@agent-native/core 0.84.20 → 0.84.22

package/dist/mcp/builtin-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"builtin-tools.js","sourceRoot":"","sources":["../../src/mcp/builtin-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AAQ/D;;;;GAIG;AACH,SAAS,IAAI,CACX,WAAmB,EACnB,UAAmB,EACnB,QAAmB;IAEnB,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxC,OAAO;QACL,WAAW;QACX,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,UAAU;YACtB,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAAiB;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAC7D,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AA0BH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,MAA6D;IAE7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,GAAG,KAAK,oBAAoB,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA+B;IACzD,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,IAAI,wBAAwB,EAAE,CAAC;IACrE,OAAO,sBAAsB,CAAC,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,8BAA8B,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,IAAU;IAChC,OAAO,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU;IAC1B,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;QACxB,EAAE,MAAM,CACN,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CACvE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,IAAI,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkB,EAAE,IAAU;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ,IAAI,eAAe;SACtC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACjD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,KAAK,EAAE,QAAQ,IAAI,gBAAgB,MAAM,GAAG;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SAC/C;QACD,OAAO,EACL,oBAAoB,MAAM,6BAA6B;YACvD,WAAW,IAAI,CAAC,EAAE,mCAAmC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAAc;IAIpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,OAAO;QACL,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YACzC,gBAAgB,EAAE,8BAA8B;SACjD,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAA4C,EAC5C,WAAiB,EACjB,SAAiB;IAEjB,IAAI,SAAS,IAAI,CAAC,IAAI,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,WAAW,CAAC;IAE1B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CACnE,CAAC;QACF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,iDAAiD;YACjD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC3C,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAkB,EAClB,OAAe,EACf,SAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACzC,EACD;QACE,KAAK,EAAE,IAAI;QACX,QAAQ;KACT,CACF,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAkB,EAClB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAiB,EACjB,WAAmB;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,SAAS,YAAY,CACnB,MAAiB,EACjB,WAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,IAAI,CACR,qEAAqE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,qDAAqD,CACxD;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACpE,MAAM,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAEpC,kEAAkE;YAClE,iEAAiE;YACjE,sEAAsE;YACtE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,qEAAqE;YACrE,iBAAiB;YACjB,MAAM,UAAU,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC9B,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC;YAUjE,MAAM,IAAI,GAAe,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACV,CAAC,CAAC;oBACE,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,GAAG,EAAE,UAAU;oBACf,IAAI,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAuB;oBAChD,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAoB;iBAC7B;gBACH,CAAC,CAAC;oBACE,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,IAAI,EAAE,CAAC,CAAC,IAA0B;oBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,MAAM,EAAE,WAAoB;iBAC7B,CACN,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAExE,qEAAqE;YACrE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;gBACjC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;YAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7C,gEAAgE;gBAChE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnB,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC;oBACR,EAAE,EAAE,EAAE,CAAC,EAAE;oBACT,GAAG,EAAE,EAAE,CAAC,GAAG;oBACX,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,EAAE,CAAC,WAAW;gBACzB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,IAAI;aACL,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAS,WAAW,CAClB,MAAiB,EACjB,WAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,IAAI,CACR,mEAAmE;YACjE,mCAAmC;YACnC,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,kBAAkB,EACpB;YACE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;YAC3D,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sHAAsH;aACzH;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,oLAAoL;aACvL;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iEAAiE;aACpE;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,8FAA8F;aACjG;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;gBACzB,WAAW,EACT,sEAAsE;aACzE;SACF,EACD,CAAC,KAAK,CAAC,CACR;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,yDAAyD;YACzD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAA6D,CAAC;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAgD,CAAC;YAC5D,CAAC;iBAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,SAAS,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,CAAC;YACpC,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,CAAC;YACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;YACzD,IACE,IAAI,CAAC,KAAK,IAAI,IAAI;gBAClB,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,MAAM,CAAC,EACpD,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;iBAAM,IACL,IAAI,CAAC,KAAK,IAAI,IAAI;gBAClB,CAAC,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,OAAO,CAAC,EACtD,CAAC;gBACD,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YACD,IACE,aAAa,KAAK,IAAI;gBACtB,aAAa,KAAK,KAAK;gBACvB,aAAa,KAAK,MAAM;gBACxB,aAAa,KAAK,OAAO,EACzB,CAAC;gBACD,OAAO,MAAM,EAAE,KAAK,CAAC;YACvB,CAAC;YAED,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAC7B,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS;oBACnD,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxD,OAAO,MAAM,EAAE,MAAM,CAAC;YACxB,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,GAAG,SAAS,CAAC;YAEnE,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI;gBACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC;gBAClC,CAAC,CAAC,cAAc;oBACd,CAAC,CAAC,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC;oBAC5C,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,MAAM,UAAU,GACd,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEnE,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,SAAS;gBACtB,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,EAAE;gBACpD,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC;YACnB,IAAI,aAAiC,CAAC;YACtC,IAAI,eAAmC,CAAC;YACxC,IAAI,cAAkC,CAAC;YAEvC,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxB,MAAM,EAAE,iBAAiB,EAAE,GACzB,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,GAC1D,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;oBAC7C,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBAC3C,MAAM,UAAU,GAAG,wBAAwB,CACzC,sBAAsB,CAAC,GAAG,CAAC,EAC3B,WAAW,EAAE,MAAM,CACpB,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBACf,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;4BAC5C,UAAU;4BACV,KAAK,EAAE,GAAG,EAAE,KAAK;4BACjB,UAAU;4BACV,KAAK,EAAE,MAAM,IAAI,IAAI;yBACtB,CAAC,CAAC;wBACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBACrD,aAAa,GAAG,WAAW,EAAE,MAAM;4BACjC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;4BACnD,CAAC,CAAC,SAAS,CAAC;wBACd,eAAe,GAAG,UAAU,CAAC;wBAC7B,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,GAAG;gBACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG;gBACH,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,KAAK;aACN,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,CAAC,GAAG,MAKT,CAAC;YACF,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,CAAC,CAAC,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK,EAAE,QAAQ,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE;gBAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC;QACJ,CAAC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,QAAQ,CAAC;gBACjB,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,wCAAwC;gBACrD,WAAW,EAAE,kBAAkB;gBAC/B,SAAS,EAAE,UAAU;aACtB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,sBAAsB,CAAC,WAE/B;IACC,OAAO;QACL,IAAI,EAAE;YACJ,GAAG,IAAI,CACL,qJAAqJ,EACrJ;gBACE,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,yDAAyD;iBAC5D;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yCAAyC;iBACvD;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;oBACzB,WAAW,EAAE,4CAA4C;iBAC1D;aACF,CACF;YACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;SACzB;QACf,0EAA0E;QAC1E,uEAAuE;QACvE,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,EAAE,iBAAiB,EAAE,GACzB,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,GAC1D,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAC7C,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC7C,CAAC,CAAC,IAAI,CAAC,GAAG;gBACV,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,wBAAwB,CACzC,SAAS,EACT,WAAW,EAAE,MAAM,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;gBAC5C,UAAU;gBACV,KAAK,EAAE,GAAG,EAAE,KAAK;gBACjB,UAAU;gBACV,KAAK,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aAC5D,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,WAAW,EAAE,MAAM;gBAClC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,QAAQ;gBACR,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,EAAU,EACV,OAAe,EACf,OAAmD;IAInD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,mBAAmB,CACxB,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EACrE,OAAO,EACP,OAAO,CAAC,SAAS,IAAI,8BAA8B,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,yDAAyD;QACzD,SAAS,EAAE,CAAC,GAAG,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAiB,EACjB,YAAoB,EACpB,WAA+B;IAE/B,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,MAAM,EAAE,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC;YAChD,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,EAAE;YAChB,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,UAAU,CACjB,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,mEAAmE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,+DAA+D;YAC/D,oEAAoE;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,uEAAuE,EACzE;YACE,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,uDAAuD;aACrE;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,wCAAwC;aACtD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,uEAAuE;aAC1E;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,2FAA2F;aAC9F;SACF,EACD,CAAC,SAAS,CAAC,CACZ;QACD,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC9C,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAExC,qEAAqE;YACrE,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACrE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,OAAO,MAAM,eAAe,CAC1B,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,EAAE,EACZ,OAAO,EACP;wBACE,OAAO,EAAE,aAAa;wBACtB,SAAS;qBACV,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,oEAAoE;oBACpE,kDAAkD;oBAClD,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,CAAC,EAAE,aAAa;wBACtD,GAAG,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAClD,GAAG,EAAE,CAAC,EAAc,CACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAC3C,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,OAAO,MAAM,eAAe,CAC1B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,EAAE,EACX,OAAO,EACP;4BACE,OAAO,EAAE,aAAa;4BACtB,SAAS;yBACV,CACF,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,EAAE,YAAY;4BACpD,oBAAoB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC5C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,iDAAiD;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,UAAU,GACd,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;YAC1D,MAAM,IAAI,GAAG,UAAU;gBACrB,CAAC,CAAC,kBAAkB,YAAY,iCAAiC;oBAC/D,iCAAiC,MAAM,aAAa;gBACtD,CAAC,CAAC,SAAS,CAAC;YAEd,wEAAwE;YACxE,sEAAsE;YACtE,0EAA0E;YAC1E,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC5D,IAAI,mBAAmB,EAAE,CAAC;gBACxB,OAAO,mBAAmB,CACxB;oBACE,GAAG,EAAE,MAAM;oBACX,MAAM,EAAE,mBAAmB;oBAC3B,SAAS,EAAE,OAAO;oBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1B,EACD,OAAO,EACP,SAAS,CACV,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO;gBACL,GAAG,EAAE,MAAM;gBACX,SAAS,EAAE,OAAO;gBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,QAAQ;aACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,8EAA8E,EAC9E;YACE,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gEAAgE;aACnE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,0CAA0C;aACxD;SACF,EACD,CAAC,QAAQ,CAAC,CACX;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAC1C,MAAM,EACN,YAAY,EACZ,WAAW,CACZ,CAAC;YACF,OAAO,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,OAAO;QACL,IAAI,EAAE,IAAI,CACR,yEAAyE;YACvE,gCAAgC,CACnC;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACtE,OAAO;gBACL,SAAS,EAAE,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxC,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,sBAAsB;IAC7B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,qEAAqE;YACnE,sEAAsE;YACtE,6CAA6C,EAC/C;YACE,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,mDAAmD;aACjE;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,uEAAuE;aAC1E;SACF,EACD,CAAC,MAAM,EAAE,UAAU,CAAC,CACrB;QACD,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,mCAAmC,CAAC,GAAG,OAAO,CAAC;qBACjE,IAAI,EAAE;qBACN,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAC3C,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACb,+DAA+D;oBAC7D,oDAAoD,CACvD,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE7C,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,iEAAiE;gBACjE,oEAAoE;gBACpE,qEAAqE;gBACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACpB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;oBAC/D,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC;wBACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzB,CAAC;oBAAC,MAAM,CAAC;wBACP,0BAA0B;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,mEAAmE;YACnE,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;YAC3B,mEAAmE;YACnE,iEAAiE;YACjE,qEAAqE;YACrE,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG;gBAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE;gBACpD,CAAC,CAAC,WAAW,CAAC;YAEhB,OAAO;gBACL,IAAI;gBACJ,QAAQ;gBACR,OAAO,EAAE,CAAC,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,IAAI;gBACJ,GAAG,EAAE,OAAO,EAAE,GAAG;gBACjB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,CAAC,GAAG,MAA8C,CAAC;YACzD,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,QAAQ;gBACf,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,KAAK,EAAE;gBAChC,IAAI,EAAE,MAAM;aACb,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC;QAC5C,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC;QAC1C,oBAAoB,EAAE,sBAAsB,CAAC,WAAW,CAAC;QACzD,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC;QACxC,cAAc,EAAE,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;QACrD,oBAAoB,EAAE,sBAAsB,EAAE;QAC9C,cAAc,EAAE,iBAAiB,EAAE;KACpC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Generic cross-app MCP tools — a stable verb set every external agent gets\n * regardless of which template it is talking to.\n *\n * These are merged into the MCP action registry by\n * `createMCPServerForRequest` (see `build-server.ts`). **Precedence: template\n * actions win.** If a template defines an action named `list_apps` /\n * `open_app` / `ask_app` / `create_workspace_app` / `list_templates`, the\n * template's `ActionEntry` overwrites the builtin of the same name. This is\n * the same template-over-framework precedence `autoDiscoverActions` uses.\n *\n * | Tool                  | Side effects | Returns                                  |\n * | --------------------- | ------------ | ---------------------------------------- |\n * | `list_apps`           | none         | `{ apps: [{ id, url, running }] }`       |\n * | `open_app`            | none         | `{ url }` (+ deep-link `link`)           |\n * | `create_embed_session`| ticket mint  | `{ startUrl }` for MCP App iframes       |\n * | `ask_app`             | agent loop   | `{ app, routedVia, response }` or task   |\n * | `ask_app_status`      | none         | poll a durable `ask_app` task            |\n * | `create_workspace_app`| scaffolds    | `{ name, url, port, deepLink }` (+ link) |\n *\n * `open_app` / `create_workspace_app` return an **absolute** URL on the\n * *target* app's origin when it differs from this app (so a workspace link\n * lands in the right app), and a relative path for the same app / standalone.\n * `ask_app` routes to a *different* workspace app over A2A when possible and\n * reports `routedVia: \"a2a\"`; otherwise it answers locally\n * (`routedVia: \"local\"`) and never falsely claims cross-app delegation.\n * | `list_templates`      | none         | `{ templates: [...] }` (allow-list only) |\n *\n * Node-only at call time (workspace resolution + scaffolding use `fs`), but\n * the module has no top-level Node imports so it bundles fine alongside\n * `mountMCP` — the Node bits are dynamically imported inside `run()`.\n */\n\nimport type { Task } from \"../a2a/types.js\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport { getConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { buildDeepLink } from \"../server/deep-link.js\";\nimport { MCP_APP_CHAT_BRIDGE_QUERY_PARAM } from \"../shared/embed-auth.js\";\nimport type { MCPConfig } from \"./build-server.js\";\nimport { embedApp } from \"./embed-app.js\";\nimport { fetchOrgApps, type OrgApp } from \"./org-directory.js\";\n\n/** Flat map of param name → JSON-schema property. */\ntype Params = Record<\n  string,\n  { type: string; description?: string; enum?: string[] }\n>;\n\n/**\n * Build an `ActionTool`. `parameters` is wrapped in the\n * `{ type:\"object\", properties, required }` shape `createMCPServerForRequest`\n * forwards verbatim as the MCP tool `inputSchema`.\n */\nfunction tool(\n  description: string,\n  parameters?: Params,\n  required?: string[],\n): ActionTool {\n  if (!parameters) return { description };\n  return {\n    description,\n    parameters: {\n      type: \"object\",\n      properties: parameters,\n      ...(required && required.length ? { required } : {}),\n    },\n  };\n}\n\n/**\n * The canonical app id this MCP server is mounted for. `MCPConfig.appId` is\n * authoritative; fall back to lowercasing `name` (which is the capitalized\n * app id at every call site) for back-compat with configs that predate the\n * `appId` field.\n */\nfunction currentAppId(config: MCPConfig): string {\n  return (config.appId || config.name || \"app\").toLowerCase();\n}\n\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\nconst ASK_APP_DEFAULT_INLINE_WAIT_MS = 20_000;\nconst ASK_APP_MAX_INLINE_WAIT_MS = 25_000;\nconst ASK_APP_POLL_INTERVAL_MS = 1_500;\nconst ASK_APP_A2A_REQUEST_TIMEOUT_MS = 10_000;\nconst ASK_APP_TERMINAL_STATES = new Set<string>([\n  \"completed\",\n  \"failed\",\n  \"canceled\",\n]);\n\ntype AskAppRequestMeta = { origin?: string; basePath?: string };\n\ninterface AskAppRoute {\n  app: string;\n  origin: string;\n  routedVia: \"local\" | \"a2a\";\n  note?: string;\n}\n\ninterface AskAppTaskResult {\n  app: string;\n  routedVia: \"local\" | \"a2a\";\n  taskId: string;\n  status: string;\n  response?: string;\n  error?: string;\n  note?: string;\n  poll?: {\n    tool: \"ask_app_status\";\n    arguments: { app: string; taskId: string };\n  };\n  message?: string;\n}\n\nfunction safeAppPath(raw: unknown): string | null {\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\n  const value = raw.trim();\n  if (CONTROL_CHARS.test(value)) return null;\n  if (!value.startsWith(\"/\")) return null;\n  if (value.startsWith(\"//\") || value.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(value)) return null;\n  return value;\n}\n\nfunction appendParamsToPath(\n  path: string,\n  params: Record<string, string | number | boolean> | undefined,\n): string {\n  if (!params || Object.keys(params).length === 0) return path;\n  const url = new URL(path, \"http://agent-native.invalid\");\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, String(value));\n  }\n  return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction viewToAppPath(view: string): string | null {\n  const value = view.trim();\n  if (!value) return null;\n  return safeAppPath(value.startsWith(\"/\") ? value : `/${value}`);\n}\n\nfunction withConfiguredBasePath(path: string): string {\n  const base = getConfiguredAppBasePath();\n  if (!base || path === base || path.startsWith(`${base}/`)) return path;\n  return `${base}${path}`;\n}\n\nfunction withMcpChatBridgeParam(path: string): string {\n  try {\n    const url = new URL(path, \"http://agent-native.invalid\");\n    url.searchParams.set(MCP_APP_CHAT_BRIDGE_QUERY_PARAM, \"1\");\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return path;\n  }\n}\n\nfunction agentNativeA2AEndpoint(urlOrOrigin: string): string {\n  const value = urlOrOrigin.replace(/\\/+$/, \"\");\n  try {\n    const parsed = new URL(value);\n    const pathname = parsed.pathname.replace(/\\/+$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\") || pathname.endsWith(\"/a2a\")) {\n      return value;\n    }\n  } catch {\n    // Fall through and append the conventional Agent Native endpoint.\n  }\n  return `${value}/_agent-native/a2a`;\n}\n\nfunction selfA2AEndpointUrl(requestMeta?: AskAppRequestMeta): string | null {\n  const origin = requestMeta?.origin?.replace(/\\/+$/, \"\");\n  if (!origin) return null;\n  const basePath = requestMeta?.basePath || getConfiguredAppBasePath();\n  return agentNativeA2AEndpoint(`${origin}${basePath}`);\n}\n\nfunction boundedAskAppWaitMs(raw: unknown): number {\n  if (raw == null || raw === \"\") return ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed)) return ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  return Math.max(0, Math.min(ASK_APP_MAX_INLINE_WAIT_MS, Math.trunc(parsed)));\n}\n\nfunction isExplicitAsyncAsk(raw: unknown): boolean {\n  return raw === true || raw === \"true\" || raw === 1 || raw === \"1\";\n}\n\nfunction taskState(task: Task): string {\n  return String(task.status?.state ?? \"unknown\");\n}\n\nfunction isTerminalTask(task: Task): boolean {\n  return ASK_APP_TERMINAL_STATES.has(taskState(task));\n}\n\nfunction taskText(task: Task): string {\n  return (\n    task.status.message?.parts\n      ?.filter(\n        (part): part is { type: \"text\"; text: string } => part.type === \"text\",\n      )\n      .map((part) => part.text)\n      .join(\"\\n\")\n      .trim() ?? \"\"\n  );\n}\n\nfunction askAppTaskResult(route: AskAppRoute, task: Task): AskAppTaskResult {\n  const status = taskState(task);\n  const response = taskText(task);\n  const base = {\n    app: route.app,\n    routedVia: route.routedVia,\n    taskId: task.id,\n    status,\n    ...(route.note ? { note: route.note } : {}),\n  };\n\n  if (status === \"completed\") {\n    return {\n      ...base,\n      response: response || \"(no response)\",\n    };\n  }\n\n  if (status === \"failed\" || status === \"canceled\") {\n    return {\n      ...base,\n      ...(response ? { response } : {}),\n      error: response || `ask_app task ${status}.`,\n    };\n  }\n\n  return {\n    ...base,\n    poll: {\n      tool: \"ask_app_status\",\n      arguments: { app: route.app, taskId: task.id },\n    },\n    message:\n      `ask_app is still ${status}. Call ask_app_status with ` +\n      `taskId \"${task.id}\" to retrieve the final response.`,\n  };\n}\n\nasync function createA2AClientForAskApp(origin: string): Promise<{\n  client: import(\"../a2a/client.js\").A2AClient;\n  metadata: Record<string, unknown>;\n}> {\n  const { A2AClient } = await import(\"../a2a/client.js\");\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  const auth = await resolveA2ACallerAuth();\n  const metadata: Record<string, unknown> = {};\n  if (auth.userEmail) metadata.userEmail = auth.userEmail;\n  if (auth.orgDomain) metadata.orgDomain = auth.orgDomain;\n  return {\n    client: new A2AClient(origin, auth.apiKey, {\n      requestTimeoutMs: ASK_APP_A2A_REQUEST_TIMEOUT_MS,\n    }),\n    metadata,\n  };\n}\n\nasync function waitForA2ATask(\n  client: import(\"../a2a/client.js\").A2AClient,\n  initialTask: Task,\n  maxWaitMs: number,\n): Promise<Task> {\n  if (maxWaitMs <= 0 || isTerminalTask(initialTask)) return initialTask;\n  const deadline = Date.now() + maxWaitMs;\n  let current = initialTask;\n\n  while (!isTerminalTask(current)) {\n    const remaining = deadline - Date.now();\n    if (remaining <= 0) return current;\n    await new Promise((resolve) =>\n      setTimeout(resolve, Math.min(ASK_APP_POLL_INTERVAL_MS, remaining)),\n    );\n    try {\n      current = await client.getTask(initialTask.id);\n    } catch {\n      // Transient status fetch failures should not turn a successfully\n      // submitted durable task into a failed MCP call.\n      if (Date.now() >= deadline) return current;\n      continue;\n    }\n  }\n\n  return current;\n}\n\nasync function submitAskAppA2ATask(\n  route: AskAppRoute,\n  message: string,\n  maxWaitMs: number,\n): Promise<AskAppTaskResult> {\n  const { client, metadata } = await createA2AClientForAskApp(route.origin);\n  const task = await client.send(\n    {\n      role: \"user\",\n      parts: [{ type: \"text\", text: message }],\n    },\n    {\n      async: true,\n      metadata,\n    },\n  );\n  const finalOrRunning = await waitForA2ATask(client, task, maxWaitMs);\n  return askAppTaskResult(route, finalOrRunning);\n}\n\nasync function fetchAskAppA2ATask(\n  route: AskAppRoute,\n  taskId: string,\n): Promise<AskAppTaskResult> {\n  const { client } = await createA2AClientForAskApp(route.origin);\n  const task = await client.getTask(taskId);\n  return askAppTaskResult(route, task);\n}\n\n/**\n * Resolve the absolute origin of a *target* workspace app (e.g.\n * `http://127.0.0.1:8101`) so cross-app deep links / A2A calls point at the\n * right app instead of the current request's origin. Reuses the same\n * workspace resolution `list_apps` / the stdio proxy use.\n *\n * Returns `null` when:\n *   - the target is the current app (caller should keep relative behavior),\n *   - there is no workspace info (standalone / single app), or\n *   - the target app is unknown.\n */\nasync function resolveTargetAppOrigin(\n  config: MCPConfig,\n  targetAppId: string,\n): Promise<{ origin: string; id: string } | null> {\n  const target = targetAppId.trim().toLowerCase();\n  if (!target || target === currentAppId(config)) return null;\n  try {\n    const { resolveWorkspace } = await import(\"./workspace-resolve.js\");\n    const ws = await resolveWorkspace();\n    if (!ws.isWorkspace) return null;\n    const match = ws.apps.find((a) => a.id.toLowerCase() === target);\n    if (!match) return null;\n    return { origin: match.url, id: match.id };\n  } catch {\n    return null;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// list_apps\n// ---------------------------------------------------------------------------\n\nfunction listAppsTool(\n  config: MCPConfig,\n  requestMeta?: { origin?: string },\n): ActionEntry {\n  return {\n    tool: tool(\n      \"List the workspace apps and their URLs. Use this to discover which \" +\n        \"apps exist before opening or asking one. In a single-app project \" +\n        \"this returns just that app. When an org directory is configured \" +\n        \"this also includes the org's deployed sibling apps.\",\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async () => {\n      const { resolveWorkspace } = await import(\"./workspace-resolve.js\");\n      const ws = await resolveWorkspace();\n\n      // The MCP request is served BY the current app, so it is provably\n      // reachable at the inbound request origin — that beats a guessed\n      // `PORT || 5173` probe (which reports the wrong URL + `running:false`\n      // whenever the dev server picked a non-default port, e.g. `agent-\n      // native dev` on :8080). For the entry that IS this app (the sole\n      // entry when single-app, or the id matching `config.appId` in a\n      // workspace) prefer the live origin; other workspace apps keep their\n      // probed values.\n      const liveOrigin = requestMeta?.origin?.replace(/\\/+$/, \"\") || \"\";\n      let livePort = 0;\n      if (liveOrigin) {\n        try {\n          const u = new URL(liveOrigin);\n          livePort = Number(u.port) || (u.protocol === \"https:\" ? 443 : 80);\n        } catch {\n          livePort = 0;\n        }\n      }\n      const selfId = (config.appId ?? \"\").toLowerCase();\n      const isSelf = (id: string) =>\n        !!liveOrigin &&\n        (!ws.isWorkspace || (!!selfId && id.toLowerCase() === selfId));\n\n      interface AppEntry {\n        id: string;\n        url: string;\n        port: number | undefined;\n        running: boolean;\n        source: \"workspace\" | \"org-directory\";\n      }\n\n      const apps: AppEntry[] = ws.apps.map((a) =>\n        isSelf(a.id)\n          ? {\n              id: a.id,\n              url: liveOrigin,\n              port: (livePort || a.port) as number | undefined,\n              running: true,\n              source: \"workspace\" as const,\n            }\n          : {\n              id: a.id,\n              url: a.url,\n              port: a.port as number | undefined,\n              running: a.running,\n              source: \"workspace\" as const,\n            },\n      );\n      const seenIds = new Set(apps.map((a) => a.id.toLowerCase()));\n      const seenOrigins = new Set(apps.map((a) => a.url.replace(/\\/+$/, \"\")));\n\n      // Merge the org directory's deployed sibling apps. Inactive (no env)\n      // or any failure ⇒ fetchOrgApps() returns [] and this is a no-op, so\n      // the existing local/workspace behavior is preserved exactly.\n      const orgApps = await fetchOrgApps({\n        selfId: currentAppId(config),\n      }).catch(() => [] as OrgApp[]);\n      for (const oa of orgApps) {\n        const idKey = oa.id.toLowerCase();\n        const originKey = oa.url.replace(/\\/+$/, \"\");\n        // Dedupe by id OR origin — a workspace app already listed wins.\n        if (seenIds.has(idKey) || seenOrigins.has(originKey)) continue;\n        seenIds.add(idKey);\n        seenOrigins.add(originKey);\n        apps.push({\n          id: oa.id,\n          url: oa.url,\n          port: undefined,\n          running: true,\n          source: \"org-directory\",\n        });\n      }\n\n      return {\n        workspace: ws.isWorkspace,\n        gatewayUrl: ws.gatewayUrl,\n        apps,\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// open_app\n// ---------------------------------------------------------------------------\n\nfunction openAppTool(\n  config: MCPConfig,\n  requestMeta?: { origin?: string },\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Build a deep link that opens an app at a specific view/record or \" +\n        \"focused route/component. No side \" +\n        \"effects — returns a URL the user can click to land in the running UI. \" +\n        \"Set embed:true when a UI-capable MCP host should render the live app \" +\n        \"or focused route/component inline. Omit view and path to land on the \" +\n        \"app's home page.\",\n      {\n        app: { type: \"string\", description: \"App id, e.g. 'mail'\" },\n        view: {\n          type: \"string\",\n          description:\n            \"Target view, e.g. 'inbox' (maps to navigate command). Optional — omit (along with path) to open the app's home page.\",\n        },\n        path: {\n          type: \"string\",\n          description:\n            \"Optional app route to open directly, e.g. '/extensions/abc', '/adhoc/q2', or '/chart?panel=...'. Must be same-origin relative. Omit (along with view) to open the app's home page.\",\n        },\n        params: {\n          type: \"object\",\n          description:\n            \"Optional record-focus / filter params, e.g. { threadId: 'abc' }\",\n        },\n        embed: {\n          type: \"boolean\",\n          description:\n            \"Render the full app or focused route/component inline in MCP Apps when the host supports it.\",\n        },\n        chrome: {\n          type: \"string\",\n          enum: [\"full\", \"minimal\"],\n          description:\n            \"Embed chrome preference for compatible app routes. Defaults to full.\",\n        },\n      },\n      [\"app\"],\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const app = String(args.app ?? \"\").trim();\n      const view = String(args.view ?? \"\").trim();\n      // `safeAppPath` rejects anything that isn't a leading-slash same-origin\n      // path. When the caller passes nothing, fall back to the app's root so a\n      // bare `open_app({app:\"dispatch\"})` lands on the home page instead of\n      // throwing. The model self-corrects on the retry today, but the extra\n      // round-trip wastes a turn and looks broken to the user.\n      const path = safeAppPath(args.path) || (view ? null : \"/\");\n      if (!app) {\n        throw new Error(\"open_app requires 'app'.\");\n      }\n      let params: Record<string, string | number | boolean> | undefined;\n      const raw = args.params;\n      if (raw && typeof raw === \"object\") {\n        params = raw as Record<string, string | number | boolean>;\n      } else if (typeof raw === \"string\" && raw.trim()) {\n        try {\n          params = JSON.parse(raw);\n        } catch {\n          params = undefined;\n        }\n      }\n      const embeddedParam = params?.embed;\n      const chromeParam = params?.chrome;\n      let embed = args.embed === true || args.embed === \"true\";\n      if (\n        args.embed == null &&\n        (embeddedParam === true || embeddedParam === \"true\")\n      ) {\n        embed = true;\n      } else if (\n        args.embed == null &&\n        (embeddedParam === false || embeddedParam === \"false\")\n      ) {\n        embed = false;\n      }\n      if (\n        embeddedParam === true ||\n        embeddedParam === false ||\n        embeddedParam === \"true\" ||\n        embeddedParam === \"false\"\n      ) {\n        delete params?.embed;\n      }\n\n      const chrome =\n        typeof args.chrome === \"string\"\n          ? args.chrome\n          : chromeParam === \"full\" || chromeParam === \"minimal\"\n            ? chromeParam\n            : undefined;\n      if (chromeParam === \"full\" || chromeParam === \"minimal\") {\n        delete params?.chrome;\n      }\n      if (params && Object.keys(params).length === 0) params = undefined;\n\n      const directViewPath = embed && view ? viewToAppPath(view) : null;\n      const relUrl = path\n        ? appendParamsToPath(path, params)\n        : directViewPath\n          ? appendParamsToPath(directViewPath, params)\n          : buildDeepLink({ app, view, params });\n      const sameAppUrl =\n        path || directViewPath ? withConfiguredBasePath(relUrl) : relUrl;\n\n      // Cross-app target in a workspace: resolve the TARGET app's origin and\n      // return an absolute URL. Otherwise the MCP layer would prefix the\n      // relative path with the CURRENT request origin, landing the user in\n      // the wrong app (e.g. open_app({app:\"calendar\"}) served from Mail).\n      // Same-app / standalone keeps the relative path (current behavior).\n      const targetApp = await resolveTargetAppOrigin(config, app);\n      const appUrl = targetApp\n        ? `${targetApp.origin.replace(/\\/+$/, \"\")}${relUrl}`\n        : sameAppUrl;\n      const url = appUrl;\n      let embedStartUrl: string | undefined;\n      let embedTargetPath: string | undefined;\n      let embedExpiresAt: number | undefined;\n\n      if (embed && !targetApp) {\n        const { getRequestContext } =\n          await import(\"../server/request-context.js\");\n        const ctx = getRequestContext();\n        const ownerEmail = ctx?.userEmail?.trim();\n        if (ownerEmail) {\n          const { normalizeEmbedTargetPath, createEmbedSessionTicket } =\n            await import(\"../server/embed-session.js\");\n          const { buildEmbedStartPath } =\n            await import(\"../server/embed-route.js\");\n          const targetPath = normalizeEmbedTargetPath(\n            withMcpChatBridgeParam(url),\n            requestMeta?.origin,\n          );\n          if (targetPath) {\n            const ticket = await createEmbedSessionTicket({\n              ownerEmail,\n              orgId: ctx?.orgId,\n              targetPath,\n              scope: chrome ?? null,\n            });\n            const startPath = buildEmbedStartPath(ticket.ticket);\n            embedStartUrl = requestMeta?.origin\n              ? new URL(startPath, requestMeta.origin).toString()\n              : startPath;\n            embedTargetPath = targetPath;\n            embedExpiresAt = ticket.expiresAt;\n          }\n        }\n      }\n\n      return {\n        app,\n        ...(view ? { view } : {}),\n        ...(path ? { path } : {}),\n        url,\n        ...(embedStartUrl ? { embedStartUrl } : {}),\n        ...(embedTargetPath ? { embedTargetPath } : {}),\n        ...(embedExpiresAt ? { embedExpiresAt } : {}),\n        embed,\n      };\n    },\n    link: ({ result }) => {\n      if (!result || typeof result !== \"object\") return null;\n      const r = result as {\n        url?: string;\n        app?: string;\n        view?: string;\n        embed?: boolean;\n      };\n      if (r.embed) return null;\n      if (!r.url) return null;\n      return {\n        url: r.url,\n        label: `Open ${r.app ?? \"app\"}`,\n        view: r.view,\n      };\n    },\n    mcpApp: {\n      resource: embedApp({\n        title: \"Open app\",\n        description: \"Render the requested app route inline.\",\n        iframeTitle: \"Agent Native app\",\n        openLabel: \"Open app\",\n      }),\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// create_embed_session\n// ---------------------------------------------------------------------------\n\nfunction createEmbedSessionTool(requestMeta?: {\n  origin?: string;\n}): ActionEntry {\n  return {\n    tool: {\n      ...tool(\n        \"MCP Apps helper: create a one-time browser embed session for a same-origin app URL. Usually called by an MCP App iframe, not directly by the model.\",\n        {\n          url: {\n            type: \"string\",\n            description:\n              \"Same-origin absolute URL or app-relative path to embed.\",\n          },\n          path: {\n            type: \"string\",\n            description: \"Same-origin app-relative path to embed.\",\n          },\n          chrome: {\n            type: \"string\",\n            enum: [\"full\", \"minimal\"],\n            description: \"Embed chrome preference. Defaults to full.\",\n          },\n        },\n      ),\n      _meta: { ui: { visibility: [\"app\"] } },\n    } as ActionTool,\n    // App-only bootstrap helper: the ticket becomes a normal browser session,\n    // so keep it write-scoped until embed sessions can enforce MCP scopes.\n    readOnly: false,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const { getRequestContext } =\n        await import(\"../server/request-context.js\");\n      const ctx = getRequestContext();\n      const ownerEmail = ctx?.userEmail?.trim();\n      if (!ownerEmail) {\n        throw new Error(\n          \"create_embed_session requires an authenticated MCP caller.\",\n        );\n      }\n\n      const { normalizeEmbedTargetPath, createEmbedSessionTicket } =\n        await import(\"../server/embed-session.js\");\n      const { buildEmbedStartPath } = await import(\"../server/embed-route.js\");\n      const rawTarget =\n        typeof args.url === \"string\" && args.url.trim()\n          ? args.url\n          : typeof args.path === \"string\"\n            ? args.path\n            : \"\";\n      const targetPath = normalizeEmbedTargetPath(\n        rawTarget,\n        requestMeta?.origin,\n      );\n      if (!targetPath) {\n        throw new Error(\n          \"create_embed_session can only embed same-origin app-relative URLs.\",\n        );\n      }\n\n      const ticket = await createEmbedSessionTicket({\n        ownerEmail,\n        orgId: ctx?.orgId,\n        targetPath,\n        scope: typeof args.chrome === \"string\" ? args.chrome : null,\n      });\n      const startPath = buildEmbedStartPath(ticket.ticket);\n      const startUrl = requestMeta?.origin\n        ? new URL(startPath, requestMeta.origin).toString()\n        : startPath;\n      return {\n        startUrl,\n        targetPath,\n        expiresAt: ticket.expiresAt,\n      };\n    },\n  };\n}\n\n/**\n * Route an `ask_app` message to a *different* app's agent over A2A. Shared by\n * the workspace-resolved path and the org-directory-resolved path so the A2A\n * call logic is not duplicated. `origin` is the target app's A2A base\n * (workspace dev origin or the directory's `a2aUrl`); `id` is reported back.\n *\n * Throws on failure so the caller can be honest — it never falls back to this\n * app's agent and pretends it was the target.\n */\nasync function routeAskOverA2A(\n  origin: string,\n  id: string,\n  message: string,\n  options?: { durable?: boolean; maxWaitMs?: number },\n): Promise<\n  { app: string; routedVia: \"a2a\"; response: string } | AskAppTaskResult\n> {\n  if (options?.durable) {\n    return submitAskAppA2ATask(\n      { app: id, origin: agentNativeA2AEndpoint(origin), routedVia: \"a2a\" },\n      message,\n      options.maxWaitMs ?? ASK_APP_DEFAULT_INLINE_WAIT_MS,\n    );\n  }\n  const { callAgent } = await import(\"../a2a/client.js\");\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  // The MCP handler runs inside `runWithRequestContext`, so this is the\n  // verified caller identity and org scope. Reuse the same auth resolver as\n  // org-directory discovery so the directory lookup and actual A2A call are\n  // scoped the same way.\n  const auth = await resolveA2ACallerAuth();\n  const response = await callAgent(origin, message, {\n    apiKey: auth.apiKey,\n    userEmail: auth.userEmail,\n    orgDomain: auth.orgDomain,\n    orgSecret: auth.orgSecret,\n    // Bound the wait — cross-app A2A polls async by default.\n    timeoutMs: 5 * 60_000,\n  });\n  return { app: id, routedVia: \"a2a\", response };\n}\n\nasync function resolveAskAppStatusRoute(\n  config: MCPConfig,\n  requestedApp: string,\n  requestMeta?: AskAppRequestMeta,\n): Promise<AskAppRoute> {\n  const selfId = currentAppId(config);\n  const normalized = requestedApp.trim().toLowerCase();\n  const selfEndpointUrl = selfA2AEndpointUrl(requestMeta);\n\n  if (!normalized || normalized === selfId) {\n    if (!selfEndpointUrl) {\n      throw new Error(\n        \"ask_app_status requires a running app origin for local tasks.\",\n      );\n    }\n    return { app: selfId, origin: selfEndpointUrl, routedVia: \"local\" };\n  }\n\n  const targetApp = await resolveTargetAppOrigin(config, requestedApp);\n  if (targetApp) {\n    return {\n      app: targetApp.id,\n      origin: agentNativeA2AEndpoint(targetApp.origin),\n      routedVia: \"a2a\",\n    };\n  }\n\n  const orgApps = await fetchOrgApps({ selfId }).catch(() => [] as OrgApp[]);\n  const dirMatch = orgApps.find((a) => a.id === normalized);\n  if (dirMatch) {\n    return {\n      app: dirMatch.id,\n      origin: agentNativeA2AEndpoint(dirMatch.a2aUrl),\n      routedVia: \"a2a\",\n    };\n  }\n\n  throw new Error(`No reachable ask_app task route for app \"${requestedApp}\".`);\n}\n\n// ---------------------------------------------------------------------------\n// ask_app\n// ---------------------------------------------------------------------------\n\nfunction askAppTool(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Send a natural-language message to an app's AI agent and get its \" +\n        \"response. Use for complex, multi-step tasks needing the agent's \" +\n        \"reasoning and full app context. In a single-app project the 'app' \" +\n        \"param is optional (defaults to this app). When 'app' names a \" +\n        \"different workspace app it is routed there over A2A; the result's \" +\n        \"'routedVia' field reports whether it ran cross-app or locally. \" +\n        \"On hosted MCP, long tasks may return a durable taskId instead of a \" +\n        \"final response; call ask_app_status with that taskId until completed.\",\n      {\n        app: {\n          type: \"string\",\n          description: \"App id to route to (optional in a single-app project)\",\n        },\n        message: {\n          type: \"string\",\n          description: \"The message to send to the app's agent\",\n        },\n        async: {\n          type: \"boolean\",\n          description:\n            \"When true, start a durable task and return immediately with a taskId.\",\n        },\n        maxWaitMs: {\n          type: \"number\",\n          description:\n            \"Maximum time to wait inline before returning a taskId. Hosted MCP clamps this to 25000ms.\",\n        },\n      },\n      [\"message\"],\n    ),\n    run: async (args: Record<string, any>) => {\n      const message = String(args.message ?? \"\").trim();\n      if (!message) throw new Error(\"ask_app requires a 'message'.\");\n      const requestedApp = String(args.app ?? \"\").trim();\n      const selfId = currentAppId(config);\n      const useDurableA2A = Boolean(requestMeta?.origin);\n      const maxWaitMs = isExplicitAsyncAsk(args.async)\n        ? 0\n        : boundedAskAppWaitMs(args.maxWaitMs);\n\n      // Cross-app: the caller named a *different* workspace app. Route the\n      // message to THAT app's agent over A2A (its `/_agent-native/a2a`\n      // endpoint runs the real agent loop with JWT identity) rather than\n      // silently answering from this app's agent and claiming delegation.\n      const targetApp = await resolveTargetAppOrigin(config, requestedApp);\n      if (targetApp) {\n        try {\n          return await routeAskOverA2A(\n            targetApp.origin,\n            targetApp.id,\n            message,\n            {\n              durable: useDurableA2A,\n              maxWaitMs,\n            },\n          );\n        } catch (err: any) {\n          // Be honest: routing was attempted and failed — do NOT fall back to\n          // this app's agent and pretend it was the target.\n          throw new Error(\n            `Failed to route ask_app to \"${targetApp.id}\" via A2A: ` +\n              `${err?.message ?? err}`,\n          );\n        }\n      }\n\n      // Not a known local/workspace app — try the org directory. When a\n      // directory is configured and the requested app is one of the org's\n      // deployed sibling apps, route to it over A2A (same path as above,\n      // against its `a2aUrl`). Inactive directory / any failure ⇒ orgApps is\n      // [] and this is skipped, preserving the exact local-only behavior.\n      if (requestedApp && requestedApp.toLowerCase() !== selfId) {\n        const orgApps = await fetchOrgApps({ selfId }).catch(\n          () => [] as OrgApp[],\n        );\n        const dirMatch = orgApps.find(\n          (a) => a.id === requestedApp.toLowerCase(),\n        );\n        if (dirMatch) {\n          try {\n            return await routeAskOverA2A(\n              dirMatch.a2aUrl,\n              dirMatch.id,\n              message,\n              {\n                durable: useDurableA2A,\n                maxWaitMs,\n              },\n            );\n          } catch (err: any) {\n            throw new Error(\n              `Failed to route ask_app to \"${dirMatch.id}\" via A2A ` +\n                `(org directory): ${err?.message ?? err}`,\n            );\n          }\n        }\n      }\n\n      // Same app (or no workspace / unknown target): answer locally with this\n      // app's own ask-agent handler — the same entry point the HTTP MCP mount\n      // + A2A use, so there is no second agent runner.\n      if (!config.askAgent) {\n        throw new Error(\n          \"This app does not expose an agent (no ask-agent handler).\",\n        );\n      }\n\n      // If the caller named an app we couldn't route to (unknown id, or no\n      // workspace), say so honestly instead of claiming we reached it.\n      const unresolved =\n        !!requestedApp && requestedApp.toLowerCase() !== selfId;\n      const note = unresolved\n        ? `Requested app \"${requestedApp}\" is not a reachable workspace ` +\n          `app; answered with this app (\"${selfId}\") instead.`\n        : undefined;\n\n      // Hosted MCP cannot safely keep a JSON request/response open for a full\n      // agent loop: serverless gateways can return an inactivity 504 before\n      // the result body exists. When we know the running app origin, submit the\n      // local ask through the app's durable A2A task path and only wait a\n      // short bounded window for fast completions.\n      const localA2AEndpointUrl = selfA2AEndpointUrl(requestMeta);\n      if (localA2AEndpointUrl) {\n        return submitAskAppA2ATask(\n          {\n            app: selfId,\n            origin: localA2AEndpointUrl,\n            routedVia: \"local\",\n            ...(note ? { note } : {}),\n          },\n          message,\n          maxWaitMs,\n        );\n      }\n\n      const response = await config.askAgent(message);\n      return {\n        app: selfId,\n        routedVia: \"local\",\n        ...(note ? { note } : {}),\n        response,\n      };\n    },\n  };\n}\n\nfunction askAppStatusTool(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Poll a durable ask_app task and return its current status or final response.\",\n      {\n        app: {\n          type: \"string\",\n          description:\n            \"App id returned by ask_app. Optional for same-app local tasks.\",\n        },\n        taskId: {\n          type: \"string\",\n          description: \"The durable task id returned by ask_app.\",\n        },\n      },\n      [\"taskId\"],\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const taskId = String(args.taskId ?? \"\").trim();\n      if (!taskId) throw new Error(\"ask_app_status requires 'taskId'.\");\n      const requestedApp = String(args.app ?? \"\").trim();\n      const route = await resolveAskAppStatusRoute(\n        config,\n        requestedApp,\n        requestMeta,\n      );\n      return fetchAskAppA2ATask(route, taskId);\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// list_templates\n// ---------------------------------------------------------------------------\n\nfunction listTemplatesTool(): ActionEntry {\n  return {\n    tool: tool(\n      \"List the first-party templates that can be scaffolded into a workspace \" +\n        \"(allow-listed templates only).\",\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async () => {\n      const { visibleTemplates } = await import(\"../cli/templates-meta.js\");\n      return {\n        templates: visibleTemplates().map((t) => ({\n          name: t.name,\n          label: t.label,\n          hint: t.hint,\n        })),\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// create_workspace_app\n// ---------------------------------------------------------------------------\n\nfunction createWorkspaceAppTool(): ActionEntry {\n  return {\n    tool: tool(\n      \"Scaffold a new app into the current workspace from an allow-listed \" +\n        \"template, then return a deep link to open it. Idempotent: if an app \" +\n        \"with that name already exists it is reused.\",\n      {\n        name: {\n          type: \"string\",\n          description: \"New app id (directory under apps/), e.g. 'mymail'\",\n        },\n        template: {\n          type: \"string\",\n          description:\n            \"Template to scaffold from — must be allow-listed (see list_templates)\",\n        },\n      },\n      [\"name\", \"template\"],\n    ),\n    run: async (args: Record<string, any>) => {\n      const name = String(args.name ?? \"\").trim();\n      const template = String(args.template ?? \"\").trim();\n      if (!name || !template) {\n        throw new Error(\n          \"create_workspace_app requires both 'name' and 'template'.\",\n        );\n      }\n\n      // Enforce the strict public template allow-list. The authoritative,\n      // dependency-free source inside @agent-native/core is cli/templates-meta\n      // (kept in sync with packages/shared-app-config/templates.ts; CI guard).\n      const { visibleTemplates } = await import(\"../cli/templates-meta.js\");\n      const allowed = new Set(visibleTemplates().map((t) => t.name));\n      if (!allowed.has(template)) {\n        throw new Error(\n          `Template \"${template}\" is not allow-listed. Allowed: ${[...allowed]\n            .sort()\n            .join(\", \")}`,\n        );\n      }\n\n      const { findWorkspaceRoot, resolveWorkspace } =\n        await import(\"./workspace-resolve.js\");\n      const fs = await import(\"node:fs\");\n      const path = await import(\"node:path\");\n\n      const root = findWorkspaceRoot(process.cwd());\n      if (!root) {\n        throw new Error(\n          \"Not inside a workspace. create_workspace_app only works in a \" +\n            \"multi-app workspace (run from the workspace root).\",\n        );\n      }\n\n      const appDir = path.join(root, \"apps\", name);\n      const alreadyExisted = fs.existsSync(appDir);\n\n      if (!alreadyExisted) {\n        // Reuse the CLI scaffolder directly (no second `agent-native`\n        // subprocess). `addAppToWorkspace(name, { template })` takes the\n        // non-interactive single-template path when name + one template are\n        // given. Run it from the workspace root so detectWorkspace resolves.\n        const prevCwd = process.cwd();\n        try {\n          process.chdir(root);\n          const { addAppToWorkspace } = await import(\"../cli/create.js\");\n          await addAppToWorkspace(name, { template, noInstall: true });\n        } finally {\n          try {\n            process.chdir(prevCwd);\n          } catch {\n            // best-effort cwd restore\n          }\n        }\n      }\n\n      // The workspace gateway auto-detects new apps/* dirs (fs.watch +\n      // 2s sync) and lazily boots the dev server on first request, so we\n      // don't spawn vite ourselves — opening the deep link warms it. Resolve\n      // the port the gateway will use so we can report it.\n      const ws = await resolveWorkspace(root);\n      const appInfo = ws.apps.find((a) => a.id === name);\n      const port = appInfo?.port;\n      // The scaffolded app is always a *different* app from the host MCP\n      // server, so anchor the deep link to the new app's own origin. A\n      // relative path would otherwise be prefixed with the current request\n      // origin and land on the wrong app. Fall back to the relative path\n      // only if the gateway hasn't reported the new app's URL yet.\n      const relDeepLink = buildDeepLink({ app: name, view: \"home\" });\n      const deepLink = appInfo?.url\n        ? `${appInfo.url.replace(/\\/+$/, \"\")}${relDeepLink}`\n        : relDeepLink;\n\n      return {\n        name,\n        template,\n        created: !alreadyExisted,\n        reused: alreadyExisted,\n        port,\n        url: appInfo?.url,\n        gatewayUrl: ws.gatewayUrl,\n        deepLink,\n      };\n    },\n    link: ({ result }) => {\n      if (!result || typeof result !== \"object\") return null;\n      const r = result as { deepLink?: string; name?: string };\n      if (!r.deepLink) return null;\n      return {\n        url: r.deepLink,\n        label: `Open ${r.name ?? \"app\"}`,\n        view: \"home\",\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Registry\n// ---------------------------------------------------------------------------\n\n/**\n * Build the generic cross-app builtin tool registry. Called by\n * `createMCPServerForRequest`; the result is merged UNDER the config's\n * actions so template actions of the same name win.\n */\nexport function getBuiltinCrossAppTools(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): Record<string, ActionEntry> {\n  return {\n    list_apps: listAppsTool(config, requestMeta),\n    open_app: openAppTool(config, requestMeta),\n    create_embed_session: createEmbedSessionTool(requestMeta),\n    ask_app: askAppTool(config, requestMeta),\n    ask_app_status: askAppStatusTool(config, requestMeta),\n    create_workspace_app: createWorkspaceAppTool(),\n    list_templates: listTemplatesTool(),\n  };\n}\n"]}
+{"version":3,"file":"builtin-tools.js","sourceRoot":"","sources":["../../src/mcp/builtin-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AAQ/D;;;;GAIG;AACH,SAAS,IAAI,CACX,WAAmB,EACnB,UAAmB,EACnB,QAAmB;IAEnB,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxC,OAAO;QACL,WAAW;QACX,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,UAAU;YACtB,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAAiB;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAC7D,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AA0BH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,MAA6D;IAE7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,GAAG,KAAK,oBAAoB,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA+B;IACzD,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,IAAI,wBAAwB,EAAE,CAAC;IACrE,OAAO,sBAAsB,CAAC,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,8BAA8B,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,IAAU;IAChC,OAAO,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU;IAC1B,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;QACxB,EAAE,MAAM,CACN,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CACvE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,IAAI,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkB,EAAE,IAAU;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ,IAAI,eAAe;SACtC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACjD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,KAAK,EAAE,QAAQ,IAAI,gBAAgB,MAAM,GAAG;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SAC/C;QACD,OAAO,EACL,oBAAoB,MAAM,6BAA6B;YACvD,WAAW,IAAI,CAAC,EAAE,mCAAmC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAAc;IAIpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,OAAO;QACL,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YACzC,gBAAgB,EAAE,8BAA8B;YAChD,GAAG,CAAC,IAAI,CAAC,eAAe;gBACtB,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAA4C,EAC5C,WAAiB,EACjB,SAAiB;IAEjB,IAAI,SAAS,IAAI,CAAC,IAAI,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,WAAW,CAAC;IAE1B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CACnE,CAAC;QACF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,iDAAiD;YACjD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC3C,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAkB,EAClB,OAAe,EACf,SAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACzC,EACD;QACE,KAAK,EAAE,IAAI;QACX,QAAQ;KACT,CACF,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAkB,EAClB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAiB,EACjB,WAAmB;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,SAAS,YAAY,CACnB,MAAiB,EACjB,WAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,IAAI,CACR,qEAAqE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,qDAAqD,CACxD;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACpE,MAAM,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAEpC,kEAAkE;YAClE,iEAAiE;YACjE,sEAAsE;YACtE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,qEAAqE;YACrE,iBAAiB;YACjB,MAAM,UAAU,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC9B,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC;YAUjE,MAAM,IAAI,GAAe,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACV,CAAC,CAAC;oBACE,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,GAAG,EAAE,UAAU;oBACf,IAAI,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAuB;oBAChD,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAoB;iBAC7B;gBACH,CAAC,CAAC;oBACE,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,IAAI,EAAE,CAAC,CAAC,IAA0B;oBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,MAAM,EAAE,WAAoB;iBAC7B,CACN,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAExE,qEAAqE;YACrE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;gBACjC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;YAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7C,gEAAgE;gBAChE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnB,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC;oBACR,EAAE,EAAE,EAAE,CAAC,EAAE;oBACT,GAAG,EAAE,EAAE,CAAC,GAAG;oBACX,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,EAAE,CAAC,WAAW;gBACzB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,IAAI;aACL,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAS,WAAW,CAClB,MAAiB,EACjB,WAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,IAAI,CACR,mEAAmE;YACjE,mCAAmC;YACnC,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,kBAAkB,EACpB;YACE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;YAC3D,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sHAAsH;aACzH;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,oLAAoL;aACvL;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iEAAiE;aACpE;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,8FAA8F;aACjG;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;gBACzB,WAAW,EACT,sEAAsE;aACzE;SACF,EACD,CAAC,KAAK,CAAC,CACR;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,yDAAyD;YACzD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAA6D,CAAC;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAgD,CAAC;YAC5D,CAAC;iBAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,SAAS,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,CAAC;YACpC,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,CAAC;YACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;YACzD,IACE,IAAI,CAAC,KAAK,IAAI,IAAI;gBAClB,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,MAAM,CAAC,EACpD,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;iBAAM,IACL,IAAI,CAAC,KAAK,IAAI,IAAI;gBAClB,CAAC,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,OAAO,CAAC,EACtD,CAAC;gBACD,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YACD,IACE,aAAa,KAAK,IAAI;gBACtB,aAAa,KAAK,KAAK;gBACvB,aAAa,KAAK,MAAM;gBACxB,aAAa,KAAK,OAAO,EACzB,CAAC;gBACD,OAAO,MAAM,EAAE,KAAK,CAAC;YACvB,CAAC;YAED,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAC7B,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS;oBACnD,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxD,OAAO,MAAM,EAAE,MAAM,CAAC;YACxB,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,GAAG,SAAS,CAAC;YAEnE,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI;gBACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC;gBAClC,CAAC,CAAC,cAAc;oBACd,CAAC,CAAC,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC;oBAC5C,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,MAAM,UAAU,GACd,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEnE,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,SAAS;gBACtB,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,EAAE;gBACpD,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC;YACnB,IAAI,aAAiC,CAAC;YACtC,IAAI,eAAmC,CAAC;YACxC,IAAI,cAAkC,CAAC;YAEvC,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxB,MAAM,EAAE,iBAAiB,EAAE,GACzB,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,GAC1D,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;oBAC7C,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBAC3C,MAAM,UAAU,GAAG,wBAAwB,CACzC,sBAAsB,CAAC,GAAG,CAAC,EAC3B,WAAW,EAAE,MAAM,CACpB,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBACf,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;4BAC5C,UAAU;4BACV,KAAK,EAAE,GAAG,EAAE,KAAK;4BACjB,UAAU;4BACV,KAAK,EAAE,MAAM,IAAI,IAAI;yBACtB,CAAC,CAAC;wBACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBACrD,aAAa,GAAG,WAAW,EAAE,MAAM;4BACjC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;4BACnD,CAAC,CAAC,SAAS,CAAC;wBACd,eAAe,GAAG,UAAU,CAAC;wBAC7B,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,GAAG;gBACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG;gBACH,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,KAAK;aACN,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,CAAC,GAAG,MAKT,CAAC;YACF,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,CAAC,CAAC,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK,EAAE,QAAQ,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE;gBAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC;QACJ,CAAC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,QAAQ,CAAC;gBACjB,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,wCAAwC;gBACrD,WAAW,EAAE,kBAAkB;gBAC/B,SAAS,EAAE,UAAU;aACtB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,sBAAsB,CAAC,WAE/B;IACC,OAAO;QACL,IAAI,EAAE;YACJ,GAAG,IAAI,CACL,qJAAqJ,EACrJ;gBACE,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,yDAAyD;iBAC5D;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yCAAyC;iBACvD;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;oBACzB,WAAW,EAAE,4CAA4C;iBAC1D;aACF,CACF;YACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;SACzB;QACf,0EAA0E;QAC1E,uEAAuE;QACvE,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,EAAE,iBAAiB,EAAE,GACzB,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,GAC1D,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAC7C,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC7C,CAAC,CAAC,IAAI,CAAC,GAAG;gBACV,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,wBAAwB,CACzC,SAAS,EACT,WAAW,EAAE,MAAM,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;gBAC5C,UAAU;gBACV,KAAK,EAAE,GAAG,EAAE,KAAK;gBACjB,UAAU;gBACV,KAAK,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aAC5D,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,WAAW,EAAE,MAAM;gBAClC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,QAAQ;gBACR,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,EAAU,EACV,OAAe,EACf,OAAmD;IAInD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,mBAAmB,CACxB,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EACrE,OAAO,EACP,OAAO,CAAC,SAAS,IAAI,8BAA8B,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,yDAAyD;QACzD,SAAS,EAAE,CAAC,GAAG,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAiB,EACjB,YAAoB,EACpB,WAA+B;IAE/B,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,MAAM,EAAE,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC;YAChD,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,EAAE;YAChB,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,UAAU,CACjB,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,mEAAmE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,+DAA+D;YAC/D,oEAAoE;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,uEAAuE,EACzE;YACE,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,uDAAuD;aACrE;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,wCAAwC;aACtD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,uEAAuE;aAC1E;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,2FAA2F;aAC9F;SACF,EACD,CAAC,SAAS,CAAC,CACZ;QACD,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC9C,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAExC,qEAAqE;YACrE,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACrE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,OAAO,MAAM,eAAe,CAC1B,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,EAAE,EACZ,OAAO,EACP;wBACE,OAAO,EAAE,aAAa;wBACtB,SAAS;qBACV,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,oEAAoE;oBACpE,kDAAkD;oBAClD,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,CAAC,EAAE,aAAa;wBACtD,GAAG,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAClD,GAAG,EAAE,CAAC,EAAc,CACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAC3C,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,OAAO,MAAM,eAAe,CAC1B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,EAAE,EACX,OAAO,EACP;4BACE,OAAO,EAAE,aAAa;4BACtB,SAAS;yBACV,CACF,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,EAAE,YAAY;4BACpD,oBAAoB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC5C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,iDAAiD;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,UAAU,GACd,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;YAC1D,MAAM,IAAI,GAAG,UAAU;gBACrB,CAAC,CAAC,kBAAkB,YAAY,iCAAiC;oBAC/D,iCAAiC,MAAM,aAAa;gBACtD,CAAC,CAAC,SAAS,CAAC;YAEd,wEAAwE;YACxE,sEAAsE;YACtE,0EAA0E;YAC1E,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC5D,IAAI,mBAAmB,EAAE,CAAC;gBACxB,OAAO,mBAAmB,CACxB;oBACE,GAAG,EAAE,MAAM;oBACX,MAAM,EAAE,mBAAmB;oBAC3B,SAAS,EAAE,OAAO;oBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1B,EACD,OAAO,EACP,SAAS,CACV,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO;gBACL,GAAG,EAAE,MAAM;gBACX,SAAS,EAAE,OAAO;gBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,QAAQ;aACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,8EAA8E,EAC9E;YACE,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gEAAgE;aACnE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,0CAA0C;aACxD;SACF,EACD,CAAC,QAAQ,CAAC,CACX;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAC1C,MAAM,EACN,YAAY,EACZ,WAAW,CACZ,CAAC;YACF,OAAO,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,OAAO;QACL,IAAI,EAAE,IAAI,CACR,yEAAyE;YACvE,gCAAgC,CACnC;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACtE,OAAO;gBACL,SAAS,EAAE,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxC,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,sBAAsB;IAC7B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,qEAAqE;YACnE,sEAAsE;YACtE,6CAA6C,EAC/C;YACE,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,mDAAmD;aACjE;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,uEAAuE;aAC1E;SACF,EACD,CAAC,MAAM,EAAE,UAAU,CAAC,CACrB;QACD,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,mCAAmC,CAAC,GAAG,OAAO,CAAC;qBACjE,IAAI,EAAE;qBACN,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAC3C,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACb,+DAA+D;oBAC7D,oDAAoD,CACvD,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE7C,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,iEAAiE;gBACjE,oEAAoE;gBACpE,qEAAqE;gBACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACpB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;oBAC/D,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC;wBACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzB,CAAC;oBAAC,MAAM,CAAC;wBACP,0BAA0B;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,mEAAmE;YACnE,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;YAC3B,mEAAmE;YACnE,iEAAiE;YACjE,qEAAqE;YACrE,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG;gBAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE;gBACpD,CAAC,CAAC,WAAW,CAAC;YAEhB,OAAO;gBACL,IAAI;gBACJ,QAAQ;gBACR,OAAO,EAAE,CAAC,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,IAAI;gBACJ,GAAG,EAAE,OAAO,EAAE,GAAG;gBACjB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,CAAC,GAAG,MAA8C,CAAC;YACzD,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,QAAQ;gBACf,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,KAAK,EAAE;gBAChC,IAAI,EAAE,MAAM;aACb,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC;QAC5C,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC;QAC1C,oBAAoB,EAAE,sBAAsB,CAAC,WAAW,CAAC;QACzD,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC;QACxC,cAAc,EAAE,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;QACrD,oBAAoB,EAAE,sBAAsB,EAAE;QAC9C,cAAc,EAAE,iBAAiB,EAAE;KACpC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Generic cross-app MCP tools — a stable verb set every external agent gets\n * regardless of which template it is talking to.\n *\n * These are merged into the MCP action registry by\n * `createMCPServerForRequest` (see `build-server.ts`). **Precedence: template\n * actions win.** If a template defines an action named `list_apps` /\n * `open_app` / `ask_app` / `create_workspace_app` / `list_templates`, the\n * template's `ActionEntry` overwrites the builtin of the same name. This is\n * the same template-over-framework precedence `autoDiscoverActions` uses.\n *\n * | Tool                  | Side effects | Returns                                  |\n * | --------------------- | ------------ | ---------------------------------------- |\n * | `list_apps`           | none         | `{ apps: [{ id, url, running }] }`       |\n * | `open_app`            | none         | `{ url }` (+ deep-link `link`)           |\n * | `create_embed_session`| ticket mint  | `{ startUrl }` for MCP App iframes       |\n * | `ask_app`             | agent loop   | `{ app, routedVia, response }` or task   |\n * | `ask_app_status`      | none         | poll a durable `ask_app` task            |\n * | `create_workspace_app`| scaffolds    | `{ name, url, port, deepLink }` (+ link) |\n *\n * `open_app` / `create_workspace_app` return an **absolute** URL on the\n * *target* app's origin when it differs from this app (so a workspace link\n * lands in the right app), and a relative path for the same app / standalone.\n * `ask_app` routes to a *different* workspace app over A2A when possible and\n * reports `routedVia: \"a2a\"`; otherwise it answers locally\n * (`routedVia: \"local\"`) and never falsely claims cross-app delegation.\n * | `list_templates`      | none         | `{ templates: [...] }` (allow-list only) |\n *\n * Node-only at call time (workspace resolution + scaffolding use `fs`), but\n * the module has no top-level Node imports so it bundles fine alongside\n * `mountMCP` — the Node bits are dynamically imported inside `run()`.\n */\n\nimport type { Task } from \"../a2a/types.js\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport { getConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { buildDeepLink } from \"../server/deep-link.js\";\nimport { MCP_APP_CHAT_BRIDGE_QUERY_PARAM } from \"../shared/embed-auth.js\";\nimport type { MCPConfig } from \"./build-server.js\";\nimport { embedApp } from \"./embed-app.js\";\nimport { fetchOrgApps, type OrgApp } from \"./org-directory.js\";\n\n/** Flat map of param name → JSON-schema property. */\ntype Params = Record<\n  string,\n  { type: string; description?: string; enum?: string[] }\n>;\n\n/**\n * Build an `ActionTool`. `parameters` is wrapped in the\n * `{ type:\"object\", properties, required }` shape `createMCPServerForRequest`\n * forwards verbatim as the MCP tool `inputSchema`.\n */\nfunction tool(\n  description: string,\n  parameters?: Params,\n  required?: string[],\n): ActionTool {\n  if (!parameters) return { description };\n  return {\n    description,\n    parameters: {\n      type: \"object\",\n      properties: parameters,\n      ...(required && required.length ? { required } : {}),\n    },\n  };\n}\n\n/**\n * The canonical app id this MCP server is mounted for. `MCPConfig.appId` is\n * authoritative; fall back to lowercasing `name` (which is the capitalized\n * app id at every call site) for back-compat with configs that predate the\n * `appId` field.\n */\nfunction currentAppId(config: MCPConfig): string {\n  return (config.appId || config.name || \"app\").toLowerCase();\n}\n\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\nconst ASK_APP_DEFAULT_INLINE_WAIT_MS = 20_000;\nconst ASK_APP_MAX_INLINE_WAIT_MS = 25_000;\nconst ASK_APP_POLL_INTERVAL_MS = 1_500;\nconst ASK_APP_A2A_REQUEST_TIMEOUT_MS = 10_000;\nconst ASK_APP_TERMINAL_STATES = new Set<string>([\n  \"completed\",\n  \"failed\",\n  \"canceled\",\n]);\n\ntype AskAppRequestMeta = { origin?: string; basePath?: string };\n\ninterface AskAppRoute {\n  app: string;\n  origin: string;\n  routedVia: \"local\" | \"a2a\";\n  note?: string;\n}\n\ninterface AskAppTaskResult {\n  app: string;\n  routedVia: \"local\" | \"a2a\";\n  taskId: string;\n  status: string;\n  response?: string;\n  error?: string;\n  note?: string;\n  poll?: {\n    tool: \"ask_app_status\";\n    arguments: { app: string; taskId: string };\n  };\n  message?: string;\n}\n\nfunction safeAppPath(raw: unknown): string | null {\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\n  const value = raw.trim();\n  if (CONTROL_CHARS.test(value)) return null;\n  if (!value.startsWith(\"/\")) return null;\n  if (value.startsWith(\"//\") || value.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(value)) return null;\n  return value;\n}\n\nfunction appendParamsToPath(\n  path: string,\n  params: Record<string, string | number | boolean> | undefined,\n): string {\n  if (!params || Object.keys(params).length === 0) return path;\n  const url = new URL(path, \"http://agent-native.invalid\");\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, String(value));\n  }\n  return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction viewToAppPath(view: string): string | null {\n  const value = view.trim();\n  if (!value) return null;\n  return safeAppPath(value.startsWith(\"/\") ? value : `/${value}`);\n}\n\nfunction withConfiguredBasePath(path: string): string {\n  const base = getConfiguredAppBasePath();\n  if (!base || path === base || path.startsWith(`${base}/`)) return path;\n  return `${base}${path}`;\n}\n\nfunction withMcpChatBridgeParam(path: string): string {\n  try {\n    const url = new URL(path, \"http://agent-native.invalid\");\n    url.searchParams.set(MCP_APP_CHAT_BRIDGE_QUERY_PARAM, \"1\");\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return path;\n  }\n}\n\nfunction agentNativeA2AEndpoint(urlOrOrigin: string): string {\n  const value = urlOrOrigin.replace(/\\/+$/, \"\");\n  try {\n    const parsed = new URL(value);\n    const pathname = parsed.pathname.replace(/\\/+$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\") || pathname.endsWith(\"/a2a\")) {\n      return value;\n    }\n  } catch {\n    // Fall through and append the conventional Agent Native endpoint.\n  }\n  return `${value}/_agent-native/a2a`;\n}\n\nfunction selfA2AEndpointUrl(requestMeta?: AskAppRequestMeta): string | null {\n  const origin = requestMeta?.origin?.replace(/\\/+$/, \"\");\n  if (!origin) return null;\n  const basePath = requestMeta?.basePath || getConfiguredAppBasePath();\n  return agentNativeA2AEndpoint(`${origin}${basePath}`);\n}\n\nfunction boundedAskAppWaitMs(raw: unknown): number {\n  if (raw == null || raw === \"\") return ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed)) return ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  return Math.max(0, Math.min(ASK_APP_MAX_INLINE_WAIT_MS, Math.trunc(parsed)));\n}\n\nfunction isExplicitAsyncAsk(raw: unknown): boolean {\n  return raw === true || raw === \"true\" || raw === 1 || raw === \"1\";\n}\n\nfunction taskState(task: Task): string {\n  return String(task.status?.state ?? \"unknown\");\n}\n\nfunction isTerminalTask(task: Task): boolean {\n  return ASK_APP_TERMINAL_STATES.has(taskState(task));\n}\n\nfunction taskText(task: Task): string {\n  return (\n    task.status.message?.parts\n      ?.filter(\n        (part): part is { type: \"text\"; text: string } => part.type === \"text\",\n      )\n      .map((part) => part.text)\n      .join(\"\\n\")\n      .trim() ?? \"\"\n  );\n}\n\nfunction askAppTaskResult(route: AskAppRoute, task: Task): AskAppTaskResult {\n  const status = taskState(task);\n  const response = taskText(task);\n  const base = {\n    app: route.app,\n    routedVia: route.routedVia,\n    taskId: task.id,\n    status,\n    ...(route.note ? { note: route.note } : {}),\n  };\n\n  if (status === \"completed\") {\n    return {\n      ...base,\n      response: response || \"(no response)\",\n    };\n  }\n\n  if (status === \"failed\" || status === \"canceled\") {\n    return {\n      ...base,\n      ...(response ? { response } : {}),\n      error: response || `ask_app task ${status}.`,\n    };\n  }\n\n  return {\n    ...base,\n    poll: {\n      tool: \"ask_app_status\",\n      arguments: { app: route.app, taskId: task.id },\n    },\n    message:\n      `ask_app is still ${status}. Call ask_app_status with ` +\n      `taskId \"${task.id}\" to retrieve the final response.`,\n  };\n}\n\nasync function createA2AClientForAskApp(origin: string): Promise<{\n  client: import(\"../a2a/client.js\").A2AClient;\n  metadata: Record<string, unknown>;\n}> {\n  const { A2AClient } = await import(\"../a2a/client.js\");\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  const auth = await resolveA2ACallerAuth();\n  const metadata: Record<string, unknown> = {};\n  if (auth.userEmail) metadata.userEmail = auth.userEmail;\n  if (auth.orgDomain) metadata.orgDomain = auth.orgDomain;\n  return {\n    client: new A2AClient(origin, auth.apiKey, {\n      requestTimeoutMs: ASK_APP_A2A_REQUEST_TIMEOUT_MS,\n      ...(auth.apiKeyFallbacks\n        ? { fallbackApiKeys: auth.apiKeyFallbacks }\n        : {}),\n    }),\n    metadata,\n  };\n}\n\nasync function waitForA2ATask(\n  client: import(\"../a2a/client.js\").A2AClient,\n  initialTask: Task,\n  maxWaitMs: number,\n): Promise<Task> {\n  if (maxWaitMs <= 0 || isTerminalTask(initialTask)) return initialTask;\n  const deadline = Date.now() + maxWaitMs;\n  let current = initialTask;\n\n  while (!isTerminalTask(current)) {\n    const remaining = deadline - Date.now();\n    if (remaining <= 0) return current;\n    await new Promise((resolve) =>\n      setTimeout(resolve, Math.min(ASK_APP_POLL_INTERVAL_MS, remaining)),\n    );\n    try {\n      current = await client.getTask(initialTask.id);\n    } catch {\n      // Transient status fetch failures should not turn a successfully\n      // submitted durable task into a failed MCP call.\n      if (Date.now() >= deadline) return current;\n      continue;\n    }\n  }\n\n  return current;\n}\n\nasync function submitAskAppA2ATask(\n  route: AskAppRoute,\n  message: string,\n  maxWaitMs: number,\n): Promise<AskAppTaskResult> {\n  const { client, metadata } = await createA2AClientForAskApp(route.origin);\n  const task = await client.send(\n    {\n      role: \"user\",\n      parts: [{ type: \"text\", text: message }],\n    },\n    {\n      async: true,\n      metadata,\n    },\n  );\n  const finalOrRunning = await waitForA2ATask(client, task, maxWaitMs);\n  return askAppTaskResult(route, finalOrRunning);\n}\n\nasync function fetchAskAppA2ATask(\n  route: AskAppRoute,\n  taskId: string,\n): Promise<AskAppTaskResult> {\n  const { client } = await createA2AClientForAskApp(route.origin);\n  const task = await client.getTask(taskId);\n  return askAppTaskResult(route, task);\n}\n\n/**\n * Resolve the absolute origin of a *target* workspace app (e.g.\n * `http://127.0.0.1:8101`) so cross-app deep links / A2A calls point at the\n * right app instead of the current request's origin. Reuses the same\n * workspace resolution `list_apps` / the stdio proxy use.\n *\n * Returns `null` when:\n *   - the target is the current app (caller should keep relative behavior),\n *   - there is no workspace info (standalone / single app), or\n *   - the target app is unknown.\n */\nasync function resolveTargetAppOrigin(\n  config: MCPConfig,\n  targetAppId: string,\n): Promise<{ origin: string; id: string } | null> {\n  const target = targetAppId.trim().toLowerCase();\n  if (!target || target === currentAppId(config)) return null;\n  try {\n    const { resolveWorkspace } = await import(\"./workspace-resolve.js\");\n    const ws = await resolveWorkspace();\n    if (!ws.isWorkspace) return null;\n    const match = ws.apps.find((a) => a.id.toLowerCase() === target);\n    if (!match) return null;\n    return { origin: match.url, id: match.id };\n  } catch {\n    return null;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// list_apps\n// ---------------------------------------------------------------------------\n\nfunction listAppsTool(\n  config: MCPConfig,\n  requestMeta?: { origin?: string },\n): ActionEntry {\n  return {\n    tool: tool(\n      \"List the workspace apps and their URLs. Use this to discover which \" +\n        \"apps exist before opening or asking one. In a single-app project \" +\n        \"this returns just that app. When an org directory is configured \" +\n        \"this also includes the org's deployed sibling apps.\",\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async () => {\n      const { resolveWorkspace } = await import(\"./workspace-resolve.js\");\n      const ws = await resolveWorkspace();\n\n      // The MCP request is served BY the current app, so it is provably\n      // reachable at the inbound request origin — that beats a guessed\n      // `PORT || 5173` probe (which reports the wrong URL + `running:false`\n      // whenever the dev server picked a non-default port, e.g. `agent-\n      // native dev` on :8080). For the entry that IS this app (the sole\n      // entry when single-app, or the id matching `config.appId` in a\n      // workspace) prefer the live origin; other workspace apps keep their\n      // probed values.\n      const liveOrigin = requestMeta?.origin?.replace(/\\/+$/, \"\") || \"\";\n      let livePort = 0;\n      if (liveOrigin) {\n        try {\n          const u = new URL(liveOrigin);\n          livePort = Number(u.port) || (u.protocol === \"https:\" ? 443 : 80);\n        } catch {\n          livePort = 0;\n        }\n      }\n      const selfId = (config.appId ?? \"\").toLowerCase();\n      const isSelf = (id: string) =>\n        !!liveOrigin &&\n        (!ws.isWorkspace || (!!selfId && id.toLowerCase() === selfId));\n\n      interface AppEntry {\n        id: string;\n        url: string;\n        port: number | undefined;\n        running: boolean;\n        source: \"workspace\" | \"org-directory\";\n      }\n\n      const apps: AppEntry[] = ws.apps.map((a) =>\n        isSelf(a.id)\n          ? {\n              id: a.id,\n              url: liveOrigin,\n              port: (livePort || a.port) as number | undefined,\n              running: true,\n              source: \"workspace\" as const,\n            }\n          : {\n              id: a.id,\n              url: a.url,\n              port: a.port as number | undefined,\n              running: a.running,\n              source: \"workspace\" as const,\n            },\n      );\n      const seenIds = new Set(apps.map((a) => a.id.toLowerCase()));\n      const seenOrigins = new Set(apps.map((a) => a.url.replace(/\\/+$/, \"\")));\n\n      // Merge the org directory's deployed sibling apps. Inactive (no env)\n      // or any failure ⇒ fetchOrgApps() returns [] and this is a no-op, so\n      // the existing local/workspace behavior is preserved exactly.\n      const orgApps = await fetchOrgApps({\n        selfId: currentAppId(config),\n      }).catch(() => [] as OrgApp[]);\n      for (const oa of orgApps) {\n        const idKey = oa.id.toLowerCase();\n        const originKey = oa.url.replace(/\\/+$/, \"\");\n        // Dedupe by id OR origin — a workspace app already listed wins.\n        if (seenIds.has(idKey) || seenOrigins.has(originKey)) continue;\n        seenIds.add(idKey);\n        seenOrigins.add(originKey);\n        apps.push({\n          id: oa.id,\n          url: oa.url,\n          port: undefined,\n          running: true,\n          source: \"org-directory\",\n        });\n      }\n\n      return {\n        workspace: ws.isWorkspace,\n        gatewayUrl: ws.gatewayUrl,\n        apps,\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// open_app\n// ---------------------------------------------------------------------------\n\nfunction openAppTool(\n  config: MCPConfig,\n  requestMeta?: { origin?: string },\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Build a deep link that opens an app at a specific view/record or \" +\n        \"focused route/component. No side \" +\n        \"effects — returns a URL the user can click to land in the running UI. \" +\n        \"Set embed:true when a UI-capable MCP host should render the live app \" +\n        \"or focused route/component inline. Omit view and path to land on the \" +\n        \"app's home page.\",\n      {\n        app: { type: \"string\", description: \"App id, e.g. 'mail'\" },\n        view: {\n          type: \"string\",\n          description:\n            \"Target view, e.g. 'inbox' (maps to navigate command). Optional — omit (along with path) to open the app's home page.\",\n        },\n        path: {\n          type: \"string\",\n          description:\n            \"Optional app route to open directly, e.g. '/extensions/abc', '/adhoc/q2', or '/chart?panel=...'. Must be same-origin relative. Omit (along with view) to open the app's home page.\",\n        },\n        params: {\n          type: \"object\",\n          description:\n            \"Optional record-focus / filter params, e.g. { threadId: 'abc' }\",\n        },\n        embed: {\n          type: \"boolean\",\n          description:\n            \"Render the full app or focused route/component inline in MCP Apps when the host supports it.\",\n        },\n        chrome: {\n          type: \"string\",\n          enum: [\"full\", \"minimal\"],\n          description:\n            \"Embed chrome preference for compatible app routes. Defaults to full.\",\n        },\n      },\n      [\"app\"],\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const app = String(args.app ?? \"\").trim();\n      const view = String(args.view ?? \"\").trim();\n      // `safeAppPath` rejects anything that isn't a leading-slash same-origin\n      // path. When the caller passes nothing, fall back to the app's root so a\n      // bare `open_app({app:\"dispatch\"})` lands on the home page instead of\n      // throwing. The model self-corrects on the retry today, but the extra\n      // round-trip wastes a turn and looks broken to the user.\n      const path = safeAppPath(args.path) || (view ? null : \"/\");\n      if (!app) {\n        throw new Error(\"open_app requires 'app'.\");\n      }\n      let params: Record<string, string | number | boolean> | undefined;\n      const raw = args.params;\n      if (raw && typeof raw === \"object\") {\n        params = raw as Record<string, string | number | boolean>;\n      } else if (typeof raw === \"string\" && raw.trim()) {\n        try {\n          params = JSON.parse(raw);\n        } catch {\n          params = undefined;\n        }\n      }\n      const embeddedParam = params?.embed;\n      const chromeParam = params?.chrome;\n      let embed = args.embed === true || args.embed === \"true\";\n      if (\n        args.embed == null &&\n        (embeddedParam === true || embeddedParam === \"true\")\n      ) {\n        embed = true;\n      } else if (\n        args.embed == null &&\n        (embeddedParam === false || embeddedParam === \"false\")\n      ) {\n        embed = false;\n      }\n      if (\n        embeddedParam === true ||\n        embeddedParam === false ||\n        embeddedParam === \"true\" ||\n        embeddedParam === \"false\"\n      ) {\n        delete params?.embed;\n      }\n\n      const chrome =\n        typeof args.chrome === \"string\"\n          ? args.chrome\n          : chromeParam === \"full\" || chromeParam === \"minimal\"\n            ? chromeParam\n            : undefined;\n      if (chromeParam === \"full\" || chromeParam === \"minimal\") {\n        delete params?.chrome;\n      }\n      if (params && Object.keys(params).length === 0) params = undefined;\n\n      const directViewPath = embed && view ? viewToAppPath(view) : null;\n      const relUrl = path\n        ? appendParamsToPath(path, params)\n        : directViewPath\n          ? appendParamsToPath(directViewPath, params)\n          : buildDeepLink({ app, view, params });\n      const sameAppUrl =\n        path || directViewPath ? withConfiguredBasePath(relUrl) : relUrl;\n\n      // Cross-app target in a workspace: resolve the TARGET app's origin and\n      // return an absolute URL. Otherwise the MCP layer would prefix the\n      // relative path with the CURRENT request origin, landing the user in\n      // the wrong app (e.g. open_app({app:\"calendar\"}) served from Mail).\n      // Same-app / standalone keeps the relative path (current behavior).\n      const targetApp = await resolveTargetAppOrigin(config, app);\n      const appUrl = targetApp\n        ? `${targetApp.origin.replace(/\\/+$/, \"\")}${relUrl}`\n        : sameAppUrl;\n      const url = appUrl;\n      let embedStartUrl: string | undefined;\n      let embedTargetPath: string | undefined;\n      let embedExpiresAt: number | undefined;\n\n      if (embed && !targetApp) {\n        const { getRequestContext } =\n          await import(\"../server/request-context.js\");\n        const ctx = getRequestContext();\n        const ownerEmail = ctx?.userEmail?.trim();\n        if (ownerEmail) {\n          const { normalizeEmbedTargetPath, createEmbedSessionTicket } =\n            await import(\"../server/embed-session.js\");\n          const { buildEmbedStartPath } =\n            await import(\"../server/embed-route.js\");\n          const targetPath = normalizeEmbedTargetPath(\n            withMcpChatBridgeParam(url),\n            requestMeta?.origin,\n          );\n          if (targetPath) {\n            const ticket = await createEmbedSessionTicket({\n              ownerEmail,\n              orgId: ctx?.orgId,\n              targetPath,\n              scope: chrome ?? null,\n            });\n            const startPath = buildEmbedStartPath(ticket.ticket);\n            embedStartUrl = requestMeta?.origin\n              ? new URL(startPath, requestMeta.origin).toString()\n              : startPath;\n            embedTargetPath = targetPath;\n            embedExpiresAt = ticket.expiresAt;\n          }\n        }\n      }\n\n      return {\n        app,\n        ...(view ? { view } : {}),\n        ...(path ? { path } : {}),\n        url,\n        ...(embedStartUrl ? { embedStartUrl } : {}),\n        ...(embedTargetPath ? { embedTargetPath } : {}),\n        ...(embedExpiresAt ? { embedExpiresAt } : {}),\n        embed,\n      };\n    },\n    link: ({ result }) => {\n      if (!result || typeof result !== \"object\") return null;\n      const r = result as {\n        url?: string;\n        app?: string;\n        view?: string;\n        embed?: boolean;\n      };\n      if (r.embed) return null;\n      if (!r.url) return null;\n      return {\n        url: r.url,\n        label: `Open ${r.app ?? \"app\"}`,\n        view: r.view,\n      };\n    },\n    mcpApp: {\n      resource: embedApp({\n        title: \"Open app\",\n        description: \"Render the requested app route inline.\",\n        iframeTitle: \"Agent Native app\",\n        openLabel: \"Open app\",\n      }),\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// create_embed_session\n// ---------------------------------------------------------------------------\n\nfunction createEmbedSessionTool(requestMeta?: {\n  origin?: string;\n}): ActionEntry {\n  return {\n    tool: {\n      ...tool(\n        \"MCP Apps helper: create a one-time browser embed session for a same-origin app URL. Usually called by an MCP App iframe, not directly by the model.\",\n        {\n          url: {\n            type: \"string\",\n            description:\n              \"Same-origin absolute URL or app-relative path to embed.\",\n          },\n          path: {\n            type: \"string\",\n            description: \"Same-origin app-relative path to embed.\",\n          },\n          chrome: {\n            type: \"string\",\n            enum: [\"full\", \"minimal\"],\n            description: \"Embed chrome preference. Defaults to full.\",\n          },\n        },\n      ),\n      _meta: { ui: { visibility: [\"app\"] } },\n    } as ActionTool,\n    // App-only bootstrap helper: the ticket becomes a normal browser session,\n    // so keep it write-scoped until embed sessions can enforce MCP scopes.\n    readOnly: false,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const { getRequestContext } =\n        await import(\"../server/request-context.js\");\n      const ctx = getRequestContext();\n      const ownerEmail = ctx?.userEmail?.trim();\n      if (!ownerEmail) {\n        throw new Error(\n          \"create_embed_session requires an authenticated MCP caller.\",\n        );\n      }\n\n      const { normalizeEmbedTargetPath, createEmbedSessionTicket } =\n        await import(\"../server/embed-session.js\");\n      const { buildEmbedStartPath } = await import(\"../server/embed-route.js\");\n      const rawTarget =\n        typeof args.url === \"string\" && args.url.trim()\n          ? args.url\n          : typeof args.path === \"string\"\n            ? args.path\n            : \"\";\n      const targetPath = normalizeEmbedTargetPath(\n        rawTarget,\n        requestMeta?.origin,\n      );\n      if (!targetPath) {\n        throw new Error(\n          \"create_embed_session can only embed same-origin app-relative URLs.\",\n        );\n      }\n\n      const ticket = await createEmbedSessionTicket({\n        ownerEmail,\n        orgId: ctx?.orgId,\n        targetPath,\n        scope: typeof args.chrome === \"string\" ? args.chrome : null,\n      });\n      const startPath = buildEmbedStartPath(ticket.ticket);\n      const startUrl = requestMeta?.origin\n        ? new URL(startPath, requestMeta.origin).toString()\n        : startPath;\n      return {\n        startUrl,\n        targetPath,\n        expiresAt: ticket.expiresAt,\n      };\n    },\n  };\n}\n\n/**\n * Route an `ask_app` message to a *different* app's agent over A2A. Shared by\n * the workspace-resolved path and the org-directory-resolved path so the A2A\n * call logic is not duplicated. `origin` is the target app's A2A base\n * (workspace dev origin or the directory's `a2aUrl`); `id` is reported back.\n *\n * Throws on failure so the caller can be honest — it never falls back to this\n * app's agent and pretends it was the target.\n */\nasync function routeAskOverA2A(\n  origin: string,\n  id: string,\n  message: string,\n  options?: { durable?: boolean; maxWaitMs?: number },\n): Promise<\n  { app: string; routedVia: \"a2a\"; response: string } | AskAppTaskResult\n> {\n  if (options?.durable) {\n    return submitAskAppA2ATask(\n      { app: id, origin: agentNativeA2AEndpoint(origin), routedVia: \"a2a\" },\n      message,\n      options.maxWaitMs ?? ASK_APP_DEFAULT_INLINE_WAIT_MS,\n    );\n  }\n  const { callAgent } = await import(\"../a2a/client.js\");\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  // The MCP handler runs inside `runWithRequestContext`, so this is the\n  // verified caller identity and org scope. Reuse the same auth resolver as\n  // org-directory discovery so the directory lookup and actual A2A call are\n  // scoped the same way.\n  const auth = await resolveA2ACallerAuth();\n  const response = await callAgent(origin, message, {\n    apiKey: auth.apiKey,\n    userEmail: auth.userEmail,\n    orgDomain: auth.orgDomain,\n    orgSecret: auth.orgSecret,\n    // Bound the wait — cross-app A2A polls async by default.\n    timeoutMs: 5 * 60_000,\n  });\n  return { app: id, routedVia: \"a2a\", response };\n}\n\nasync function resolveAskAppStatusRoute(\n  config: MCPConfig,\n  requestedApp: string,\n  requestMeta?: AskAppRequestMeta,\n): Promise<AskAppRoute> {\n  const selfId = currentAppId(config);\n  const normalized = requestedApp.trim().toLowerCase();\n  const selfEndpointUrl = selfA2AEndpointUrl(requestMeta);\n\n  if (!normalized || normalized === selfId) {\n    if (!selfEndpointUrl) {\n      throw new Error(\n        \"ask_app_status requires a running app origin for local tasks.\",\n      );\n    }\n    return { app: selfId, origin: selfEndpointUrl, routedVia: \"local\" };\n  }\n\n  const targetApp = await resolveTargetAppOrigin(config, requestedApp);\n  if (targetApp) {\n    return {\n      app: targetApp.id,\n      origin: agentNativeA2AEndpoint(targetApp.origin),\n      routedVia: \"a2a\",\n    };\n  }\n\n  const orgApps = await fetchOrgApps({ selfId }).catch(() => [] as OrgApp[]);\n  const dirMatch = orgApps.find((a) => a.id === normalized);\n  if (dirMatch) {\n    return {\n      app: dirMatch.id,\n      origin: agentNativeA2AEndpoint(dirMatch.a2aUrl),\n      routedVia: \"a2a\",\n    };\n  }\n\n  throw new Error(`No reachable ask_app task route for app \"${requestedApp}\".`);\n}\n\n// ---------------------------------------------------------------------------\n// ask_app\n// ---------------------------------------------------------------------------\n\nfunction askAppTool(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Send a natural-language message to an app's AI agent and get its \" +\n        \"response. Use for complex, multi-step tasks needing the agent's \" +\n        \"reasoning and full app context. In a single-app project the 'app' \" +\n        \"param is optional (defaults to this app). When 'app' names a \" +\n        \"different workspace app it is routed there over A2A; the result's \" +\n        \"'routedVia' field reports whether it ran cross-app or locally. \" +\n        \"On hosted MCP, long tasks may return a durable taskId instead of a \" +\n        \"final response; call ask_app_status with that taskId until completed.\",\n      {\n        app: {\n          type: \"string\",\n          description: \"App id to route to (optional in a single-app project)\",\n        },\n        message: {\n          type: \"string\",\n          description: \"The message to send to the app's agent\",\n        },\n        async: {\n          type: \"boolean\",\n          description:\n            \"When true, start a durable task and return immediately with a taskId.\",\n        },\n        maxWaitMs: {\n          type: \"number\",\n          description:\n            \"Maximum time to wait inline before returning a taskId. Hosted MCP clamps this to 25000ms.\",\n        },\n      },\n      [\"message\"],\n    ),\n    run: async (args: Record<string, any>) => {\n      const message = String(args.message ?? \"\").trim();\n      if (!message) throw new Error(\"ask_app requires a 'message'.\");\n      const requestedApp = String(args.app ?? \"\").trim();\n      const selfId = currentAppId(config);\n      const useDurableA2A = Boolean(requestMeta?.origin);\n      const maxWaitMs = isExplicitAsyncAsk(args.async)\n        ? 0\n        : boundedAskAppWaitMs(args.maxWaitMs);\n\n      // Cross-app: the caller named a *different* workspace app. Route the\n      // message to THAT app's agent over A2A (its `/_agent-native/a2a`\n      // endpoint runs the real agent loop with JWT identity) rather than\n      // silently answering from this app's agent and claiming delegation.\n      const targetApp = await resolveTargetAppOrigin(config, requestedApp);\n      if (targetApp) {\n        try {\n          return await routeAskOverA2A(\n            targetApp.origin,\n            targetApp.id,\n            message,\n            {\n              durable: useDurableA2A,\n              maxWaitMs,\n            },\n          );\n        } catch (err: any) {\n          // Be honest: routing was attempted and failed — do NOT fall back to\n          // this app's agent and pretend it was the target.\n          throw new Error(\n            `Failed to route ask_app to \"${targetApp.id}\" via A2A: ` +\n              `${err?.message ?? err}`,\n          );\n        }\n      }\n\n      // Not a known local/workspace app — try the org directory. When a\n      // directory is configured and the requested app is one of the org's\n      // deployed sibling apps, route to it over A2A (same path as above,\n      // against its `a2aUrl`). Inactive directory / any failure ⇒ orgApps is\n      // [] and this is skipped, preserving the exact local-only behavior.\n      if (requestedApp && requestedApp.toLowerCase() !== selfId) {\n        const orgApps = await fetchOrgApps({ selfId }).catch(\n          () => [] as OrgApp[],\n        );\n        const dirMatch = orgApps.find(\n          (a) => a.id === requestedApp.toLowerCase(),\n        );\n        if (dirMatch) {\n          try {\n            return await routeAskOverA2A(\n              dirMatch.a2aUrl,\n              dirMatch.id,\n              message,\n              {\n                durable: useDurableA2A,\n                maxWaitMs,\n              },\n            );\n          } catch (err: any) {\n            throw new Error(\n              `Failed to route ask_app to \"${dirMatch.id}\" via A2A ` +\n                `(org directory): ${err?.message ?? err}`,\n            );\n          }\n        }\n      }\n\n      // Same app (or no workspace / unknown target): answer locally with this\n      // app's own ask-agent handler — the same entry point the HTTP MCP mount\n      // + A2A use, so there is no second agent runner.\n      if (!config.askAgent) {\n        throw new Error(\n          \"This app does not expose an agent (no ask-agent handler).\",\n        );\n      }\n\n      // If the caller named an app we couldn't route to (unknown id, or no\n      // workspace), say so honestly instead of claiming we reached it.\n      const unresolved =\n        !!requestedApp && requestedApp.toLowerCase() !== selfId;\n      const note = unresolved\n        ? `Requested app \"${requestedApp}\" is not a reachable workspace ` +\n          `app; answered with this app (\"${selfId}\") instead.`\n        : undefined;\n\n      // Hosted MCP cannot safely keep a JSON request/response open for a full\n      // agent loop: serverless gateways can return an inactivity 504 before\n      // the result body exists. When we know the running app origin, submit the\n      // local ask through the app's durable A2A task path and only wait a\n      // short bounded window for fast completions.\n      const localA2AEndpointUrl = selfA2AEndpointUrl(requestMeta);\n      if (localA2AEndpointUrl) {\n        return submitAskAppA2ATask(\n          {\n            app: selfId,\n            origin: localA2AEndpointUrl,\n            routedVia: \"local\",\n            ...(note ? { note } : {}),\n          },\n          message,\n          maxWaitMs,\n        );\n      }\n\n      const response = await config.askAgent(message);\n      return {\n        app: selfId,\n        routedVia: \"local\",\n        ...(note ? { note } : {}),\n        response,\n      };\n    },\n  };\n}\n\nfunction askAppStatusTool(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Poll a durable ask_app task and return its current status or final response.\",\n      {\n        app: {\n          type: \"string\",\n          description:\n            \"App id returned by ask_app. Optional for same-app local tasks.\",\n        },\n        taskId: {\n          type: \"string\",\n          description: \"The durable task id returned by ask_app.\",\n        },\n      },\n      [\"taskId\"],\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const taskId = String(args.taskId ?? \"\").trim();\n      if (!taskId) throw new Error(\"ask_app_status requires 'taskId'.\");\n      const requestedApp = String(args.app ?? \"\").trim();\n      const route = await resolveAskAppStatusRoute(\n        config,\n        requestedApp,\n        requestMeta,\n      );\n      return fetchAskAppA2ATask(route, taskId);\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// list_templates\n// ---------------------------------------------------------------------------\n\nfunction listTemplatesTool(): ActionEntry {\n  return {\n    tool: tool(\n      \"List the first-party templates that can be scaffolded into a workspace \" +\n        \"(allow-listed templates only).\",\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async () => {\n      const { visibleTemplates } = await import(\"../cli/templates-meta.js\");\n      return {\n        templates: visibleTemplates().map((t) => ({\n          name: t.name,\n          label: t.label,\n          hint: t.hint,\n        })),\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// create_workspace_app\n// ---------------------------------------------------------------------------\n\nfunction createWorkspaceAppTool(): ActionEntry {\n  return {\n    tool: tool(\n      \"Scaffold a new app into the current workspace from an allow-listed \" +\n        \"template, then return a deep link to open it. Idempotent: if an app \" +\n        \"with that name already exists it is reused.\",\n      {\n        name: {\n          type: \"string\",\n          description: \"New app id (directory under apps/), e.g. 'mymail'\",\n        },\n        template: {\n          type: \"string\",\n          description:\n            \"Template to scaffold from — must be allow-listed (see list_templates)\",\n        },\n      },\n      [\"name\", \"template\"],\n    ),\n    run: async (args: Record<string, any>) => {\n      const name = String(args.name ?? \"\").trim();\n      const template = String(args.template ?? \"\").trim();\n      if (!name || !template) {\n        throw new Error(\n          \"create_workspace_app requires both 'name' and 'template'.\",\n        );\n      }\n\n      // Enforce the strict public template allow-list. The authoritative,\n      // dependency-free source inside @agent-native/core is cli/templates-meta\n      // (kept in sync with packages/shared-app-config/templates.ts; CI guard).\n      const { visibleTemplates } = await import(\"../cli/templates-meta.js\");\n      const allowed = new Set(visibleTemplates().map((t) => t.name));\n      if (!allowed.has(template)) {\n        throw new Error(\n          `Template \"${template}\" is not allow-listed. Allowed: ${[...allowed]\n            .sort()\n            .join(\", \")}`,\n        );\n      }\n\n      const { findWorkspaceRoot, resolveWorkspace } =\n        await import(\"./workspace-resolve.js\");\n      const fs = await import(\"node:fs\");\n      const path = await import(\"node:path\");\n\n      const root = findWorkspaceRoot(process.cwd());\n      if (!root) {\n        throw new Error(\n          \"Not inside a workspace. create_workspace_app only works in a \" +\n            \"multi-app workspace (run from the workspace root).\",\n        );\n      }\n\n      const appDir = path.join(root, \"apps\", name);\n      const alreadyExisted = fs.existsSync(appDir);\n\n      if (!alreadyExisted) {\n        // Reuse the CLI scaffolder directly (no second `agent-native`\n        // subprocess). `addAppToWorkspace(name, { template })` takes the\n        // non-interactive single-template path when name + one template are\n        // given. Run it from the workspace root so detectWorkspace resolves.\n        const prevCwd = process.cwd();\n        try {\n          process.chdir(root);\n          const { addAppToWorkspace } = await import(\"../cli/create.js\");\n          await addAppToWorkspace(name, { template, noInstall: true });\n        } finally {\n          try {\n            process.chdir(prevCwd);\n          } catch {\n            // best-effort cwd restore\n          }\n        }\n      }\n\n      // The workspace gateway auto-detects new apps/* dirs (fs.watch +\n      // 2s sync) and lazily boots the dev server on first request, so we\n      // don't spawn vite ourselves — opening the deep link warms it. Resolve\n      // the port the gateway will use so we can report it.\n      const ws = await resolveWorkspace(root);\n      const appInfo = ws.apps.find((a) => a.id === name);\n      const port = appInfo?.port;\n      // The scaffolded app is always a *different* app from the host MCP\n      // server, so anchor the deep link to the new app's own origin. A\n      // relative path would otherwise be prefixed with the current request\n      // origin and land on the wrong app. Fall back to the relative path\n      // only if the gateway hasn't reported the new app's URL yet.\n      const relDeepLink = buildDeepLink({ app: name, view: \"home\" });\n      const deepLink = appInfo?.url\n        ? `${appInfo.url.replace(/\\/+$/, \"\")}${relDeepLink}`\n        : relDeepLink;\n\n      return {\n        name,\n        template,\n        created: !alreadyExisted,\n        reused: alreadyExisted,\n        port,\n        url: appInfo?.url,\n        gatewayUrl: ws.gatewayUrl,\n        deepLink,\n      };\n    },\n    link: ({ result }) => {\n      if (!result || typeof result !== \"object\") return null;\n      const r = result as { deepLink?: string; name?: string };\n      if (!r.deepLink) return null;\n      return {\n        url: r.deepLink,\n        label: `Open ${r.name ?? \"app\"}`,\n        view: \"home\",\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Registry\n// ---------------------------------------------------------------------------\n\n/**\n * Build the generic cross-app builtin tool registry. Called by\n * `createMCPServerForRequest`; the result is merged UNDER the config's\n * actions so template actions of the same name win.\n */\nexport function getBuiltinCrossAppTools(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): Record<string, ActionEntry> {\n  return {\n    list_apps: listAppsTool(config, requestMeta),\n    open_app: openAppTool(config, requestMeta),\n    create_embed_session: createEmbedSessionTool(requestMeta),\n    ask_app: askAppTool(config, requestMeta),\n    ask_app_status: askAppStatusTool(config, requestMeta),\n    create_workspace_app: createWorkspaceAppTool(),\n    list_templates: listTemplatesTool(),\n  };\n}\n"]}

package/dist/mcp/org-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-directory.d.ts","sourceRoot":"","sources":["../../src/mcp/org-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,WAAW,MAAM;IACrB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAeD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAcf;AA4DD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2EpB;AAED,0DAA0D;AAC1D,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}
+{"version":3,"file":"org-directory.d.ts","sourceRoot":"","sources":["../../src/mcp/org-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,WAAW,MAAM;IACrB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAeD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAcf;AAqED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgFpB;AAED,0DAA0D;AAC1D,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/dist/mcp/org-directory.js

@@ -116,6 +116,9 @@ function scopedCacheKey(origin, auth) {
         `org:${auth.orgId ?? auth.orgDomain ?? ""}`,
     ].join("|");
 }
+function authTokenAttempts(auth) {
+    return [auth.apiKey, ...(auth.apiKeyFallbacks ?? [])].filter((token) => typeof token === "string" && token.length > 0);
+}
 function serviceScopedCacheKey(origin, orgId) {
     return [origin, `service-org:${orgId}`].join("|");
 }
@@ -163,7 +166,8 @@ export async function fetchOrgApps(opts) {
         const auth = serviceOrgId
             ? await resolveOrgDirectoryServiceAuth(serviceOrgId)
             : await resolveOrgDirectoryCallerAuth();
-        if (!auth.apiKey) {
+        const attempts = authTokenAttempts(auth);
+        if (attempts.length === 0) {
             // No signed token available (no A2A secret / no caller identity) — the
             // directory requires the org bearer, so degrade silently to local-only.
             return [];
@@ -176,19 +180,24 @@ export async function fetchOrgApps(opts) {
                 return stripSelf(cached.apps);
             }
         }
-        const res = await fetch(`${origin}/_agent-native/org/apps`, {
-            method: "GET",
-            headers: {
-                Authorization: `Bearer ${auth.apiKey}`,
-                Accept: "application/json",
-            },
-            signal: AbortSignal.timeout(4000),
-        });
-        if (res.ok) {
-            const json = (await res.json());
-            const list = Array.isArray(json?.apps) ? json.apps : [];
-            apps = list.map(normalizeApp).filter((a) => a !== null);
-            ttl = SUCCESS_TTL_MS;
+        for (let i = 0; i < attempts.length; i++) {
+            const res = await fetch(`${origin}/_agent-native/org/apps`, {
+                method: "GET",
+                headers: {
+                    Authorization: `Bearer ${attempts[i]}`,
+                    Accept: "application/json",
+                },
+                signal: AbortSignal.timeout(4000),
+            });
+            if (res.ok) {
+                const json = (await res.json());
+                const list = Array.isArray(json?.apps) ? json.apps : [];
+                apps = list.map(normalizeApp).filter((a) => a !== null);
+                ttl = SUCCESS_TTL_MS;
+                break;
+            }
+            if (res.status !== 401 || i >= attempts.length - 1)
+                break;
         }
         // Non-2xx ⇒ leave apps=[] with the short EMPTY_TTL (silent degrade).
     }
@@ -235,12 +244,41 @@ async function resolveOrgDirectoryServiceAuth(orgId) {
             import("./connect-store.js"),
         ]);
         const userEmail = serviceIdentityEmail("mcp-client", trimmedOrgId);
-        const apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
-            expiresIn: "5m",
-            preferGlobalSecret: !orgSecret,
-            extraClaims: { org_id: trimmedOrgId },
-        });
-        return { apiKey, userEmail, orgId: trimmedOrgId, orgDomain };
+        const apiKeyAttempts = [];
+        const addApiKeyAttempt = (token) => {
+            if (!token || apiKeyAttempts.includes(token))
+                return;
+            apiKeyAttempts.push(token);
+        };
+        if (process.env.A2A_SECRET?.trim()) {
+            try {
+                addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, orgSecret, {
+                    expiresIn: "5m",
+                    preferGlobalSecret: true,
+                    extraClaims: { org_id: trimmedOrgId },
+                }));
+            }
+            catch { }
+        }
+        if (orgSecret) {
+            try {
+                addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, orgSecret, {
+                    expiresIn: "5m",
+                    preferGlobalSecret: false,
+                    extraClaims: { org_id: trimmedOrgId },
+                }));
+            }
+            catch { }
+        }
+        return {
+            apiKey: apiKeyAttempts[0],
+            ...(apiKeyAttempts.length > 1
+                ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }
+                : {}),
+            userEmail,
+            orgId: trimmedOrgId,
+            orgDomain,
+        };
     }
     catch {
         return { orgId: trimmedOrgId, orgDomain };

package/dist/mcp/org-directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"org-directory.js","sourceRoot":"","sources":["../../src/mcp/org-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAkBH,0DAA0D;AAC1D,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,8EAA8E;AAC9E,MAAM,YAAY,GAAG,MAAM,CAAC;AAO5B,6EAA6E;AAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GACP,GAAG,CAAC,8BAA8B,IAAI,GAAG,CAAC,6BAA6B,CAAC;IAC1E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,+DAA+D;QAC/D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GACV,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1E,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;QAChD,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,EAAE;QACF,IAAI;QACJ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,GAAG,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,MAAc,EACd,IAIC;IAED,OAAO;QACL,MAAM;QACN,QAAQ,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE;QAC9B,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE;KAC5C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,KAAa;IAC1D,OAAO,CAAC,MAAM,EAAE,eAAe,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAKlC;IACC,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC9C,wEAAwE;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnD,MAAM,SAAS,GAAG,CAAC,IAAc,EAAY,EAAE,CAC7C,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAChB,IAAI,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEL,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,IAAI,GAAG,GAAG,YAAY,CAAC;IACvB,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,QAAQ,GAAG,eAAe,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY;YACvB,CAAC,CAAC,MAAM,8BAA8B,CAAC,YAAY,CAAC;YACpD,CAAC,CAAC,MAAM,6BAA6B,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,uEAAuE;YACvE,wEAAwE;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yBAAyB,EAAE;YAC1D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;YACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACrE,GAAG,GAAG,cAAc,CAAC;QACvB,CAAC;QACD,qEAAqE;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,IAAI,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;YAClB,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,uBAAuB;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,6BAA6B;IAM1C,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAAa;IAMzD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5E,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;QAC5D,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrE,MAAM,CAAC,kBAAkB,CAAC;YAC1B,MAAM,CAAC,oBAAoB,CAAC;SAC7B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;YACjE,SAAS,EAAE,IAAI;YACf,kBAAkB,EAAE,CAAC,SAAS;YAC9B,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SACtC,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Org-directory discovery for the generic cross-app MCP verbs\n * (`list_apps` / `ask_app` in `builtin-tools.ts`).\n *\n * Phase 3b of cross-app auto-wiring. Today the cross-app verbs resolve sibling\n * apps from *local workspace* info only (`workspace-resolve.ts`), so the mail\n * agent can only reach the calendar agent in a local dev workspace. When the\n * deployment runs against an org directory (Dispatch is also the identity hub\n * for the org), this module discovers the org's *deployed* sibling apps so the\n * same verbs work cross-app in production with ZERO manual setup.\n *\n * ## The directory request\n *\n *   GET  <directoryOrigin>/_agent-native/org/apps\n *   Auth Authorization: Bearer <org A2A token>   (same signed token A2A peers\n *        already mint — reuses `resolveA2ACallerAuth()`; the org A2A secret /\n *        global `A2A_SECRET` is loaded exactly how outgoing A2A calls load it)\n *   ⇒    { org, apps: [ { id, name, url, a2aUrl, capabilities? } ] }\n *        (allow-listed first-party apps only, prod URLs — enforced by the\n *         authority side, Phase 3a, on Dispatch)\n *\n * ## Resolution + safety model\n *\n *   - The directory origin is read from env: `AGENT_NATIVE_ORG_DIRECTORY_URL`\n *     (dedicated) or `AGENT_NATIVE_IDENTITY_HUB_URL` (Dispatch is also the\n *     identity hub). When *neither* is set the feature is simply inactive —\n *     `fetchOrgApps()` returns `[]` and nothing changes anywhere (asserted by\n *     a test). This makes the whole feature opt-in and back-compat.\n *   - On ANY error (no env, unreachable, 401, non-2xx, bad JSON, no signed\n *     token) `fetchOrgApps()` returns `[]` and NEVER throws — the cross-app\n *     verbs degrade silently to their exact current local-only behavior.\n *   - A short in-memory TTL cache (default 60s) keyed by directory origin and\n *     caller identity/org scope so sibling app lists never cross tenants.\n *     Empty authenticated results are cached too (with a shorter TTL) so a\n *     transient failure doesn't hammer the directory on every call.\n *   - No secrets are ever logged.\n *\n * Bundled alongside `mountMCP` (no Node-only top-level imports). The A2A\n * caller-auth + a2a client are dynamically imported inside `fetchOrgApps()`.\n */\n\nexport interface OrgApp {\n  /** Canonical app id, e.g. `calendar`. */\n  id: string;\n  /** Human-readable name, e.g. `Calendar`. */\n  name: string;\n  /** Deployed app origin/URL, e.g. `https://calendar.acme.com`. */\n  url: string;\n  /**\n   * A2A endpoint to route `ask_app` to. The authority side returns this; we\n   * fall back to the app `url` (the A2A client appends `/_agent-native/a2a`).\n   */\n  a2aUrl: string;\n  /** Optional capability hints the authority side may include. */\n  capabilities?: string[];\n}\n\n/** Default cache TTL for a successful directory fetch. */\nconst SUCCESS_TTL_MS = 60_000;\n/** Shorter TTL for an empty/failed fetch so transient errors recover fast. */\nconst EMPTY_TTL_MS = 10_000;\n\ninterface CacheEntry {\n  apps: OrgApp[];\n  expiresAt: number;\n}\n\n/** In-memory cache keyed by resolved directory origin (+ identity scope). */\nconst cache = new Map<string, CacheEntry>();\n\n/**\n * Resolve the org-directory origin from env. Returns `null` when neither env\n * var is set — the caller treats `null` as \"feature inactive\".\n *\n * `env` is injectable for tests; defaults to `process.env`.\n */\nexport function resolveOrgDirectoryOrigin(\n  env: NodeJS.ProcessEnv = process.env,\n): string | null {\n  const raw =\n    env.AGENT_NATIVE_ORG_DIRECTORY_URL || env.AGENT_NATIVE_IDENTITY_HUB_URL;\n  if (!raw || typeof raw !== \"string\") return null;\n  const trimmed = raw.trim().replace(/\\/+$/, \"\");\n  if (!trimmed) return null;\n  try {\n    // Validate it's an absolute http(s) URL; reject anything else.\n    const u = new URL(trimmed);\n    if (u.protocol !== \"http:\" && u.protocol !== \"https:\") return null;\n    return trimmed;\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeApp(raw: unknown): OrgApp | null {\n  if (!raw || typeof raw !== \"object\") return null;\n  const r = raw as Record<string, unknown>;\n  const id = typeof r.id === \"string\" ? r.id.trim().toLowerCase() : \"\";\n  const url = typeof r.url === \"string\" ? r.url.trim() : \"\";\n  if (!id || !url) return null;\n  // Only accept absolute http(s) URLs from the directory.\n  try {\n    const u = new URL(url);\n    if (u.protocol !== \"http:\" && u.protocol !== \"https:\") return null;\n  } catch {\n    return null;\n  }\n  const name = typeof r.name === \"string\" && r.name.trim() ? r.name.trim() : id;\n  const a2aUrl =\n    typeof r.a2aUrl === \"string\" && r.a2aUrl.trim() ? r.a2aUrl.trim() : url;\n  const capabilities = Array.isArray(r.capabilities)\n    ? r.capabilities.filter((c): c is string => typeof c === \"string\")\n    : undefined;\n  return {\n    id,\n    name,\n    url: url.replace(/\\/+$/, \"\"),\n    a2aUrl: a2aUrl.replace(/\\/+$/, \"\"),\n    ...(capabilities && capabilities.length ? { capabilities } : {}),\n  };\n}\n\n/** Compare two origins by host (ignores trailing slash / protocol noise). */\nfunction sameOrigin(a: string, b: string): boolean {\n  try {\n    const ua = new URL(a);\n    const ub = new URL(b);\n    return ua.host === ub.host && ua.protocol === ub.protocol;\n  } catch {\n    return a.replace(/\\/+$/, \"\") === b.replace(/\\/+$/, \"\");\n  }\n}\n\nfunction scopedCacheKey(\n  origin: string,\n  auth: {\n    userEmail?: string;\n    orgId?: string;\n    orgDomain?: string;\n  },\n): string {\n  return [\n    origin,\n    `user:${auth.userEmail ?? \"\"}`,\n    `org:${auth.orgId ?? auth.orgDomain ?? \"\"}`,\n  ].join(\"|\");\n}\n\nfunction serviceScopedCacheKey(origin: string, orgId: string): string {\n  return [origin, `service-org:${orgId}`].join(\"|\");\n}\n\n/**\n * Fetch the org's first-party sibling apps from the org directory.\n *\n * - Returns `[]` (never throws) on ANY failure or when the directory env is\n *   unset — the cross-app verbs then keep their exact local-only behavior.\n * - Short in-memory TTL cache so it isn't fetched on every tool call.\n * - Strips the current app from the result (compared by id and by origin) so\n *   `list_apps` / `ask_app` never offer to route to themselves.\n *\n * @param opts.selfId      Current app id (so it's stripped from the result).\n * @param opts.selfOrigin  Current app origin (so it's stripped by origin too).\n * @param opts.env         Injectable env (tests). Defaults to `process.env`.\n */\nexport async function fetchOrgApps(opts?: {\n  selfId?: string;\n  selfOrigin?: string;\n  serviceOrgId?: string;\n  env?: NodeJS.ProcessEnv;\n}): Promise<OrgApp[]> {\n  const env = opts?.env ?? process.env;\n  const origin = resolveOrgDirectoryOrigin(env);\n  // Feature inactive: no directory configured ⇒ behave exactly as before.\n  if (!origin) return [];\n\n  const selfId = (opts?.selfId ?? \"\").trim().toLowerCase();\n  const selfOrigin = (opts?.selfOrigin ?? \"\").trim();\n\n  const stripSelf = (apps: OrgApp[]): OrgApp[] =>\n    apps.filter((a) => {\n      if (selfId && a.id === selfId) return false;\n      if (selfOrigin && sameOrigin(a.url, selfOrigin)) return false;\n      return true;\n    });\n\n  let cacheKey: string | null = null;\n  let apps: OrgApp[] = [];\n  let ttl = EMPTY_TTL_MS;\n  const serviceOrgId = opts?.serviceOrgId?.trim();\n  if (serviceOrgId) {\n    const serviceCacheKey = serviceScopedCacheKey(origin, serviceOrgId);\n    const cached = cache.get(serviceCacheKey);\n    if (cached && cached.expiresAt > Date.now()) {\n      return stripSelf(cached.apps);\n    }\n    cacheKey = serviceCacheKey;\n  }\n  try {\n    const auth = serviceOrgId\n      ? await resolveOrgDirectoryServiceAuth(serviceOrgId)\n      : await resolveOrgDirectoryCallerAuth();\n    if (!auth.apiKey) {\n      // No signed token available (no A2A secret / no caller identity) — the\n      // directory requires the org bearer, so degrade silently to local-only.\n      return [];\n    }\n\n    if (!cacheKey) {\n      const now = Date.now();\n      cacheKey = scopedCacheKey(origin, auth);\n      const cached = cache.get(cacheKey);\n      if (cached && cached.expiresAt > now) {\n        return stripSelf(cached.apps);\n      }\n    }\n\n    const res = await fetch(`${origin}/_agent-native/org/apps`, {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${auth.apiKey}`,\n        Accept: \"application/json\",\n      },\n      signal: AbortSignal.timeout(4000),\n    });\n    if (res.ok) {\n      const json = (await res.json()) as { apps?: unknown };\n      const list = Array.isArray(json?.apps) ? json.apps : [];\n      apps = list.map(normalizeApp).filter((a): a is OrgApp => a !== null);\n      ttl = SUCCESS_TTL_MS;\n    }\n    // Non-2xx ⇒ leave apps=[] with the short EMPTY_TTL (silent degrade).\n  } catch {\n    // Unreachable / parse error / abort ⇒ silent degrade to local-only.\n    apps = [];\n    ttl = EMPTY_TTL_MS;\n  }\n\n  if (cacheKey) {\n    cache.set(cacheKey, {\n      apps,\n      expiresAt: Date.now() + ttl,\n    });\n  }\n  return stripSelf(apps);\n}\n\n/** Test-only: clear the in-memory cache between cases. */\nexport function _resetOrgDirectoryCache(): void {\n  cache.clear();\n}\n\nasync function resolveOrgDirectoryCallerAuth(): Promise<{\n  apiKey?: string;\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n}> {\n  // Reuse the existing A2A caller-auth: it reads userEmail + orgId from the\n  // request context, loads the org A2A secret via getOrgA2ASecret (falling\n  // back to the global A2A_SECRET env), and signs the same bearer JWT A2A\n  // peers already use. No new secret loading is invented for normal callers.\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  return resolveA2ACallerAuth();\n}\n\nasync function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{\n  apiKey?: string;\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n}> {\n  const trimmedOrgId = orgId.trim();\n  if (!trimmedOrgId) return {};\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  try {\n    const { getOrgDomain, getOrgA2ASecret } = await import(\"../org/context.js\");\n    orgDomain = (await getOrgDomain(trimmedOrgId)) ?? undefined;\n    orgSecret = (await getOrgA2ASecret(trimmedOrgId)) ?? undefined;\n  } catch {}\n  try {\n    const [{ signA2AToken }, { serviceIdentityEmail }] = await Promise.all([\n      import(\"../a2a/client.js\"),\n      import(\"./connect-store.js\"),\n    ]);\n    const userEmail = serviceIdentityEmail(\"mcp-client\", trimmedOrgId);\n    const apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {\n      expiresIn: \"5m\",\n      preferGlobalSecret: !orgSecret,\n      extraClaims: { org_id: trimmedOrgId },\n    });\n    return { apiKey, userEmail, orgId: trimmedOrgId, orgDomain };\n  } catch {\n    return { orgId: trimmedOrgId, orgDomain };\n  }\n}\n"]}
+{"version":3,"file":"org-directory.js","sourceRoot":"","sources":["../../src/mcp/org-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAkBH,0DAA0D;AAC1D,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,8EAA8E;AAC9E,MAAM,YAAY,GAAG,MAAM,CAAC;AAO5B,6EAA6E;AAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GACP,GAAG,CAAC,8BAA8B,IAAI,GAAG,CAAC,6BAA6B,CAAC;IAC1E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,+DAA+D;QAC/D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,wDAAwD;IACxD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,MAAM,GACV,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1E,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;QAChD,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,EAAE;QACF,IAAI;QACJ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,GAAG,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,MAAc,EACd,IAIC;IAED,OAAO;QACL,MAAM;QACN,QAAQ,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE;QAC9B,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE;KAC5C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,IAG1B;IACC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAC1D,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,KAAa;IAC1D,OAAO,CAAC,MAAM,EAAE,eAAe,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAKlC;IACC,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACrC,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC9C,wEAAwE;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnD,MAAM,SAAS,GAAG,CAAC,IAAc,EAAY,EAAE,CAC7C,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAChB,IAAI,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEL,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,IAAI,GAAG,GAAG,YAAY,CAAC;IACvB,MAAM,YAAY,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,QAAQ,GAAG,eAAe,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY;YACvB,CAAC,CAAC,MAAM,8BAA8B,CAAC,YAAY,CAAC;YACpD,CAAC,CAAC,MAAM,6BAA6B,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,uEAAuE;YACvE,wEAAwE;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBACrC,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yBAAyB,EAAE;gBAC1D,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC,EAAE;oBACtC,MAAM,EAAE,kBAAkB;iBAC3B;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;gBACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;gBACrE,GAAG,GAAG,cAAc,CAAC;gBACrB,MAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM;QAC5D,CAAC;QACD,qEAAqE;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,IAAI,GAAG,EAAE,CAAC;QACV,GAAG,GAAG,YAAY,CAAC;IACrB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;YAClB,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,uBAAuB;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,6BAA6B;IAO1C,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAAa;IAOzD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5E,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;QAC5D,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrE,MAAM,CAAC,kBAAkB,CAAC;YAC1B,MAAM,CAAC,oBAAoB,CAAC;SAC7B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACnE,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAAE,EAAE;YACrD,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO;YACrD,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC,CAAC;QACF,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,gBAAgB,CACd,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;oBAClD,SAAS,EAAE,IAAI;oBACf,kBAAkB,EAAE,IAAI;oBACxB,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;iBACtC,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,gBAAgB,CACd,MAAM,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE;oBAClD,SAAS,EAAE,IAAI;oBACf,kBAAkB,EAAE,KAAK;oBACzB,WAAW,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;iBACtC,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;YACzB,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC3B,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,SAAS;YACT,KAAK,EAAE,YAAY;YACnB,SAAS;SACV,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Org-directory discovery for the generic cross-app MCP verbs\n * (`list_apps` / `ask_app` in `builtin-tools.ts`).\n *\n * Phase 3b of cross-app auto-wiring. Today the cross-app verbs resolve sibling\n * apps from *local workspace* info only (`workspace-resolve.ts`), so the mail\n * agent can only reach the calendar agent in a local dev workspace. When the\n * deployment runs against an org directory (Dispatch is also the identity hub\n * for the org), this module discovers the org's *deployed* sibling apps so the\n * same verbs work cross-app in production with ZERO manual setup.\n *\n * ## The directory request\n *\n *   GET  <directoryOrigin>/_agent-native/org/apps\n *   Auth Authorization: Bearer <org A2A token>   (same signed token A2A peers\n *        already mint — reuses `resolveA2ACallerAuth()`; the org A2A secret /\n *        global `A2A_SECRET` is loaded exactly how outgoing A2A calls load it)\n *   ⇒    { org, apps: [ { id, name, url, a2aUrl, capabilities? } ] }\n *        (allow-listed first-party apps only, prod URLs — enforced by the\n *         authority side, Phase 3a, on Dispatch)\n *\n * ## Resolution + safety model\n *\n *   - The directory origin is read from env: `AGENT_NATIVE_ORG_DIRECTORY_URL`\n *     (dedicated) or `AGENT_NATIVE_IDENTITY_HUB_URL` (Dispatch is also the\n *     identity hub). When *neither* is set the feature is simply inactive —\n *     `fetchOrgApps()` returns `[]` and nothing changes anywhere (asserted by\n *     a test). This makes the whole feature opt-in and back-compat.\n *   - On ANY error (no env, unreachable, 401, non-2xx, bad JSON, no signed\n *     token) `fetchOrgApps()` returns `[]` and NEVER throws — the cross-app\n *     verbs degrade silently to their exact current local-only behavior.\n *   - A short in-memory TTL cache (default 60s) keyed by directory origin and\n *     caller identity/org scope so sibling app lists never cross tenants.\n *     Empty authenticated results are cached too (with a shorter TTL) so a\n *     transient failure doesn't hammer the directory on every call.\n *   - No secrets are ever logged.\n *\n * Bundled alongside `mountMCP` (no Node-only top-level imports). The A2A\n * caller-auth + a2a client are dynamically imported inside `fetchOrgApps()`.\n */\n\nexport interface OrgApp {\n  /** Canonical app id, e.g. `calendar`. */\n  id: string;\n  /** Human-readable name, e.g. `Calendar`. */\n  name: string;\n  /** Deployed app origin/URL, e.g. `https://calendar.acme.com`. */\n  url: string;\n  /**\n   * A2A endpoint to route `ask_app` to. The authority side returns this; we\n   * fall back to the app `url` (the A2A client appends `/_agent-native/a2a`).\n   */\n  a2aUrl: string;\n  /** Optional capability hints the authority side may include. */\n  capabilities?: string[];\n}\n\n/** Default cache TTL for a successful directory fetch. */\nconst SUCCESS_TTL_MS = 60_000;\n/** Shorter TTL for an empty/failed fetch so transient errors recover fast. */\nconst EMPTY_TTL_MS = 10_000;\n\ninterface CacheEntry {\n  apps: OrgApp[];\n  expiresAt: number;\n}\n\n/** In-memory cache keyed by resolved directory origin (+ identity scope). */\nconst cache = new Map<string, CacheEntry>();\n\n/**\n * Resolve the org-directory origin from env. Returns `null` when neither env\n * var is set — the caller treats `null` as \"feature inactive\".\n *\n * `env` is injectable for tests; defaults to `process.env`.\n */\nexport function resolveOrgDirectoryOrigin(\n  env: NodeJS.ProcessEnv = process.env,\n): string | null {\n  const raw =\n    env.AGENT_NATIVE_ORG_DIRECTORY_URL || env.AGENT_NATIVE_IDENTITY_HUB_URL;\n  if (!raw || typeof raw !== \"string\") return null;\n  const trimmed = raw.trim().replace(/\\/+$/, \"\");\n  if (!trimmed) return null;\n  try {\n    // Validate it's an absolute http(s) URL; reject anything else.\n    const u = new URL(trimmed);\n    if (u.protocol !== \"http:\" && u.protocol !== \"https:\") return null;\n    return trimmed;\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeApp(raw: unknown): OrgApp | null {\n  if (!raw || typeof raw !== \"object\") return null;\n  const r = raw as Record<string, unknown>;\n  const id = typeof r.id === \"string\" ? r.id.trim().toLowerCase() : \"\";\n  const url = typeof r.url === \"string\" ? r.url.trim() : \"\";\n  if (!id || !url) return null;\n  // Only accept absolute http(s) URLs from the directory.\n  try {\n    const u = new URL(url);\n    if (u.protocol !== \"http:\" && u.protocol !== \"https:\") return null;\n  } catch {\n    return null;\n  }\n  const name = typeof r.name === \"string\" && r.name.trim() ? r.name.trim() : id;\n  const a2aUrl =\n    typeof r.a2aUrl === \"string\" && r.a2aUrl.trim() ? r.a2aUrl.trim() : url;\n  const capabilities = Array.isArray(r.capabilities)\n    ? r.capabilities.filter((c): c is string => typeof c === \"string\")\n    : undefined;\n  return {\n    id,\n    name,\n    url: url.replace(/\\/+$/, \"\"),\n    a2aUrl: a2aUrl.replace(/\\/+$/, \"\"),\n    ...(capabilities && capabilities.length ? { capabilities } : {}),\n  };\n}\n\n/** Compare two origins by host (ignores trailing slash / protocol noise). */\nfunction sameOrigin(a: string, b: string): boolean {\n  try {\n    const ua = new URL(a);\n    const ub = new URL(b);\n    return ua.host === ub.host && ua.protocol === ub.protocol;\n  } catch {\n    return a.replace(/\\/+$/, \"\") === b.replace(/\\/+$/, \"\");\n  }\n}\n\nfunction scopedCacheKey(\n  origin: string,\n  auth: {\n    userEmail?: string;\n    orgId?: string;\n    orgDomain?: string;\n  },\n): string {\n  return [\n    origin,\n    `user:${auth.userEmail ?? \"\"}`,\n    `org:${auth.orgId ?? auth.orgDomain ?? \"\"}`,\n  ].join(\"|\");\n}\n\nfunction authTokenAttempts(auth: {\n  apiKey?: string;\n  apiKeyFallbacks?: string[];\n}): string[] {\n  return [auth.apiKey, ...(auth.apiKeyFallbacks ?? [])].filter(\n    (token): token is string => typeof token === \"string\" && token.length > 0,\n  );\n}\n\nfunction serviceScopedCacheKey(origin: string, orgId: string): string {\n  return [origin, `service-org:${orgId}`].join(\"|\");\n}\n\n/**\n * Fetch the org's first-party sibling apps from the org directory.\n *\n * - Returns `[]` (never throws) on ANY failure or when the directory env is\n *   unset — the cross-app verbs then keep their exact local-only behavior.\n * - Short in-memory TTL cache so it isn't fetched on every tool call.\n * - Strips the current app from the result (compared by id and by origin) so\n *   `list_apps` / `ask_app` never offer to route to themselves.\n *\n * @param opts.selfId      Current app id (so it's stripped from the result).\n * @param opts.selfOrigin  Current app origin (so it's stripped by origin too).\n * @param opts.env         Injectable env (tests). Defaults to `process.env`.\n */\nexport async function fetchOrgApps(opts?: {\n  selfId?: string;\n  selfOrigin?: string;\n  serviceOrgId?: string;\n  env?: NodeJS.ProcessEnv;\n}): Promise<OrgApp[]> {\n  const env = opts?.env ?? process.env;\n  const origin = resolveOrgDirectoryOrigin(env);\n  // Feature inactive: no directory configured ⇒ behave exactly as before.\n  if (!origin) return [];\n\n  const selfId = (opts?.selfId ?? \"\").trim().toLowerCase();\n  const selfOrigin = (opts?.selfOrigin ?? \"\").trim();\n\n  const stripSelf = (apps: OrgApp[]): OrgApp[] =>\n    apps.filter((a) => {\n      if (selfId && a.id === selfId) return false;\n      if (selfOrigin && sameOrigin(a.url, selfOrigin)) return false;\n      return true;\n    });\n\n  let cacheKey: string | null = null;\n  let apps: OrgApp[] = [];\n  let ttl = EMPTY_TTL_MS;\n  const serviceOrgId = opts?.serviceOrgId?.trim();\n  if (serviceOrgId) {\n    const serviceCacheKey = serviceScopedCacheKey(origin, serviceOrgId);\n    const cached = cache.get(serviceCacheKey);\n    if (cached && cached.expiresAt > Date.now()) {\n      return stripSelf(cached.apps);\n    }\n    cacheKey = serviceCacheKey;\n  }\n  try {\n    const auth = serviceOrgId\n      ? await resolveOrgDirectoryServiceAuth(serviceOrgId)\n      : await resolveOrgDirectoryCallerAuth();\n    const attempts = authTokenAttempts(auth);\n    if (attempts.length === 0) {\n      // No signed token available (no A2A secret / no caller identity) — the\n      // directory requires the org bearer, so degrade silently to local-only.\n      return [];\n    }\n\n    if (!cacheKey) {\n      const now = Date.now();\n      cacheKey = scopedCacheKey(origin, auth);\n      const cached = cache.get(cacheKey);\n      if (cached && cached.expiresAt > now) {\n        return stripSelf(cached.apps);\n      }\n    }\n\n    for (let i = 0; i < attempts.length; i++) {\n      const res = await fetch(`${origin}/_agent-native/org/apps`, {\n        method: \"GET\",\n        headers: {\n          Authorization: `Bearer ${attempts[i]}`,\n          Accept: \"application/json\",\n        },\n        signal: AbortSignal.timeout(4000),\n      });\n      if (res.ok) {\n        const json = (await res.json()) as { apps?: unknown };\n        const list = Array.isArray(json?.apps) ? json.apps : [];\n        apps = list.map(normalizeApp).filter((a): a is OrgApp => a !== null);\n        ttl = SUCCESS_TTL_MS;\n        break;\n      }\n      if (res.status !== 401 || i >= attempts.length - 1) break;\n    }\n    // Non-2xx ⇒ leave apps=[] with the short EMPTY_TTL (silent degrade).\n  } catch {\n    // Unreachable / parse error / abort ⇒ silent degrade to local-only.\n    apps = [];\n    ttl = EMPTY_TTL_MS;\n  }\n\n  if (cacheKey) {\n    cache.set(cacheKey, {\n      apps,\n      expiresAt: Date.now() + ttl,\n    });\n  }\n  return stripSelf(apps);\n}\n\n/** Test-only: clear the in-memory cache between cases. */\nexport function _resetOrgDirectoryCache(): void {\n  cache.clear();\n}\n\nasync function resolveOrgDirectoryCallerAuth(): Promise<{\n  apiKey?: string;\n  apiKeyFallbacks?: string[];\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n}> {\n  // Reuse the existing A2A caller-auth: it reads userEmail + orgId from the\n  // request context, loads the org A2A secret via getOrgA2ASecret (falling\n  // back to the global A2A_SECRET env), and signs the same bearer JWT A2A\n  // peers already use. No new secret loading is invented for normal callers.\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  return resolveA2ACallerAuth();\n}\n\nasync function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{\n  apiKey?: string;\n  apiKeyFallbacks?: string[];\n  userEmail?: string;\n  orgId?: string;\n  orgDomain?: string;\n}> {\n  const trimmedOrgId = orgId.trim();\n  if (!trimmedOrgId) return {};\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  try {\n    const { getOrgDomain, getOrgA2ASecret } = await import(\"../org/context.js\");\n    orgDomain = (await getOrgDomain(trimmedOrgId)) ?? undefined;\n    orgSecret = (await getOrgA2ASecret(trimmedOrgId)) ?? undefined;\n  } catch {}\n  try {\n    const [{ signA2AToken }, { serviceIdentityEmail }] = await Promise.all([\n      import(\"../a2a/client.js\"),\n      import(\"./connect-store.js\"),\n    ]);\n    const userEmail = serviceIdentityEmail(\"mcp-client\", trimmedOrgId);\n    const apiKeyAttempts: string[] = [];\n    const addApiKeyAttempt = (token: string | undefined) => {\n      if (!token || apiKeyAttempts.includes(token)) return;\n      apiKeyAttempts.push(token);\n    };\n    if (process.env.A2A_SECRET?.trim()) {\n      try {\n        addApiKeyAttempt(\n          await signA2AToken(userEmail, orgDomain, orgSecret, {\n            expiresIn: \"5m\",\n            preferGlobalSecret: true,\n            extraClaims: { org_id: trimmedOrgId },\n          }),\n        );\n      } catch {}\n    }\n    if (orgSecret) {\n      try {\n        addApiKeyAttempt(\n          await signA2AToken(userEmail, orgDomain, orgSecret, {\n            expiresIn: \"5m\",\n            preferGlobalSecret: false,\n            extraClaims: { org_id: trimmedOrgId },\n          }),\n        );\n      } catch {}\n    }\n    return {\n      apiKey: apiKeyAttempts[0],\n      ...(apiKeyAttempts.length > 1\n        ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }\n        : {}),\n      userEmail,\n      orgId: trimmedOrgId,\n      orgDomain,\n    };\n  } catch {\n    return { orgId: trimmedOrgId, orgDomain };\n  }\n}\n"]}

package/dist/notifications/channels.d.ts

@@ -10,6 +10,16 @@
  *                              value never enters the agent context.
  * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also
  *                              supports `${keys.NAME}`).
+ * NOTIFICATIONS_SLACK_WEBHOOK_URL
+ *                            → POST notifications to a Slack incoming webhook.
+ *                              Supports `${keys.NAME}` substitution.
+ * NOTIFICATIONS_EMAIL_CHANNEL=1
+ *                            → enable the built-in email channel for
+ *                              per-notification recipients.
+ * NOTIFICATIONS_EMAIL_RECIPIENTS
+ *                            → comma-separated fallback recipients for email
+ *                              notifications that do not pass
+ *                              `metadata.emailRecipients`.
  */
 export declare function registerBuiltinNotificationChannels(): void;
 //# sourceMappingURL=channels.d.ts.map

package/dist/notifications/channels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../../src/notifications/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,wBAAgB,mCAAmC,IAAI,IAAI,CAQ1D"}
+{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../../src/notifications/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH,wBAAgB,mCAAmC,IAAI,IAAI,CAkB1D"}