\n\n      // Determine if agent was CC'd (not in To, but in CC)\n      const toAddresses = parsed.to.map((a) => a.toLowerCase());\n      const ccAddresses = (parsed.cc ?? []).map((a) => a.toLowerCase());\n      const isCC =\n        !toAddresses.includes(agentAddress) &&\n        ccAddresses.includes(agentAddress);\n\n      // Build thread ID from References chain (Gmail-style: oldest Message-ID is thread root).\n      // Scope the thread root by sender so an attacker who can forge a `References:`\n      // header pointing at someone else's thread root can't graft into that thread.\n      // Without this scoping, a third party could craft an inbound email whose\n      // References chain matches a known victim's Message-ID and inject messages into\n      // the victim's existing conversation — leaking prior content via the agent's\n      // reply (M1 in the webhooks security audit).\n      const threadRootId = scopeThreadIdToSender(\n        getThreadRootId(parsed.messageId, parsed.references),\n        senderEmail,\n      );\n\n      // Build body text\n      let bodyText = parsed.text || stripHtmlForPlainText(parsed.html || \"\");\n\n      // Truncate if needed\n      if (bodyText.length > EMAIL_MAX_BODY_LENGTH) {\n        bodyText =\n          bodyText.slice(0, EMAIL_MAX_BODY_LENGTH) + \"\\n[Message truncated]\";\n      }\n\n      // Prefix CC'd emails with context\n      if (isCC) {\n        const otherRecipients = toAddresses\n          .filter((a) => a !== agentAddress)\n          .join(\", \");\n        bodyText =\n          `[CC'd on email between ${senderEmail} and ${otherRecipients || \"others\"}]\\n` +\n          `Subject: ${parsed.subject}\\n\\n` +\n          bodyText;\n      }\n\n      return {\n        platform: \"email\",\n        externalThreadId: threadRootId,\n        text: bodyText,\n        senderName: parsed.from.name,\n        senderId: senderEmail,\n        // Carry the message-authentication verdict downstream. Owner\n        // resolution (dispatch) must NOT grant a real user's identity /\n        // credentials unless the sender is verified — an unverified or\n        // spoofed `From:` falls back to a synthetic, credential-less owner.\n        senderVerified: parsed.senderVerified,\n        platformContext: {\n          messageId: parsed.messageId,\n          subject: parsed.subject,\n          from: senderEmail,\n          to: parsed.to,\n          cc: parsed.cc,\n          inReplyTo: parsed.inReplyTo,\n          references: parsed.references,\n          isCC,\n          senderVerified: parsed.senderVerified,\n        },\n        timestamp: parsed.date ? new Date(parsed.date).getTime() : Date.now(),\n      };\n    },\n\n    async sendResponse(\n      message: OutgoingMessage,\n      context: IncomingMessage,\n    ): Promise<void> {\n      const agentAddress = await resolveSecret(\"EMAIL_AGENT_ADDRESS\");\n      if (!agentAddress) {\n        console.error(\"[email] EMAIL_AGENT_ADDRESS not configured\");\n        return;\n      }\n\n      const config = await getIntegrationConfig(\"email\");\n      const displayName =\n        (config?.configData?.displayName as string) || \"Dispatch Agent\";\n\n      // EMAIL_FROM overrides the from-address — required when the receiving\n      // address is on a sub-domain that can't be a verified sender (e.g.\n      // *.resend.app). Inbound and outbound addresses can differ.\n      const emailFrom = await resolveSecret(\"EMAIL_FROM\");\n      const fromAddress = emailFrom || `${displayName} <${agentAddress}>`;\n\n      const subject = context.platformContext.subject as string;\n      const reSubject = subject.startsWith(\"Re: \") ? subject : `Re: ${subject}`;\n\n      try {\n        await sendEmail({\n          to: context.senderId!,\n          from: fromAddress,\n          subject: reSubject,\n          html: message.text,\n          text: stripHtmlForPlainText(message.text),\n          inReplyTo: context.platformContext.messageId as string,\n          references: buildReferencesHeader(context.platformContext),\n          cc: context.platformContext.isCC\n            ? buildReplyAllCc(context, agentAddress)\n            : undefined,\n        });\n      } catch (err) {\n        console.error(\"[email] Failed to send response:\", err);\n      }\n    },\n\n    async sendMessageToTarget(\n      message: OutgoingMessage,\n      target: OutboundTarget,\n    ): Promise<void> {\n      const agentAddress = await resolveSecret(\"EMAIL_AGENT_ADDRESS\");\n      if (!agentAddress) {\n        console.error(\"[email] EMAIL_AGENT_ADDRESS not configured\");\n        return;\n      }\n\n      const config = await getIntegrationConfig(\"email\");\n      const displayName =\n        (config?.configData?.displayName as string) || \"Dispatch Agent\";\n\n      try {\n        await sendEmail({\n          to: target.destination,\n          from: `${displayName} <${agentAddress}>`,\n          subject: target.label || \"Message from Dispatch Agent\",\n          html: message.text,\n          text: stripHtmlForPlainText(message.text),\n          ...(target.threadRef\n            ? {\n                inReplyTo: target.threadRef,\n                references: target.threadRef,\n              }\n            : {}),\n        });\n      } catch (err) {\n        console.error(\"[email] Failed to send proactive message:\", err);\n        throw err;\n      }\n    },\n\n    formatAgentResponse(text: string): OutgoingMessage {\n      const bodyHtml = markdownToHtml(text);\n      const html = wrapInEmailTemplate(bodyHtml);\n      return { text: html, platformContext: {} };\n    },\n\n    async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n      const hasAgentAddress = !!(await resolveSecret(\"EMAIL_AGENT_ADDRESS\"));\n      const hasEmailProvider = await isEmailConfigured();\n      const hasWebhookSecret = !!(await resolveSecret(\n        \"EMAIL_INBOUND_WEBHOOK_SECRET\",\n      ));\n      const configured = hasAgentAddress && hasEmailProvider;\n\n      return {\n        platform: \"email\",\n        label: \"Email\",\n        enabled: false, // overridden by plugin\n        configured,\n        details: {\n          hasAgentAddress,\n          hasEmailProvider,\n          hasWebhookSecret,\n          provider: await getEmailProvider(),\n        },\n        error: !configured\n          ? \"Save EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY in settings\"\n          : undefined,\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Parsed email shape\n// ---------------------------------------------------------------------------\n\ninterface ParsedEmail {\n  messageId: string;\n  subject: string;\n  from: { name?: string; email: string };\n  to: string[];\n  cc?: string[];\n  text?: string;\n  html?: string;\n  inReplyTo?: string;\n  references?: string[];\n  date?: string;\n  /**\n   * True when the provider's message-authentication results show that the\n   * mail genuinely originated from the From domain: DKIM `pass` aligned with\n   * the From domain, or an aligned SPF `pass`. False when results are absent\n   * or fail — we fail closed so a spoofed `From:` can never be treated as\n   * verified. See FINDING 3 (inbound-email impersonation) in the webhook\n   * security audit.\n   */\n  senderVerified: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Webhook verification\n// ---------------------------------------------------------------------------\n\nasync function verifyResendWebhook(\n  event: H3Event,\n  secret?: string,\n): Promise<boolean> {\n  if (!secret) {\n    if (shouldRefuseWhenSecretMissing()) {\n      if (!_resendUnverifiedWarned) {\n        _resendUnverifiedWarned = true;\n        console.error(\n          \"[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — refusing Resend webhook in production. \" +\n            \"Set EMAIL_INBOUND_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n        );\n      }\n      return false;\n    }\n    if (!_resendUnverifiedWarned) {\n      _resendUnverifiedWarned = true;\n      console.warn(\n        \"[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — accepting Resend webhook without verification (dev mode)\",\n      );\n    }\n    return true;\n  }\n\n  const svixId = getHeader(event, \"svix-id\");\n  const svixTimestamp = getHeader(event, \"svix-timestamp\");\n  const svixSignature = getHeader(event, \"svix-signature\");\n\n  if (!svixId || !svixTimestamp || !svixSignature) {\n    console.warn(\"[email] Missing Svix signature headers\");\n    return false;\n  }\n\n  // Reject requests older than 5 minutes (replay protection)\n  const ts = parseInt(svixTimestamp, 10);\n  if (Math.abs(Date.now() / 1000 - ts) > 300) {\n    console.warn(\"[email] Svix timestamp too old, rejecting\");\n    return false;\n  }\n\n  const body = await readRawBody(event);\n  const crypto = await import(\"node:crypto\");\n\n  // Svix signing secret may be prefixed with \"whsec_\"\n  const rawSecret = secret.startsWith(\"whsec_\") ? secret.slice(6) : secret;\n  const secretBytes = Buffer.from(rawSecret, \"base64\");\n\n  const signedContent = `${svixId}.${svixTimestamp}.${body}`;\n  const expectedSignature = crypto\n    .createHmac(\"sha256\", secretBytes)\n    .update(signedContent)\n    .digest(\"base64\");\n\n  // Svix sends multiple signatures separated by spaces, each prefixed with \"v1,\"\n  const signatures = svixSignature.split(\" \");\n  for (const sig of signatures) {\n    const sigValue = sig.startsWith(\"v1,\") ? sig.slice(3) : sig;\n    try {\n      if (\n        crypto.timingSafeEqual(\n          Buffer.from(expectedSignature),\n          Buffer.from(sigValue),\n        )\n      ) {\n        return true;\n      }\n    } catch {\n      // Length mismatch — try next signature\n    }\n  }\n\n  console.warn(\"[email] Svix signature verification failed\");\n  return false;\n}\n\nfunction safeEq(a: string, b: string): boolean {\n  const aBuf = Buffer.from(a);\n  const bBuf = Buffer.from(b);\n  if (aBuf.length !== bBuf.length) return false;\n  return timingSafeEqual(aBuf, bBuf);\n}\n\nasync function verifySendGridWebhook(\n  event: H3Event,\n  secret?: string,\n): Promise<boolean> {\n  if (!secret) {\n    if (shouldRefuseWhenSecretMissing()) {\n      if (!_sendgridUnverifiedWarned) {\n        _sendgridUnverifiedWarned = true;\n        console.error(\n          \"[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — refusing SendGrid webhook in production. \" +\n            \"Set EMAIL_INBOUND_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n        );\n      }\n      return false;\n    }\n    if (!_sendgridUnverifiedWarned) {\n      _sendgridUnverifiedWarned = true;\n      console.warn(\n        \"[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — accepting SendGrid webhook without verification (dev mode)\",\n      );\n    }\n    return true;\n  }\n\n  // Check for the secret in a custom header or basic auth\n  const authHeader = getHeader(event, \"authorization\");\n  if (authHeader) {\n    // Basic auth: \"Basic base64(user:pass)\" — secret is the password\n    if (authHeader.startsWith(\"Basic \")) {\n      const decoded = Buffer.from(authHeader.slice(6), \"base64\").toString();\n      const password = decoded.split(\":\")[1];\n      if (password !== undefined && safeEq(password, secret)) return true;\n    }\n  }\n\n  // Also check a custom header (common SendGrid Inbound Parse pattern)\n  const customSecret = getHeader(event, \"x-webhook-secret\");\n  if (customSecret !== undefined && safeEq(customSecret, secret)) return true;\n\n  console.warn(\"[email] SendGrid webhook secret verification failed\");\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// Inbound email parsing\n// ---------------------------------------------------------------------------\n\nasync function parseResendWebhook(event: H3Event): Promise<ParsedEmail | null> {\n  const raw = await readRawBody(event);\n  const body = JSON.parse(raw);\n  if (!body || body.type !== \"email.received\") return null;\n\n  const data = body.data;\n  if (!data) return null;\n\n  // Resend webhook payload provides email metadata directly in data\n  // Fields: from, to, cc, subject, text, html, headers, created_at\n  const fromRaw = data.from as string | undefined;\n  const from = fromRaw ? parseEmailAddress(fromRaw) : null;\n  if (!from) return null;\n\n  const toRaw = data.to as string | string[] | undefined;\n  const to = normalizeAddressList(toRaw);\n  const ccRaw = data.cc as string | string[] | undefined;\n  const cc = normalizeAddressList(ccRaw);\n\n  // Parse headers for Message-ID, In-Reply-To, References\n  const headers = parseHeadersObject(data.headers);\n  const messageId =\n    headers[\"message-id\"] || data.email_id || `resend-${Date.now()}`;\n\n  // Resend forwards the raw `Authentication-Results` header (and may also\n  // surface explicit `dkim`/`spf` fields). Derive a verified verdict from\n  // whichever is present; absent results fail closed (unverified).\n  const senderVerified = computeSenderVerified({\n    fromEmail: from.email,\n    authResults: headers[\"authentication-results\"],\n    dkim: typeof data.dkim === \"string\" ? data.dkim : undefined,\n    spf: typeof data.spf === \"string\" ? data.spf : undefined,\n  });\n\n  return {\n    messageId,\n    subject: (data.subject as string) || \"(no subject)\",\n    from,\n    to,\n    cc: cc.length > 0 ? cc : undefined,\n    text: data.text as string | undefined,\n    html: data.html as string | undefined,\n    inReplyTo: headers[\"in-reply-to\"] || undefined,\n    references: parseReferencesHeader(headers[\"references\"]),\n    date: (data.created_at as string) || undefined,\n    senderVerified,\n  };\n}\n\nasync function parseSendGridWebhook(\n  event: H3Event,\n): Promise<ParsedEmail | null> {\n  const raw = await readRawBody(event);\n  const body = JSON.parse(raw);\n  if (!body) return null;\n\n  // SendGrid Inbound Parse sends form data with fields:\n  // from, to, cc, subject, text, html, headers, envelope\n  const fromRaw = body.from as string | undefined;\n  const from = fromRaw ? parseEmailAddress(fromRaw) : null;\n  if (!from) return null;\n\n  const toRaw = body.to as string | undefined;\n  const to = toRaw ? toRaw.split(\",\").map((a: string) => a.trim()) : [];\n  const ccRaw = body.cc as string | undefined;\n  const cc = ccRaw ? ccRaw.split(\",\").map((a: string) => a.trim()) : [];\n\n  // Parse raw headers string\n  const headersStr = body.headers as string | undefined;\n  const headers = parseHeadersString(headersStr);\n  const messageId = headers[\"message-id\"] || `sendgrid-${Date.now()}`;\n\n  // SendGrid Inbound Parse posts explicit `dkim` (e.g. `{@example.com : pass}`)\n  // and `SPF` (e.g. `pass`) form fields, and also carries\n  // `Authentication-Results` inside the raw headers blob. Use all available\n  // signals; absent results fail closed (unverified).\n  const senderVerified = computeSenderVerified({\n    fromEmail: from.email,\n    authResults: headers[\"authentication-results\"],\n    dkim: typeof body.dkim === \"string\" ? body.dkim : undefined,\n    spf: typeof body.SPF === \"string\" ? body.SPF : undefined,\n  });\n\n  return {\n    messageId,\n    subject: (body.subject as string) || \"(no subject)\",\n    from,\n    to,\n    cc: cc.length > 0 ? cc : undefined,\n    text: body.text as string | undefined,\n    html: body.html as string | undefined,\n    inReplyTo: headers[\"in-reply-to\"] || undefined,\n    references: parseReferencesHeader(headers[\"references\"]),\n    date: headers[\"date\"] || undefined,\n    senderVerified,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — sender authentication (DKIM / SPF)\n// ---------------------------------------------------------------------------\n\n/**\n * Extract the registrable-ish domain from an email address (lowercased).\n * We keep the full host rather than collapsing to an eTLD+1 — exact-domain\n * alignment is the conservative choice here, and avoids bundling a public\n * suffix list. Subdomain senders that legitimately DKIM-sign with the parent\n * domain are handled by the suffix check in `domainsAlign`.\n */\nfunction emailDomain(email: string): string {\n  const at = email.lastIndexOf(\"@\");\n  return at >= 0\n    ? email\n        .slice(at + 1)\n        .trim()\n        .toLowerCase()\n    : \"\";\n}\n\n/**\n * True when `signingDomain` is the From domain or a parent of it (e.g.\n * From `user@mail.example.com` aligned with a `d=example.com` signature).\n * Both directions of subdomain nesting are accepted because senders sign\n * with either the exact From host or the organizational parent.\n */\nfunction domainsAlign(fromDomain: string, signingDomain: string): boolean {\n  if (!fromDomain || !signingDomain) return false;\n  if (fromDomain === signingDomain) return true;\n  return (\n    fromDomain.endsWith(`.${signingDomain}`) ||\n    signingDomain.endsWith(`.${fromDomain}`)\n  );\n}\n\n/**\n * Compute whether an inbound email is authenticated as genuinely coming from\n * its `From:` domain. Returns true only when DKIM passes for an aligned\n * domain, or SPF passes for an aligned domain. Anything else — missing\n * results, `fail`, `softfail`, `none`, `neutral`, `temperror`, `permerror`\n * — returns false (fail closed).\n *\n * Inputs may come from provider-specific fields (`dkim`, `spf`) and/or the\n * RFC 8601 `Authentication-Results` header, in any combination. We treat the\n * union: if ANY source shows an aligned pass, the sender is verified.\n */\nfunction computeSenderVerified(input: {\n  fromEmail: string;\n  authResults?: string;\n  dkim?: string;\n  spf?: string;\n}): boolean {\n  const fromDomain = emailDomain(input.fromEmail);\n  if (!fromDomain) return false;\n\n  // 1. Provider DKIM field, e.g. SendGrid `{@example.com : pass}` or\n  //    `{@example.com : pass; @other.com : fail}`.\n  if (input.dkim) {\n    const dkimEntries = input.dkim.matchAll(\n      /@([a-z0-9.-]+)\\s*:\\s*(pass|fail|none|neutral|softfail|temperror|permerror)/gi,\n    );\n    for (const m of dkimEntries) {\n      const domain = m[1].toLowerCase();\n      const verdict = m[2].toLowerCase();\n      if (verdict === \"pass\" && domainsAlign(fromDomain, domain)) return true;\n    }\n  }\n\n  // 2. Provider SPF field. SendGrid posts a bare verdict (e.g. `pass`); since\n  //    SPF authenticates the envelope/MailFrom rather than the header From,\n  //    a bare `pass` with no domain only counts when we can't tell it's\n  //    misaligned. We accept a bare `pass` as an aligned SPF pass — this is\n  //    the same trust level Gmail-style routing assigns to a plain SPF pass.\n  if (input.spf) {\n    const spfVerdict = input.spf.trim().toLowerCase();\n    if (spfVerdict === \"pass\") return true;\n  }\n\n  // 3. RFC 8601 `Authentication-Results` header (may list multiple methods).\n  if (input.authResults) {\n    const ar = input.authResults.toLowerCase();\n    // DKIM with an aligned domain.\n    const dkimRe = /dkim=pass[^;]*?(?:header\\.(?:d|i)=|@)([a-z0-9.-]+)/g;\n    for (const m of ar.matchAll(dkimRe)) {\n      const domain = m[1].replace(/^@/, \"\");\n      if (domainsAlign(fromDomain, domain)) return true;\n    }\n    // SPF pass (envelope auth) — accept as an aligned pass.\n    if (/spf=pass\\b/.test(ar)) return true;\n  }\n\n  return false;\n}\n\n// ---------------------------------------------------------------------------\n// Rate limiting\n// ---------------------------------------------------------------------------\n\n/**\n * Rate-limit heuristic backed by the `integration_pending_tasks` queue.\n *\n * Counts how many tasks this sender has produced in the last hour. The count\n * INCLUDES tasks already processed (status = completed/failed) because the\n * rows aren't deleted on completion — that's enough signal to throttle a\n * single noisy/abusive sender without needing a dedicated counter table.\n *\n * Two trade-offs worth knowing:\n *   - This is a coarse heuristic, not exact metering. Within one hour the\n *     count is correct; rows produced more than an hour ago naturally drop\n *     off. We don't try to be precise, only to raise the bar past the\n *     \"send 10K emails through one Lambda burst\" failure mode.\n *   - The query relies on the `idx_pending_tasks_status_created` index plus\n *     a sender substring match. A targeted attacker could amortise the cost\n *     by reusing one sender address — that's fine, the goal here is to bound\n *     the attack within a single attacker identity, not to detect spoofing.\n *\n * If the table doesn't yet exist on this deployment (no inbound webhook has\n * been processed before), we silently allow the message — the schema is\n * provisioned on first task insert. See H4 in the webhook security audit.\n */\nasync function isRateLimited(senderEmail: string): Promise<boolean> {\n  const cutoff = Date.now() - RATE_LIMIT_WINDOW_MS;\n  try {\n    const client = getDbExec();\n    const { rows } = await client.execute({\n      sql: `\n        SELECT COUNT(*) AS c\n          FROM integration_pending_tasks\n         WHERE platform = ?\n           AND created_at >= ?\n           AND payload LIKE ? ESCAPE '\\\\'\n      `,\n      args: [\"email\", cutoff, `%\"senderId\":\"${escapeLike(senderEmail)}\"%`],\n    });\n    const count = Number(\n      (rows[0] as Record<string, unknown> | undefined)?.c ?? 0,\n    );\n    return count >= RATE_LIMIT_MAX;\n  } catch {\n    // Table doesn't exist yet (first webhook on a fresh deployment) — allow.\n    return false;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — email address parsing\n// ---------------------------------------------------------------------------\n\n/** Parse \"Name <addr@example.com>\" or plain \"addr@example.com\" */\nfunction parseEmailAddress(raw: string): { name?: string; email: string } {\n  const match = raw.match(/^\\s*(.*?)\\s*<([^>]+)>\\s*$/);\n  if (match && match[2]) {\n    return {\n      name: match[1].replace(/^[\"']|[\"']$/g, \"\").trim() || undefined,\n      email: match[2].trim(),\n    };\n  }\n  return { email: raw.trim() };\n}\n\n/** Normalize a to/cc field that may be a string, array, or undefined into a string[] of addresses */\nfunction normalizeAddressList(raw: string | string[] | undefined): string[] {\n  if (!raw) return [];\n  if (Array.isArray(raw)) return raw.map((a) => a.trim());\n  return raw.split(\",\").map((a) => a.trim());\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — header parsing\n// ---------------------------------------------------------------------------\n\n/** Parse a headers object (Resend format: array of {name, value} or Record) */\nfunction parseHeadersObject(headers: unknown): Record<string, string> {\n  const result: Record<string, string> = {};\n  if (!headers) return result;\n\n  if (Array.isArray(headers)) {\n    for (const h of headers) {\n      if (h && typeof h === \"object\" && \"name\" in h && \"value\" in h) {\n        result[(h.name as string).toLowerCase()] = h.value as string;\n      }\n    }\n  } else if (typeof headers === \"object\") {\n    for (const [key, value] of Object.entries(\n      headers as Record<string, unknown>,\n    )) {\n      result[key.toLowerCase()] = String(value);\n    }\n  }\n  return result;\n}\n\n/** Parse a raw headers string (SendGrid format: \"Key: Value\\nKey: Value\\n...\") */\nfunction parseHeadersString(raw: string | undefined): Record<string, string> {\n  const result: Record<string, string> = {};\n  if (!raw) return result;\n\n  const lines = raw.split(/\\r?\\n/);\n  let currentKey = \"\";\n  let currentValue = \"\";\n\n  for (const line of lines) {\n    // Continuation line (starts with whitespace)\n    if (/^\\s/.test(line) && currentKey) {\n      currentValue += \" \" + line.trim();\n      continue;\n    }\n    // Save previous header\n    if (currentKey) {\n      result[currentKey.toLowerCase()] = currentValue;\n    }\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx > 0) {\n      currentKey = line.slice(0, colonIdx).trim();\n      currentValue = line.slice(colonIdx + 1).trim();\n    } else {\n      currentKey = \"\";\n      currentValue = \"\";\n    }\n  }\n  // Save last header\n  if (currentKey) {\n    result[currentKey.toLowerCase()] = currentValue;\n  }\n  return result;\n}\n\n/** Parse a References header value into an array of Message-IDs */\nfunction parseReferencesHeader(\n  references: string | undefined,\n): string[] | undefined {\n  if (!references) return undefined;\n  const ids = references.match(/<[^>]+>/g);\n  return ids && ids.length > 0 ? ids : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — threading\n// ---------------------------------------------------------------------------\n\n/**\n * Get the thread root ID using a Gmail-style approach:\n * the oldest Message-ID from the References chain is the thread root.\n * If no References, use the current Message-ID.\n */\nfunction getThreadRootId(messageId: string, references?: string[]): string {\n  if (references && references.length > 0) {\n    return references[0];\n  }\n  return messageId;\n}\n\n/**\n * Scope a raw thread root id by the sender's email address. Two different\n * senders crafting the same `References:` header value should NOT collide\n * onto the same internal thread mapping — that's the email-side fix for the\n * thread-injection finding (M1 in the webhook security audit).\n *\n * The returned id is opaque to callers and stays stable across messages\n * from the same sender on the same conversation thread, so reply behaviour\n * is unchanged.\n */\nfunction scopeThreadIdToSender(\n  rawThreadId: string,\n  senderEmail: string,\n): string {\n  return `${senderEmail.toLowerCase()}::${rawThreadId}`;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — reply building\n// ---------------------------------------------------------------------------\n\n/** Build a References header from the platform context */\nfunction buildReferencesHeader(ctx: Record<string, unknown>): string {\n  const parts: string[] = [];\n\n  // Include existing references\n  const refs = ctx.references as string[] | undefined;\n  if (refs) {\n    parts.push(...refs);\n  }\n\n  // Append the current message ID\n  const messageId = ctx.messageId as string | undefined;\n  if (messageId) {\n    // Avoid duplicates\n    if (!parts.includes(messageId)) {\n      parts.push(messageId);\n    }\n  }\n\n  return parts.join(\" \");\n}\n\n/**\n * Build CC list for reply-all when agent was CC'd.\n * Include original To addresses and other CC addresses, excluding the agent and the original sender.\n */\nfunction buildReplyAllCc(\n  context: IncomingMessage,\n  agentAddress: string,\n): string[] | undefined {\n  const normalizedAgentAddress = agentAddress.toLowerCase();\n  const senderEmail = context.senderId?.toLowerCase();\n  const toAddresses = (context.platformContext.to as string[]) || [];\n  const ccAddresses = (context.platformContext.cc as string[]) || [];\n\n  const allRecipients = new Set<string>();\n  for (const addr of [...toAddresses, ...ccAddresses]) {\n    const normalized = addr.toLowerCase().trim();\n    // Exclude agent address and original sender (sender goes in To)\n    if (normalized !== normalizedAgentAddress && normalized !== senderEmail) {\n      allRecipients.add(normalized);\n    }\n  }\n\n  return allRecipients.size > 0 ? Array.from(allRecipients) : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers — text conversion\n// ---------------------------------------------------------------------------\n\n/** Strip HTML tags for a plain-text version of the email */\nfunction stripHtmlForPlainText(html: string): string {\n  return html\n    .replace(/<br\\s*\\/?>/gi, \"\\n\")\n    .replace(/<\\/p>/gi, \"\\n\\n\")\n    .replace(/<\\/div>/gi, \"\\n\")\n    .replace(/<\\/li>/gi, \"\\n\")\n    .replace(/<li[^>]*>/gi, \"- \")\n    .replace(/<\\/h[1-6]>/gi, \"\\n\\n\")\n    .replace(/<[^>]+>/g, \"\")\n    .replace(/&nbsp;/g, \" \")\n    .replace(/&amp;/g, \"&\")\n    .replace(/&lt;/g, \"<\")\n    .replace(/&gt;/g, \">\")\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .replace(/\\n{3,}/g, \"\\n\\n\")\n    .trim();\n}\n\nfunction escapeHtml(s: string): string {\n  return s\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\nfunction decodeBasicHtmlEntities(s: string): string {\n  return s\n    .replace(/&amp;/g, \"&\")\n    .replace(/&lt;/g, \"<\")\n    .replace(/&gt;/g, \">\")\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\");\n}\n\nfunction splitTrailingUrlPunctuation(raw: string): {\n  url: string;\n  trailing: string;\n} {\n  let url = raw;\n  let trailing = \"\";\n  const trailingEntities = [\"&quot;\", \"&#39;\"];\n\n  for (;;) {\n    const entity = trailingEntities.find((candidate) =>\n      url.endsWith(candidate),\n    );\n    if (!entity) break;\n    url = url.slice(0, -entity.length);\n    trailing = entity + trailing;\n  }\n\n  while (/[.,!?;:]$/.test(url)) {\n    trailing = url.slice(-1) + trailing;\n    url = url.slice(0, -1);\n  }\n\n  while (url.endsWith(\")\") && !url.includes(\"(\")) {\n    trailing = \")\" + trailing;\n    url = url.slice(0, -1);\n  }\n\n  return { url, trailing };\n}\n\nfunction labelForUrl(rawUrl: string): string {\n  try {\n    const parsed = new URL(decodeBasicHtmlEntities(rawUrl));\n    const host = parsed.hostname.replace(/^www\\./, \"\");\n    return host ? `Open ${host}` : \"Open link\";\n  } catch {\n    return \"Open link\";\n  }\n}\n\nfunction linkifyTextSegment(segment: string): string {\n  return segment.replace(/\\bhttps?:\\/\\/[^\\s<>\"']+/gi, (raw) => {\n    const { url, trailing } = splitTrailingUrlPunctuation(raw);\n    const href = decodeBasicHtmlEntities(url);\n    return `<a href=\"${escapeHtml(href)}\" style=\"color:#2563eb;text-decoration:underline;\">${escapeHtml(\n      labelForUrl(url),\n    )}</a>${trailing}`;\n  });\n}\n\nfunction linkifyBareUrlsInHtml(html: string): string {\n  const parts = html.split(/(<\\/?[^>]+>)/g);\n  let skipDepth = 0;\n\n  return parts\n    .map((part) => {\n      if (part.startsWith(\"<\") && part.endsWith(\">\")) {\n        if (/^<\\/\\s*(a|code)\\b/i.test(part)) {\n          skipDepth = Math.max(0, skipDepth - 1);\n        } else if (/^<\\s*(a|code)\\b/i.test(part)) {\n          skipDepth += 1;\n        }\n        return part;\n      }\n      return skipDepth > 0 ? part : linkifyTextSegment(part);\n    })\n    .join(\"\");\n}\n\n/** Convert basic markdown to HTML for email rendering */\nfunction markdownToHtml(md: string): string {\n  let html = md;\n\n  // Escape HTML entities in the source (but not our generated tags)\n  html = escapeHtml(html);\n\n  // Bold: **text** or __text__\n  html = html.replace(/\\*\\*(.+?)\\*\\*/g, \"<strong>$1</strong>\");\n  html = html.replace(/__(.+?)__/g, \"<strong>$1</strong>\");\n\n  // Italic: *text* or _text_ (but not inside words with underscores)\n  html = html.replace(/(?<!\\w)\\*([^*]+?)\\*(?!\\w)/g, \"<em>$1</em>\");\n  html = html.replace(/(?<!\\w)_([^_]+?)_(?!\\w)/g, \"<em>$1</em>\");\n\n  // Links: [text](url)\n  html = html.replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, (_match, label, url) => {\n    const visibleLabel = /^https?:\\/\\//i.test(decodeBasicHtmlEntities(label))\n      ? escapeHtml(labelForUrl(label))\n      : label;\n    return `<a href=\"${escapeHtml(\n      decodeBasicHtmlEntities(url),\n    )}\" style=\"color:#2563eb;text-decoration:underline;\">${visibleLabel}</a>`;\n  });\n\n  // Inline code: `code`\n  html = html.replace(\n    /`([^`]+)`/g,\n    '<code style=\"background:#f1f5f9;padding:1px 4px;border-radius:3px;font-size:0.9em;\">$1</code>',\n  );\n\n  // Bare URLs: keep the destination in href but avoid spelling long URLs out.\n  html = linkifyBareUrlsInHtml(html);\n\n  // Unordered lists: lines starting with \"- \" or \"* \"\n  html = html.replace(/^([*-]) (.+)$/gm, \"<li>$2</li>\");\n  // Wrap consecutive <li> in <ul>\n  html = html.replace(\n    /(<li>.*?<\\/li>\\n?)+/g,\n    '<ul style=\"margin:8px 0;padding-left:20px;\">$&</ul>',\n  );\n\n  // Ordered lists: lines starting with \"1. \", \"2. \" etc.\n  html = html.replace(/^\\d+\\. (.+)$/gm, \"<li>$1</li>\");\n  // Wrap consecutive <li> that aren't in <ul> in <ol>\n  html = html.replace(/(?<!<\\/ul>)(<li>.*?<\\/li>\\n?)+/g, (match) => {\n    if (match.includes(\"<ul\")) return match;\n    return `<ol style=\"margin:8px 0;padding-left:20px;\">${match}</ol>`;\n  });\n\n  // Headings: # through ###\n  html = html.replace(\n    /^### (.+)$/gm,\n    '<h3 style=\"margin:16px 0 8px;font-size:1.1em;\">$1</h3>',\n  );\n  html = html.replace(\n    /^## (.+)$/gm,\n    '<h2 style=\"margin:16px 0 8px;font-size:1.25em;\">$1</h2>',\n  );\n  html = html.replace(\n    /^# (.+)$/gm,\n    '<h1 style=\"margin:16px 0 8px;font-size:1.4em;\">$1</h1>',\n  );\n\n  // Horizontal rules: --- or ***\n  html = html.replace(\n    /^(-{3,}|\\*{3,})$/gm,\n    '<hr style=\"border:none;border-top:1px solid #e2e8f0;margin:16px 0;\">',\n  );\n\n  // Paragraphs: double newlines\n  html = html.replace(/\\n\\n/g, \"</p><p>\");\n  // Single newlines → <br>\n  html = html.replace(/\\n/g, \"<br>\");\n\n  // Wrap in paragraph tags\n  html = `<p>${html}</p>`;\n  // Clean up empty paragraphs\n  html = html.replace(/<p>\\s*<\\/p>/g, \"\");\n\n  return html;\n}\n\n/** Wrap body HTML in a minimal email template with inline styles */\nfunction wrapInEmailTemplate(bodyHtml: string): string {\n  return `<!DOCTYPE html>\n<html>\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\n</head>\n<body style=\"margin:0;padding:0;background-color:#ffffff;\">\n<div style=\"max-width:600px;margin:0 auto;padding:20px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.6;color:#1a1a1a;\">\n${bodyHtml}\n</div>\n</body>\n</html>`;\n}\n\n// ---------------------------------------------------------------------------\n// Raw body reader (matches Slack adapter pattern)\n// ---------------------------------------------------------------------------\n\n/**\n * Read the raw request body as a string and cache on the event context.\n * Reads raw bytes from the request stream — never re-stringifies a parsed\n * body, since the Resend / Svix HMAC is computed over the exact bytes sent\n * (M2 in the webhook security audit).\n */\nasync function readRawBody(event: H3Event): Promise<string> {\n  const cached = event.context.__rawBody;\n  if (typeof cached === \"string\") return cached;\n  const raw = (await h3ReadRawBody(event)) ?? \"\";\n  event.context.__rawBody = raw;\n  return raw;\n}\n"]}