@agent-native/core 0.9.1 → 0.10.0

package/dist/deploy/workspace-core.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-core.js","sourceRoot":"","sources":["../../src/deploy/workspace-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,IAAI,GAAoC,CAAC;AACzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC,GAAG;QAAE,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AA6BD,IAAI,KAAuE,CAAC;AAE5E;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB;IAEhB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,wDAAwD;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;gBACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxD,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iBAAiB,CAC9B,aAAqB,EACrB,WAAmB;IAEnB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IAEzB,gCAAgC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1E,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,qBAAqB;IACrB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACjC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,EAAE,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,qBAAqB,CAClC,UAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IACzB,MAAM,GAAG,GAAwC,EAAE,CAAC;IAEpD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;KAC3C,CAAC;IAEF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACrC,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IAExB,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,eAAe,GAAiC;QACpD,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,aAAa,EAAE,CAAC,kBAAkB,CAAC;QACnC,YAAY,EAAE,CAAC,oBAAoB,CAAC;QACpC,GAAG,EAAE,CAAC,WAAW,CAAC;QAClB,SAAS,EAAE,CAAC,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAGvD,EAAE,CAAC;QACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,gBAAgB;YAChB,wBAAwB;YACxB,iCAAiC;YACjC,2BAA2B;YAC3B,oBAAoB;YACpB,2BAA2B;YAC3B,MAAM,QAAQ,GAAG;gBACf,IAAI,MAAM,CAAC,sBAAsB,IAAI,KAAK,EAAE,GAAG,CAAC;gBAChD,IAAI,MAAM,CAAC,uCAAuC,IAAI,KAAK,EAAE,GAAG,CAAC;gBACjE,IAAI,MAAM,CAAC,yBAAyB,IAAI,cAAc,EAAE,GAAG,CAAC;aAC7D,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAEpD,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IAEzB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CACxC,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,WAAW,CACrB,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,GACb;QACE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;KAChC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAExD,MAAM,MAAM,GAAyB;QACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU;QACV,OAAO;QACP,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS;QACT,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;IAEF,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,wBAAwB;IACtC,KAAK,GAAG,SAAS,CAAC;AACpB,CAAC","sourcesContent":["/**\n * Workspace-core discovery.\n *\n * An enterprise can sit many agent-native apps in one monorepo alongside a\n * private workspace shared package that can provide shared plugins, skills,\n * actions, and AGENTS.md. Apps inherit everything from\n * the shared package without writing any boilerplate — this is the\n * middle layer of the three-layer inheritance model:\n *\n *   1. app local           (highest priority — app's own server/plugins/, actions/, etc.)\n *   2. workspace core      (middle — packages/shared/ in the enterprise monorepo)\n *   3. @agent-native/core  (lowest — framework defaults)\n *\n * Discovery works by walking up from the build cwd looking for a package.json\n * that declares `\"agent-native\": { \"workspaceCore\": \"@company/shared\" }`.\n * The declared package is then resolved through the monorepo's node_modules,\n * and its directory structure is probed for the standard layout:\n *\n *   packages/shared/\n *     package.json\n *     src/server/index.ts  (exports <slot>Plugin for any slot it wants to provide)\n *     actions/             (shared agent-callable actions)\n *     .agents/skills/      (shared skills)\n *     AGENTS.md            (enterprise-wide agent instructions)\n *     src/client/         (optional shared React code)\n */\nimport path from \"path\";\n\nlet _fs: typeof import(\"fs\") | undefined;\nasync function getFs(): Promise<typeof import(\"fs\")> {\n  if (!_fs) _fs = await import(\"node:fs\");\n  return _fs;\n}\n\n/** Mirrors DEFAULT_PLUGIN_REGISTRY's slot names. */\nexport type PluginSlot =\n  | \"agent-chat\"\n  | \"auth\"\n  | \"core-routes\"\n  | \"integrations\"\n  | \"org\"\n  | \"resources\"\n  | \"terminal\";\n\nexport interface WorkspaceCoreExports {\n  /** Absolute path of the monorepo root (the dir containing the root package.json). */\n  workspaceRoot: string;\n  /** Resolved package name — e.g. \"@my-company/shared\". */\n  packageName: string;\n  /** Absolute path to the workspace core package's root directory. */\n  packageDir: string;\n  /** Plugin slot → export name (if the workspace core declares an override for that slot). */\n  plugins: Partial<Record<PluginSlot, string>>;\n  /** Absolute path to the workspace core's actions/ directory, or null if it doesn't have one. */\n  actionsDir: string | null;\n  /** Absolute path to the workspace core's skills/ directory, or null. */\n  skillsDir: string | null;\n  /** Absolute path to the workspace core's AGENTS.md, or null. */\n  agentsMdPath: string | null;\n}\n\nlet cache: { cwd: string; result: WorkspaceCoreExports | null } | undefined;\n\n/**\n * Walk up from startDir looking for a directory whose package.json has an\n * `agent-native.workspaceCore` field. Returns both the root dir and the\n * declared package name, or null if there's no workspace core in the tree.\n */\nasync function findWorkspaceRoot(\n  startDir: string,\n): Promise<{ workspaceRoot: string; packageName: string } | null> {\n  const fs = await getFs();\n  let dir = path.resolve(startDir);\n  // Hard stop at filesystem root to avoid infinite loops.\n  for (let i = 0; i < 20; i++) {\n    const pkgPath = path.join(dir, \"package.json\");\n    if (fs.existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n        const declared = pkg?.[\"agent-native\"]?.workspaceCore;\n        if (typeof declared === \"string\" && declared.length > 0) {\n          return { workspaceRoot: dir, packageName: declared };\n        }\n      } catch {\n        // Malformed package.json — keep walking up.\n      }\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Resolve a workspace package name to its directory inside the monorepo.\n * Tries in order:\n *   1. <workspaceRoot>/node_modules/<packageName>/package.json (pnpm symlink)\n *   2. For each dir under <workspaceRoot>/packages/*, read its package.json\n *      and match on `name`.\n *   3. For each dir under <workspaceRoot>/packages/*\\/*, same match.\n *\n * The pnpm symlink approach is fastest when deps are installed; the direct\n * scan is a fallback for pre-install scenarios (e.g. running tests before\n * the first `pnpm install` in a scaffolded workspace).\n */\nasync function resolvePackageDir(\n  workspaceRoot: string,\n  packageName: string,\n): Promise<string | null> {\n  const fs = await getFs();\n\n  // 1) pnpm / npm install symlink\n  const nmCandidate = path.join(workspaceRoot, \"node_modules\", packageName);\n  if (fs.existsSync(path.join(nmCandidate, \"package.json\"))) {\n    return nmCandidate;\n  }\n\n  // 2) scan packages/*\n  const packagesDir = path.join(workspaceRoot, \"packages\");\n  const candidates: string[] = [];\n  if (fs.existsSync(packagesDir)) {\n    for (const entry of fs.readdirSync(packagesDir, { withFileTypes: true })) {\n      if (!entry.isDirectory()) continue;\n      candidates.push(path.join(packagesDir, entry.name));\n    }\n  }\n\n  // 3) scan packages/*/*  (for scoped layouts like packages/@company/shared)\n  if (fs.existsSync(packagesDir)) {\n    for (const entry of fs.readdirSync(packagesDir, { withFileTypes: true })) {\n      if (!entry.isDirectory() || !entry.name.startsWith(\"@\")) continue;\n      const scopeDir = path.join(packagesDir, entry.name);\n      for (const sub of fs.readdirSync(scopeDir, { withFileTypes: true })) {\n        if (!sub.isDirectory()) continue;\n        candidates.push(path.join(scopeDir, sub.name));\n      }\n    }\n  }\n\n  for (const candidate of candidates) {\n    const pkgPath = path.join(candidate, \"package.json\");\n    if (!fs.existsSync(pkgPath)) continue;\n    try {\n      const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n      if (pkg?.name === packageName) return candidate;\n    } catch {\n      // ignore\n    }\n  }\n  return null;\n}\n\n/**\n * Probe a workspace core package directory to discover which plugin slots it\n * exports. We read its package.json `exports` field + peek at\n * `src/server/index.ts` (or dist/server/index.js) looking for exports of the\n * form `<slot>Plugin` — the same convention the core server index uses.\n */\nasync function discoverPluginExports(\n  packageDir: string,\n): Promise<Partial<Record<PluginSlot, string>>> {\n  const fs = await getFs();\n  const out: Partial<Record<PluginSlot, string>> = {};\n\n  const candidates = [\n    path.join(packageDir, \"src\", \"server\", \"index.ts\"),\n    path.join(packageDir, \"dist\", \"server\", \"index.js\"),\n    path.join(packageDir, \"src\", \"server.ts\"),\n    path.join(packageDir, \"dist\", \"server.js\"),\n  ];\n\n  let source = \"\";\n  for (const c of candidates) {\n    if (fs.existsSync(c)) {\n      try {\n        source = fs.readFileSync(c, \"utf-8\");\n        break;\n      } catch {\n        // keep trying\n      }\n    }\n  }\n  if (!source) return out;\n\n  // Map slot name → export name we're looking for. \"agent-chat\" has a hyphen,\n  // so we probe both the camelCase and dash-free variants.\n  const slotExportNames: Record<PluginSlot, string[]> = {\n    \"agent-chat\": [\"agentChatPlugin\"],\n    auth: [\"authPlugin\"],\n    \"core-routes\": [\"coreRoutesPlugin\"],\n    integrations: [\"integrationsPlugin\"],\n    org: [\"orgPlugin\"],\n    resources: [\"resourcesPlugin\"],\n    terminal: [\"terminalPlugin\"],\n  };\n\n  for (const [slot, names] of Object.entries(slotExportNames) as [\n    PluginSlot,\n    string[],\n  ][]) {\n    for (const name of names) {\n      // Match any of:\n      //   export const <name>\n      //   export async function <name>\n      //   export function <name>\n      //   export { <name>\n      //   export { foo as <name>\n      const patterns = [\n        new RegExp(`export\\\\s+const\\\\s+${name}\\\\b`, \"m\"),\n        new RegExp(`export\\\\s+(?:async\\\\s+)?function\\\\s+${name}\\\\b`, \"m\"),\n        new RegExp(`export\\\\s*\\\\{[^}]*?\\\\b${name}\\\\b[^}]*?\\\\}`, \"m\"),\n      ];\n      if (patterns.some((re) => re.test(source))) {\n        out[slot] = name;\n        break;\n      }\n    }\n  }\n  return out;\n}\n\n/**\n * Main entry point. Discovers the workspace core for the given cwd (defaults\n * to process.cwd()) and returns its layout. Returns null if there's no\n * workspace core in the ancestor chain. Result is cached per-cwd so repeated\n * calls during a single build are cheap.\n */\nexport async function getWorkspaceCoreExports(\n  cwd: string = process.cwd(),\n): Promise<WorkspaceCoreExports | null> {\n  if (cache && cache.cwd === cwd) return cache.result;\n\n  const fs = await getFs();\n\n  const rootInfo = await findWorkspaceRoot(cwd);\n  if (!rootInfo) {\n    cache = { cwd, result: null };\n    return null;\n  }\n\n  const packageDir = await resolvePackageDir(\n    rootInfo.workspaceRoot,\n    rootInfo.packageName,\n  );\n  if (!packageDir) {\n    cache = { cwd, result: null };\n    return null;\n  }\n\n  const plugins = await discoverPluginExports(packageDir);\n\n  const actionsDir = path.join(packageDir, \"actions\");\n  const skillsDir =\n    [\n      path.join(packageDir, \".agents\", \"skills\"),\n      path.join(packageDir, \"skills\"),\n    ].find((candidate) => fs.existsSync(candidate)) ?? null;\n  const agentsMdPath = path.join(packageDir, \"AGENTS.md\");\n\n  const result: WorkspaceCoreExports = {\n    workspaceRoot: rootInfo.workspaceRoot,\n    packageName: rootInfo.packageName,\n    packageDir,\n    plugins,\n    actionsDir: fs.existsSync(actionsDir) ? actionsDir : null,\n    skillsDir,\n    agentsMdPath: fs.existsSync(agentsMdPath) ? agentsMdPath : null,\n  };\n\n  cache = { cwd, result };\n  return result;\n}\n\n/** Reset the internal cache. Exposed only for tests. */\nexport function _resetWorkspaceCoreCache(): void {\n  cache = undefined;\n}\n"]}
+{"version":3,"file":"workspace-core.js","sourceRoot":"","sources":["../../src/deploy/workspace-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,IAAI,GAAoC,CAAC;AACzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC,GAAG;QAAE,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AA8BD,IAAI,KAAuE,CAAC;AAE5E;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,QAAgB;IAEhB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,wDAAwD;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;gBACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxD,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iBAAiB,CAC9B,aAAqB,EACrB,WAAmB;IAEnB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IAEzB,gCAAgC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1E,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,qBAAqB;IACrB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpD,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACjC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,EAAE,IAAI,KAAK,WAAW;gBAAE,OAAO,SAAS,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,qBAAqB,CAClC,UAAkB;IAElB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IACzB,MAAM,GAAG,GAAwC,EAAE,CAAC;IAEpD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;KAC3C,CAAC;IAEF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACrC,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IAExB,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,eAAe,GAAiC;QACpD,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,aAAa,EAAE,CAAC,kBAAkB,CAAC;QACnC,YAAY,EAAE,CAAC,oBAAoB,CAAC;QACpC,GAAG,EAAE,CAAC,WAAW,CAAC;QAClB,SAAS,EAAE,CAAC,iBAAiB,CAAC;QAC9B,MAAM,EAAE,CAAC,cAAc,CAAC;QACxB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAGvD,EAAE,CAAC;QACJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,gBAAgB;YAChB,wBAAwB;YACxB,iCAAiC;YACjC,2BAA2B;YAC3B,oBAAoB;YACpB,2BAA2B;YAC3B,MAAM,QAAQ,GAAG;gBACf,IAAI,MAAM,CAAC,sBAAsB,IAAI,KAAK,EAAE,GAAG,CAAC;gBAChD,IAAI,MAAM,CAAC,uCAAuC,IAAI,KAAK,EAAE,GAAG,CAAC;gBACjE,IAAI,MAAM,CAAC,yBAAyB,IAAI,cAAc,EAAE,GAAG,CAAC;aAC7D,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAEpD,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IAEzB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CACxC,QAAQ,CAAC,aAAa,EACtB,QAAQ,CAAC,WAAW,CACrB,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,GACb;QACE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;KAChC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAExD,MAAM,MAAM,GAAyB;QACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,UAAU;QACV,OAAO;QACP,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS;QACT,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;IAEF,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,wBAAwB;IACtC,KAAK,GAAG,SAAS,CAAC;AACpB,CAAC","sourcesContent":["/**\n * Workspace-core discovery.\n *\n * An enterprise can sit many agent-native apps in one monorepo alongside a\n * private workspace shared package that can provide shared plugins, skills,\n * actions, and AGENTS.md. Apps inherit everything from\n * the shared package without writing any boilerplate — this is the\n * middle layer of the three-layer inheritance model:\n *\n *   1. app local           (highest priority — app's own server/plugins/, actions/, etc.)\n *   2. workspace core      (middle — packages/shared/ in the enterprise monorepo)\n *   3. @agent-native/core  (lowest — framework defaults)\n *\n * Discovery works by walking up from the build cwd looking for a package.json\n * that declares `\"agent-native\": { \"workspaceCore\": \"@company/shared\" }`.\n * The declared package is then resolved through the monorepo's node_modules,\n * and its directory structure is probed for the standard layout:\n *\n *   packages/shared/\n *     package.json\n *     src/server/index.ts  (exports <slot>Plugin for any slot it wants to provide)\n *     actions/             (shared agent-callable actions)\n *     .agents/skills/      (shared skills)\n *     AGENTS.md            (enterprise-wide agent instructions)\n *     src/client/         (optional shared React code)\n */\nimport path from \"path\";\n\nlet _fs: typeof import(\"fs\") | undefined;\nasync function getFs(): Promise<typeof import(\"fs\")> {\n  if (!_fs) _fs = await import(\"node:fs\");\n  return _fs;\n}\n\n/** Mirrors DEFAULT_PLUGIN_REGISTRY's slot names. */\nexport type PluginSlot =\n  | \"agent-chat\"\n  | \"auth\"\n  | \"core-routes\"\n  | \"integrations\"\n  | \"org\"\n  | \"resources\"\n  | \"sentry\"\n  | \"terminal\";\n\nexport interface WorkspaceCoreExports {\n  /** Absolute path of the monorepo root (the dir containing the root package.json). */\n  workspaceRoot: string;\n  /** Resolved package name — e.g. \"@my-company/shared\". */\n  packageName: string;\n  /** Absolute path to the workspace core package's root directory. */\n  packageDir: string;\n  /** Plugin slot → export name (if the workspace core declares an override for that slot). */\n  plugins: Partial<Record<PluginSlot, string>>;\n  /** Absolute path to the workspace core's actions/ directory, or null if it doesn't have one. */\n  actionsDir: string | null;\n  /** Absolute path to the workspace core's skills/ directory, or null. */\n  skillsDir: string | null;\n  /** Absolute path to the workspace core's AGENTS.md, or null. */\n  agentsMdPath: string | null;\n}\n\nlet cache: { cwd: string; result: WorkspaceCoreExports | null } | undefined;\n\n/**\n * Walk up from startDir looking for a directory whose package.json has an\n * `agent-native.workspaceCore` field. Returns both the root dir and the\n * declared package name, or null if there's no workspace core in the tree.\n */\nasync function findWorkspaceRoot(\n  startDir: string,\n): Promise<{ workspaceRoot: string; packageName: string } | null> {\n  const fs = await getFs();\n  let dir = path.resolve(startDir);\n  // Hard stop at filesystem root to avoid infinite loops.\n  for (let i = 0; i < 20; i++) {\n    const pkgPath = path.join(dir, \"package.json\");\n    if (fs.existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n        const declared = pkg?.[\"agent-native\"]?.workspaceCore;\n        if (typeof declared === \"string\" && declared.length > 0) {\n          return { workspaceRoot: dir, packageName: declared };\n        }\n      } catch {\n        // Malformed package.json — keep walking up.\n      }\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\n/**\n * Resolve a workspace package name to its directory inside the monorepo.\n * Tries in order:\n *   1. <workspaceRoot>/node_modules/<packageName>/package.json (pnpm symlink)\n *   2. For each dir under <workspaceRoot>/packages/*, read its package.json\n *      and match on `name`.\n *   3. For each dir under <workspaceRoot>/packages/*\\/*, same match.\n *\n * The pnpm symlink approach is fastest when deps are installed; the direct\n * scan is a fallback for pre-install scenarios (e.g. running tests before\n * the first `pnpm install` in a scaffolded workspace).\n */\nasync function resolvePackageDir(\n  workspaceRoot: string,\n  packageName: string,\n): Promise<string | null> {\n  const fs = await getFs();\n\n  // 1) pnpm / npm install symlink\n  const nmCandidate = path.join(workspaceRoot, \"node_modules\", packageName);\n  if (fs.existsSync(path.join(nmCandidate, \"package.json\"))) {\n    return nmCandidate;\n  }\n\n  // 2) scan packages/*\n  const packagesDir = path.join(workspaceRoot, \"packages\");\n  const candidates: string[] = [];\n  if (fs.existsSync(packagesDir)) {\n    for (const entry of fs.readdirSync(packagesDir, { withFileTypes: true })) {\n      if (!entry.isDirectory()) continue;\n      candidates.push(path.join(packagesDir, entry.name));\n    }\n  }\n\n  // 3) scan packages/*/*  (for scoped layouts like packages/@company/shared)\n  if (fs.existsSync(packagesDir)) {\n    for (const entry of fs.readdirSync(packagesDir, { withFileTypes: true })) {\n      if (!entry.isDirectory() || !entry.name.startsWith(\"@\")) continue;\n      const scopeDir = path.join(packagesDir, entry.name);\n      for (const sub of fs.readdirSync(scopeDir, { withFileTypes: true })) {\n        if (!sub.isDirectory()) continue;\n        candidates.push(path.join(scopeDir, sub.name));\n      }\n    }\n  }\n\n  for (const candidate of candidates) {\n    const pkgPath = path.join(candidate, \"package.json\");\n    if (!fs.existsSync(pkgPath)) continue;\n    try {\n      const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n      if (pkg?.name === packageName) return candidate;\n    } catch {\n      // ignore\n    }\n  }\n  return null;\n}\n\n/**\n * Probe a workspace core package directory to discover which plugin slots it\n * exports. We read its package.json `exports` field + peek at\n * `src/server/index.ts` (or dist/server/index.js) looking for exports of the\n * form `<slot>Plugin` — the same convention the core server index uses.\n */\nasync function discoverPluginExports(\n  packageDir: string,\n): Promise<Partial<Record<PluginSlot, string>>> {\n  const fs = await getFs();\n  const out: Partial<Record<PluginSlot, string>> = {};\n\n  const candidates = [\n    path.join(packageDir, \"src\", \"server\", \"index.ts\"),\n    path.join(packageDir, \"dist\", \"server\", \"index.js\"),\n    path.join(packageDir, \"src\", \"server.ts\"),\n    path.join(packageDir, \"dist\", \"server.js\"),\n  ];\n\n  let source = \"\";\n  for (const c of candidates) {\n    if (fs.existsSync(c)) {\n      try {\n        source = fs.readFileSync(c, \"utf-8\");\n        break;\n      } catch {\n        // keep trying\n      }\n    }\n  }\n  if (!source) return out;\n\n  // Map slot name → export name we're looking for. \"agent-chat\" has a hyphen,\n  // so we probe both the camelCase and dash-free variants.\n  const slotExportNames: Record<PluginSlot, string[]> = {\n    \"agent-chat\": [\"agentChatPlugin\"],\n    auth: [\"authPlugin\"],\n    \"core-routes\": [\"coreRoutesPlugin\"],\n    integrations: [\"integrationsPlugin\"],\n    org: [\"orgPlugin\"],\n    resources: [\"resourcesPlugin\"],\n    sentry: [\"sentryPlugin\"],\n    terminal: [\"terminalPlugin\"],\n  };\n\n  for (const [slot, names] of Object.entries(slotExportNames) as [\n    PluginSlot,\n    string[],\n  ][]) {\n    for (const name of names) {\n      // Match any of:\n      //   export const <name>\n      //   export async function <name>\n      //   export function <name>\n      //   export { <name>\n      //   export { foo as <name>\n      const patterns = [\n        new RegExp(`export\\\\s+const\\\\s+${name}\\\\b`, \"m\"),\n        new RegExp(`export\\\\s+(?:async\\\\s+)?function\\\\s+${name}\\\\b`, \"m\"),\n        new RegExp(`export\\\\s*\\\\{[^}]*?\\\\b${name}\\\\b[^}]*?\\\\}`, \"m\"),\n      ];\n      if (patterns.some((re) => re.test(source))) {\n        out[slot] = name;\n        break;\n      }\n    }\n  }\n  return out;\n}\n\n/**\n * Main entry point. Discovers the workspace core for the given cwd (defaults\n * to process.cwd()) and returns its layout. Returns null if there's no\n * workspace core in the ancestor chain. Result is cached per-cwd so repeated\n * calls during a single build are cheap.\n */\nexport async function getWorkspaceCoreExports(\n  cwd: string = process.cwd(),\n): Promise<WorkspaceCoreExports | null> {\n  if (cache && cache.cwd === cwd) return cache.result;\n\n  const fs = await getFs();\n\n  const rootInfo = await findWorkspaceRoot(cwd);\n  if (!rootInfo) {\n    cache = { cwd, result: null };\n    return null;\n  }\n\n  const packageDir = await resolvePackageDir(\n    rootInfo.workspaceRoot,\n    rootInfo.packageName,\n  );\n  if (!packageDir) {\n    cache = { cwd, result: null };\n    return null;\n  }\n\n  const plugins = await discoverPluginExports(packageDir);\n\n  const actionsDir = path.join(packageDir, \"actions\");\n  const skillsDir =\n    [\n      path.join(packageDir, \".agents\", \"skills\"),\n      path.join(packageDir, \"skills\"),\n    ].find((candidate) => fs.existsSync(candidate)) ?? null;\n  const agentsMdPath = path.join(packageDir, \"AGENTS.md\");\n\n  const result: WorkspaceCoreExports = {\n    workspaceRoot: rootInfo.workspaceRoot,\n    packageName: rootInfo.packageName,\n    packageDir,\n    plugins,\n    actionsDir: fs.existsSync(actionsDir) ? actionsDir : null,\n    skillsDir,\n    agentsMdPath: fs.existsSync(agentsMdPath) ? agentsMdPath : null,\n  };\n\n  cache = { cwd, result };\n  return result;\n}\n\n/** Reset the internal cache. Exposed only for tests. */\nexport function _resetWorkspaceCoreCache(): void {\n  cache = undefined;\n}\n"]}

package/dist/extensions/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/extensions/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAiBhE,wBAAgB,4BAA4B,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAoR1E"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/extensions/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAkBhE,wBAAgB,4BAA4B,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAiS1E"}

package/dist/extensions/actions.js

@@ -1,10 +1,11 @@
+import { writeAppState } from "../application-state/script-helpers.js";
 import { createExtension, getExtension, updateExtension, updateExtensionContent, } from "./store.js";
 import { addExtensionSlotTarget, installExtensionSlot, uninstallExtensionSlot, listExtensionsForSlot, listSlotsForExtension, } from "./slots/store.js";
 export function createExtensionActionEntries() {
     return {
         "create-extension": {
             tool: {
-                description: "Create a sandboxed Alpine.js mini-app extension. Use this when the user asks to create, build, or make an extension/widget/dashboard/calculator. The content must be a self-contained Alpine.js HTML body snippet that can use appAction(), appFetch(), dbQuery(), dbExec(), extensionFetch(), and extensionData.",
+                description: "Create a sandboxed Alpine.js mini-app extension. Use this when the user asks to create, build, or make an extension/widget/dashboard/calculator. The content must be a self-contained Alpine.js HTML body snippet that can use appAction(), appFetch(), dbQuery(), dbExec(), extensionFetch(), and extensionData. Prefer appAction()/appFetch() for app data; parse JSON string action results before aggregating; use dbQuery()/dbExec() only for known existing SQL tables.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -18,7 +19,7 @@ export function createExtensionActionEntries() {
                         },
                         content: {
                             type: "string",
-                            description: "Self-contained Alpine.js HTML body snippet. The iframe body has no padding, so add p-4 or p-6 to the outermost element. Use semantic Tailwind colors (bg-background, text-foreground, bg-primary, etc.) for native theming. Do not include a full app build, React code, or source files.",
+                            description: "Self-contained Alpine.js HTML body snippet. The iframe canvas already has modest default padding, so avoid duplicate outer padding unless the design needs it. Use semantic Tailwind colors (bg-background, text-foreground, bg-primary, etc.) for native theming. Do not include a full app build, React code, or source files.",
                         },
                         icon: {
                             type: "string",
@@ -41,10 +42,23 @@ export function createExtensionActionEntries() {
                     content,
                     icon: args?.icon ? String(args.icon) : undefined,
                 });
+                // Auto-navigate so the user lands on the new extension instead of
+                // having to read the JSON response and click a link. Writes a
+                // one-shot `navigate` app-state command the UI consumes and clears.
+                try {
+                    await writeAppState("navigate", {
+                        view: "extensions",
+                        extensionId: extension.id,
+                        path: `/extensions/${extension.id}`,
+                    });
+                }
+                catch {
+                    // Non-fatal — agent can still mention the path in its reply.
+                }
                 return {
                     ok: true,
                     extension,
-                    next: `Navigate to /extensions/${extension.id} or use the navigate action with --view=extensions --extensionId=${extension.id}.`,
+                    next: `Created. The user is being navigated to the new extension automatically — no further navigation tool calls needed.`,
                 };
             },
         },

package/dist/extensions/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/extensions/actions.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,kBAAkB,EAAE;YAClB,IAAI,EAAE;gBACJ,WAAW,EACT,mTAAmT;gBACrT,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,qHAAqH;yBACxH;wBACD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,kDAAkD;yBAChE;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,2RAA2R;yBAC9R;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,oCAAoC;yBAClD;qBACF;oBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;iBAC9B;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI;oBAAE,OAAO,0BAA0B,CAAC;gBAC7C,IAAI,CAAC,OAAO;oBAAE,OAAO,6BAA6B,CAAC;gBAEnD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;oBACtC,IAAI;oBACJ,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;oBACnD,OAAO;oBACP,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;iBACjD,CAAC,CAAC;gBAEH,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,SAAS;oBACT,IAAI,EAAE,2BAA2B,SAAS,CAAC,EAAE,oEAAoE,SAAS,CAAC,EAAE,GAAG;iBACjI,CAAC;YACJ,CAAC;SACF;QAED,kBAAkB,EAAE;YAClB,IAAI,EAAE;gBACJ,WAAW,EACT,iJAAiJ;gBACnJ,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,EAAE,EAAE;4BACF,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yBAAyB;yBACvC;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,4BAA4B;yBAC1C;wBACD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,2BAA2B;yBACzC;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,wDAAwD;yBAC3D;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,qGAAqG;yBACxG;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,oCAAoC;yBAClD;wBACD,UAAU,EAAE;4BACV,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,8BAA8B;4BAC3C,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;yBACnC;qBACF;oBACD,QAAQ,EAAE,CAAC,IAAI,CAAC;iBACjB;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,EAAE;oBAAE,OAAO,wBAAwB,CAAC;gBAEzC,IAAI,MAAM,GAAG,IAAI,CAAC;gBAClB,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC/D,MAAM,OAAO,GAAG,YAAY,CAAE,IAAY,CAAC,OAAO,CAAC,CAAC;oBACpD,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;wBAC5C,OAAO,mEAAmE,CAAC;oBAC7E,CAAC;oBACD,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE;wBACxC,OAAO,EACL,IAAI,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;wBAChE,OAAO;qBACR,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,IAAI,GAA2B,EAAE,CAAC;gBACxC,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;oBACpC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrD,CAAC;gBACD,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5D,IAAI,IAAI,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;oBACnC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjC,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAW,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,MAAM;oBAAE,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM;oBAAE,OAAO,+BAA+B,EAAE,EAAE,CAAC;gBACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC;SACF;QAED,2BAA2B,EAAE;YAC3B,IAAI,EAAE;gBACJ,WAAW,EACT,uVAAuV;gBACzV,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;wBAC7D,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,uDAAuD;yBAC1D;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,yEAAyE;yBAC5E;qBACF;oBACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;iBACpC;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW;oBAAE,OAAO,iCAAiC,CAAC;gBAC3D,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,sBAAsB,CACtC,WAAW,EACX,MAAM,EACN,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAC/C,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACjC,CAAC;SACF;QAED,mBAAmB,EAAE;YACnB,IAAI,EAAE;gBACJ,WAAW,EACT,4UAA4U;gBAC9U,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,0BAA0B;yBACxC;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,uDAAuD;yBAC1D;wBACD,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,+EAA+E;yBAClF;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,qEAAqE;yBACxE;qBACF;oBACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;iBACpC;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW;oBAAE,OAAO,iCAAiC,CAAC;gBAC3D,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBACjD,MAAM,QAAQ,GACZ,IAAI,EAAE,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;oBACpD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACvB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE;oBAC1D,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBACpE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;iBACvD,CAAC,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACpC,CAAC;SACF;QAED,qBAAqB,EAAE;YACrB,IAAI,EAAE;gBACJ,WAAW,EACT,8GAA8G;gBAChH,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;wBAC7D,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;qBAC5D;oBACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;iBACpC;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW;oBAAE,OAAO,iCAAiC,CAAC;gBAC3D,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBACjD,MAAM,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;SACF;QAED,0BAA0B,EAAE;YAC1B,IAAI,EAAE;gBACJ,WAAW,EACT,uKAAuK;gBACzK,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;qBAC5D;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBACjD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,CAAC;YACD,QAAQ,EAAE,IAAI;SACf;QAED,sBAAsB,EAAE;YACtB,IAAI,EAAE;gBACJ,WAAW,EACT,iIAAiI;gBACnI,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;qBAC9D;oBACD,QAAQ,EAAE,CAAC,aAAa,CAAC;iBAC1B;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,WAAW;oBAAE,OAAO,iCAAiC,CAAC;gBAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,CAAC;YACD,QAAQ,EAAE,IAAI;SACf;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IACE,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK;QACN,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CACpC,EACD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { ActionEntry } from \"../agent/production-agent.js\";\nimport {\n  createExtension,\n  getExtension,\n  updateExtension,\n  updateExtensionContent,\n} from \"./store.js\";\nimport {\n  addExtensionSlotTarget,\n  installExtensionSlot,\n  uninstallExtensionSlot,\n  listExtensionsForSlot,\n  listSlotsForExtension,\n} from \"./slots/store.js\";\n\ntype ExtensionPatch = { find: string; replace: string };\n\nexport function createExtensionActionEntries(): Record<string, ActionEntry> {\n  return {\n    \"create-extension\": {\n      tool: {\n        description:\n          \"Create a sandboxed Alpine.js mini-app extension. Use this when the user asks to create, build, or make an extension/widget/dashboard/calculator. The content must be a self-contained Alpine.js HTML body snippet that can use appAction(), appFetch(), dbQuery(), dbExec(), extensionFetch(), and extensionData.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            name: {\n              type: \"string\",\n              description:\n                'Short display name for the extension. Do not include \"app\" — e.g. name a todo app \"Todos\", a weather app \"Weather\".',\n            },\n            description: {\n              type: \"string\",\n              description: \"One-sentence summary of what the extension does.\",\n            },\n            content: {\n              type: \"string\",\n              description:\n                \"Self-contained Alpine.js HTML body snippet. The iframe body has no padding, so add p-4 or p-6 to the outermost element. Use semantic Tailwind colors (bg-background, text-foreground, bg-primary, etc.) for native theming. Do not include a full app build, React code, or source files.\",\n            },\n            icon: {\n              type: \"string\",\n              description: \"Optional icon name or short label.\",\n            },\n          },\n          required: [\"name\", \"content\"],\n        },\n      },\n      run: async (args) => {\n        const name = String(args?.name ?? \"\").trim();\n        const content = String(args?.content ?? \"\").trim();\n        if (!name) return \"Error: name is required.\";\n        if (!content) return \"Error: content is required.\";\n\n        const extension = await createExtension({\n          name,\n          description: String(args?.description ?? \"\").trim(),\n          content,\n          icon: args?.icon ? String(args.icon) : undefined,\n        });\n\n        return {\n          ok: true,\n          extension,\n          next: `Navigate to /extensions/${extension.id} or use the navigate action with --view=extensions --extensionId=${extension.id}.`,\n        };\n      },\n    },\n\n    \"update-extension\": {\n      tool: {\n        description:\n          \"Update an existing sandboxed Alpine.js mini-app extension. Prefer patches for surgical edits; use full content replacement only when necessary.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            id: {\n              type: \"string\",\n              description: \"Extension id to update.\",\n            },\n            name: {\n              type: \"string\",\n              description: \"Optional new display name.\",\n            },\n            description: {\n              type: \"string\",\n              description: \"Optional new description.\",\n            },\n            content: {\n              type: \"string\",\n              description:\n                \"Optional full replacement Alpine.js HTML body snippet.\",\n            },\n            patches: {\n              type: \"string\",\n              description:\n                'Optional JSON array of { \"find\": \"...\", \"replace\": \"...\" } patches to apply to the current content.',\n            },\n            icon: {\n              type: \"string\",\n              description: \"Optional icon name or short label.\",\n            },\n            visibility: {\n              type: \"string\",\n              description: \"Optional sharing visibility.\",\n              enum: [\"private\", \"org\", \"public\"],\n            },\n          },\n          required: [\"id\"],\n        },\n      },\n      run: async (args) => {\n        const id = String(args?.id ?? \"\").trim();\n        if (!id) return \"Error: id is required.\";\n\n        let result = null;\n        if (args?.content !== undefined || args?.patches !== undefined) {\n          const patches = parsePatches((args as any).patches);\n          if (args?.patches !== undefined && !patches) {\n            return \"Error: patches must be a JSON array of { find, replace } objects.\";\n          }\n          result = await updateExtensionContent(id, {\n            content:\n              args?.content !== undefined ? String(args.content) : undefined,\n            patches,\n          });\n        }\n\n        const meta: Record<string, string> = {};\n        if (args?.name !== undefined) meta.name = String(args.name).trim();\n        if (args?.description !== undefined) {\n          meta.description = String(args.description).trim();\n        }\n        if (args?.icon !== undefined) meta.icon = String(args.icon);\n        if (args?.visibility !== undefined) {\n          meta.visibility = String(args.visibility);\n        }\n        if (Object.keys(meta).length > 0) {\n          result = await updateExtension(id, meta as any);\n        }\n\n        if (!result) result = await getExtension(id);\n        if (!result) return `Error: extension not found: ${id}`;\n        return { ok: true, extension: result };\n      },\n    },\n\n    \"add-extension-slot-target\": {\n      tool: {\n        description:\n          'Declare that an extension can render in a UI extension-point slot of an app (e.g. \"mail.contact-sidebar.bottom\"). Apps drop ExtensionSlot components in their UI; this action registers an extension as installable into one of those slots. Slot IDs follow the convention <app>.<area>.<position>. Caller must have editor access to the extension.',\n        parameters: {\n          type: \"object\",\n          properties: {\n            extensionId: { type: \"string\", description: \"Extension id.\" },\n            slotId: {\n              type: \"string\",\n              description:\n                'Slot identifier — e.g. \"mail.contact-sidebar.bottom\".',\n            },\n            config: {\n              type: \"string\",\n              description:\n                \"Optional JSON string with slot-specific config (defaults, hints, etc.).\",\n            },\n          },\n          required: [\"extensionId\", \"slotId\"],\n        },\n      },\n      run: async (args) => {\n        const extensionId = String(args?.extensionId ?? \"\").trim();\n        const slotId = String(args?.slotId ?? \"\").trim();\n        if (!extensionId) return \"Error: extensionId is required.\";\n        if (!slotId) return \"Error: slotId is required.\";\n        const row = await addExtensionSlotTarget(\n          extensionId,\n          slotId,\n          args?.config ? String(args.config) : undefined,\n        );\n        return { ok: true, slot: row };\n      },\n    },\n\n    \"install-extension\": {\n      tool: {\n        description:\n          \"Install an extension as a widget in an extension-point slot for the current user. The extension must already declare the slot via add-extension-slot-target. Per-user installation — only affects the calling user's view. Use after creating an extension that targets a slot, or when the user asks to add an existing widget to a slot.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            extensionId: {\n              type: \"string\",\n              description: \"Extension id to install.\",\n            },\n            slotId: {\n              type: \"string\",\n              description:\n                'Slot identifier — e.g. \"mail.contact-sidebar.bottom\".',\n            },\n            position: {\n              type: \"number\",\n              description:\n                \"Optional integer position within the slot (lower = earlier). Defaults to end.\",\n            },\n            config: {\n              type: \"string\",\n              description:\n                \"Optional JSON string with per-install config (overrides, settings).\",\n            },\n          },\n          required: [\"extensionId\", \"slotId\"],\n        },\n      },\n      run: async (args) => {\n        const extensionId = String(args?.extensionId ?? \"\").trim();\n        const slotId = String(args?.slotId ?? \"\").trim();\n        if (!extensionId) return \"Error: extensionId is required.\";\n        if (!slotId) return \"Error: slotId is required.\";\n        const position =\n          args?.position !== undefined && args.position !== null\n            ? Number(args.position)\n            : undefined;\n        const row = await installExtensionSlot(extensionId, slotId, {\n          position: Number.isFinite(position as number) ? position : undefined,\n          config: args?.config ? String(args.config) : undefined,\n        });\n        return { ok: true, install: row };\n      },\n    },\n\n    \"uninstall-extension\": {\n      tool: {\n        description:\n          \"Remove an extension from an extension-point slot for the current user. Does not delete the extension itself.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            extensionId: { type: \"string\", description: \"Extension id.\" },\n            slotId: { type: \"string\", description: \"Slot identifier.\" },\n          },\n          required: [\"extensionId\", \"slotId\"],\n        },\n      },\n      run: async (args) => {\n        const extensionId = String(args?.extensionId ?? \"\").trim();\n        const slotId = String(args?.slotId ?? \"\").trim();\n        if (!extensionId) return \"Error: extensionId is required.\";\n        if (!slotId) return \"Error: slotId is required.\";\n        await uninstallExtensionSlot(extensionId, slotId);\n        return { ok: true };\n      },\n    },\n\n    \"list-extensions-for-slot\": {\n      tool: {\n        description:\n          \"List extensions the current user has access to that declare a given extension-point slot. Use to discover what's available to install into a slot the user mentioned.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            slotId: { type: \"string\", description: \"Slot identifier.\" },\n          },\n          required: [\"slotId\"],\n        },\n      },\n      run: async (args) => {\n        const slotId = String(args?.slotId ?? \"\").trim();\n        if (!slotId) return \"Error: slotId is required.\";\n        return { extensions: await listExtensionsForSlot(slotId) };\n      },\n      readOnly: true,\n    },\n\n    \"list-extension-slots\": {\n      tool: {\n        description:\n          \"List the extension-point slots a specific extension declares it can render in. Caller must have viewer access to the extension.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            extensionId: { type: \"string\", description: \"Extension id.\" },\n          },\n          required: [\"extensionId\"],\n        },\n      },\n      run: async (args) => {\n        const extensionId = String(args?.extensionId ?? \"\").trim();\n        if (!extensionId) return \"Error: extensionId is required.\";\n        return { slots: await listSlotsForExtension(extensionId) };\n      },\n      readOnly: true,\n    },\n  };\n}\n\nfunction parsePatches(value: unknown): ExtensionPatch[] | undefined {\n  if (value === undefined) return undefined;\n  const parsed = typeof value === \"string\" ? JSON.parse(value) : value;\n  if (!Array.isArray(parsed)) return undefined;\n  if (\n    parsed.some(\n      (patch) =>\n        !patch ||\n        typeof patch.find !== \"string\" ||\n        typeof patch.replace !== \"string\",\n    )\n  ) {\n    return undefined;\n  }\n  return parsed;\n}\n"]}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/extensions/actions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EACL,eAAe,EACf,YAAY,EACZ,eAAe,EACf,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,kBAAkB,EAAE;YAClB,IAAI,EAAE;gBACJ,WAAW,EACT,+cAA+c;gBACjd,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,qHAAqH;yBACxH;wBACD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,kDAAkD;yBAChE;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,kUAAkU;yBACrU;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,oCAAoC;yBAClD;qBACF;oBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;iBAC9B;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI;oBAAE,OAAO,0BAA0B,CAAC;gBAC7C,IAAI,CAAC,OAAO;oBAAE,OAAO,6BAA6B,CAAC;gBAEnD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;oBACtC,IAAI;oBACJ,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;oBACnD,OAAO;oBACP,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;iBACjD,CAAC,CAAC;gBAEH,kEAAkE;gBAClE,8DAA8D;gBAC9D,oEAAoE;gBACpE,IAAI,CAAC;oBACH,MAAM,aAAa,CAAC,UAAU,EAAE;wBAC9B,IAAI,EAAE,YAAY;wBAClB,WAAW,EAAE,SAAS,CAAC,EAAE;wBACzB,IAAI,EAAE,eAAe,SAAS,CAAC,EAAE,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,6DAA6D;gBAC/D,CAAC;gBAED,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,SAAS;oBACT,IAAI,EAAE,oHAAoH;iBAC3H,CAAC;YACJ,CAAC;SACF;QAED,kBAAkB,EAAE;YAClB,IAAI,EAAE;gBACJ,WAAW,EACT,iJAAiJ;gBACnJ,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,EAAE,EAAE;4BACF,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,yBAAyB;yBACvC;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,4BAA4B;yBAC1C;wBACD,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,2BAA2B;yBACzC;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,wDAAwD;yBAC3D;wBACD,OAAO,EAAE;4BACP,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,qGAAqG;yBACxG;wBACD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,oCAAoC;yBAClD;wBACD,UAAU,EAAE;4BACV,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,8BAA8B;4BAC3C,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;yBACnC;qBACF;oBACD,QAAQ,EAAE,CAAC,IAAI,CAAC;iBACjB;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,EAAE;oBAAE,OAAO,wBAAwB,CAAC;gBAEzC,IAAI,MAAM,GAAG,IAAI,CAAC;gBAClB,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC/D,MAAM,OAAO,GAAG,YAAY,CAAE,IAAY,CAAC,OAAO,CAAC,CAAC;oBACpD,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;wBAC5C,OAAO,mEAAmE,CAAC;oBAC7E,CAAC;oBACD,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE;wBACxC,OAAO,EACL,IAAI,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;wBAChE,OAAO;qBACR,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,IAAI,GAA2B,EAAE,CAAC;gBACxC,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;oBACpC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;gBACrD,CAAC;gBACD,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5D,IAAI,IAAI,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;oBACnC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC5C,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACjC,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAW,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,MAAM;oBAAE,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM;oBAAE,OAAO,+BAA+B,EAAE,EAAE,CAAC;gBACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC;SACF;QAED,2BAA2B,EAAE;YAC3B,IAAI,EAAE;gBACJ,WAAW,EACT,uVAAuV;gBACzV,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;wBAC7D,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,uDAAuD;yBAC1D;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,yEAAyE;yBAC5E;qBACF;oBACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;iBACpC;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW;oBAAE,OAAO,iCAAiC,CAAC;gBAC3D,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,sBAAsB,CACtC,WAAW,EACX,MAAM,EACN,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAC/C,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACjC,CAAC;SACF;QAED,mBAAmB,EAAE;YACnB,IAAI,EAAE;gBACJ,WAAW,EACT,4UAA4U;gBAC9U,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE;4BACX,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,0BAA0B;yBACxC;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,uDAAuD;yBAC1D;wBACD,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,+EAA+E;yBAClF;wBACD,MAAM,EAAE;4BACN,IAAI,EAAE,QAAQ;4BACd,WAAW,EACT,qEAAqE;yBACxE;qBACF;oBACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;iBACpC;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW;oBAAE,OAAO,iCAAiC,CAAC;gBAC3D,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBACjD,MAAM,QAAQ,GACZ,IAAI,EAAE,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;oBACpD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACvB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE;oBAC1D,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;oBACpE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;iBACvD,CAAC,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACpC,CAAC;SACF;QAED,qBAAqB,EAAE;YACrB,IAAI,EAAE;gBACJ,WAAW,EACT,8GAA8G;gBAChH,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;wBAC7D,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;qBAC5D;oBACD,QAAQ,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;iBACpC;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW;oBAAE,OAAO,iCAAiC,CAAC;gBAC3D,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBACjD,MAAM,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;SACF;QAED,0BAA0B,EAAE;YAC1B,IAAI,EAAE;gBACJ,WAAW,EACT,uKAAuK;gBACzK,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;qBAC5D;oBACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;iBACrB;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM;oBAAE,OAAO,4BAA4B,CAAC;gBACjD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,CAAC;YACD,QAAQ,EAAE,IAAI;SACf;QAED,sBAAsB,EAAE;YACtB,IAAI,EAAE;gBACJ,WAAW,EACT,iIAAiI;gBACnI,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;qBAC9D;oBACD,QAAQ,EAAE,CAAC,aAAa,CAAC;iBAC1B;aACF;YACD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,WAAW;oBAAE,OAAO,iCAAiC,CAAC;gBAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,CAAC;YACD,QAAQ,EAAE,IAAI;SACf;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IACE,MAAM,CAAC,IAAI,CACT,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK;QACN,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CACpC,EACD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { ActionEntry } from \"../agent/production-agent.js\";\nimport { writeAppState } from \"../application-state/script-helpers.js\";\nimport {\n  createExtension,\n  getExtension,\n  updateExtension,\n  updateExtensionContent,\n} from \"./store.js\";\nimport {\n  addExtensionSlotTarget,\n  installExtensionSlot,\n  uninstallExtensionSlot,\n  listExtensionsForSlot,\n  listSlotsForExtension,\n} from \"./slots/store.js\";\n\ntype ExtensionPatch = { find: string; replace: string };\n\nexport function createExtensionActionEntries(): Record<string, ActionEntry> {\n  return {\n    \"create-extension\": {\n      tool: {\n        description:\n          \"Create a sandboxed Alpine.js mini-app extension. Use this when the user asks to create, build, or make an extension/widget/dashboard/calculator. The content must be a self-contained Alpine.js HTML body snippet that can use appAction(), appFetch(), dbQuery(), dbExec(), extensionFetch(), and extensionData. Prefer appAction()/appFetch() for app data; parse JSON string action results before aggregating; use dbQuery()/dbExec() only for known existing SQL tables.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            name: {\n              type: \"string\",\n              description:\n                'Short display name for the extension. Do not include \"app\" — e.g. name a todo app \"Todos\", a weather app \"Weather\".',\n            },\n            description: {\n              type: \"string\",\n              description: \"One-sentence summary of what the extension does.\",\n            },\n            content: {\n              type: \"string\",\n              description:\n                \"Self-contained Alpine.js HTML body snippet. The iframe canvas already has modest default padding, so avoid duplicate outer padding unless the design needs it. Use semantic Tailwind colors (bg-background, text-foreground, bg-primary, etc.) for native theming. Do not include a full app build, React code, or source files.\",\n            },\n            icon: {\n              type: \"string\",\n              description: \"Optional icon name or short label.\",\n            },\n          },\n          required: [\"name\", \"content\"],\n        },\n      },\n      run: async (args) => {\n        const name = String(args?.name ?? \"\").trim();\n        const content = String(args?.content ?? \"\").trim();\n        if (!name) return \"Error: name is required.\";\n        if (!content) return \"Error: content is required.\";\n\n        const extension = await createExtension({\n          name,\n          description: String(args?.description ?? \"\").trim(),\n          content,\n          icon: args?.icon ? String(args.icon) : undefined,\n        });\n\n        // Auto-navigate so the user lands on the new extension instead of\n        // having to read the JSON response and click a link. Writes a\n        // one-shot `navigate` app-state command the UI consumes and clears.\n        try {\n          await writeAppState(\"navigate\", {\n            view: \"extensions\",\n            extensionId: extension.id,\n            path: `/extensions/${extension.id}`,\n          });\n        } catch {\n          // Non-fatal — agent can still mention the path in its reply.\n        }\n\n        return {\n          ok: true,\n          extension,\n          next: `Created. The user is being navigated to the new extension automatically — no further navigation tool calls needed.`,\n        };\n      },\n    },\n\n    \"update-extension\": {\n      tool: {\n        description:\n          \"Update an existing sandboxed Alpine.js mini-app extension. Prefer patches for surgical edits; use full content replacement only when necessary.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            id: {\n              type: \"string\",\n              description: \"Extension id to update.\",\n            },\n            name: {\n              type: \"string\",\n              description: \"Optional new display name.\",\n            },\n            description: {\n              type: \"string\",\n              description: \"Optional new description.\",\n            },\n            content: {\n              type: \"string\",\n              description:\n                \"Optional full replacement Alpine.js HTML body snippet.\",\n            },\n            patches: {\n              type: \"string\",\n              description:\n                'Optional JSON array of { \"find\": \"...\", \"replace\": \"...\" } patches to apply to the current content.',\n            },\n            icon: {\n              type: \"string\",\n              description: \"Optional icon name or short label.\",\n            },\n            visibility: {\n              type: \"string\",\n              description: \"Optional sharing visibility.\",\n              enum: [\"private\", \"org\", \"public\"],\n            },\n          },\n          required: [\"id\"],\n        },\n      },\n      run: async (args) => {\n        const id = String(args?.id ?? \"\").trim();\n        if (!id) return \"Error: id is required.\";\n\n        let result = null;\n        if (args?.content !== undefined || args?.patches !== undefined) {\n          const patches = parsePatches((args as any).patches);\n          if (args?.patches !== undefined && !patches) {\n            return \"Error: patches must be a JSON array of { find, replace } objects.\";\n          }\n          result = await updateExtensionContent(id, {\n            content:\n              args?.content !== undefined ? String(args.content) : undefined,\n            patches,\n          });\n        }\n\n        const meta: Record<string, string> = {};\n        if (args?.name !== undefined) meta.name = String(args.name).trim();\n        if (args?.description !== undefined) {\n          meta.description = String(args.description).trim();\n        }\n        if (args?.icon !== undefined) meta.icon = String(args.icon);\n        if (args?.visibility !== undefined) {\n          meta.visibility = String(args.visibility);\n        }\n        if (Object.keys(meta).length > 0) {\n          result = await updateExtension(id, meta as any);\n        }\n\n        if (!result) result = await getExtension(id);\n        if (!result) return `Error: extension not found: ${id}`;\n        return { ok: true, extension: result };\n      },\n    },\n\n    \"add-extension-slot-target\": {\n      tool: {\n        description:\n          'Declare that an extension can render in a UI extension-point slot of an app (e.g. \"mail.contact-sidebar.bottom\"). Apps drop ExtensionSlot components in their UI; this action registers an extension as installable into one of those slots. Slot IDs follow the convention <app>.<area>.<position>. Caller must have editor access to the extension.',\n        parameters: {\n          type: \"object\",\n          properties: {\n            extensionId: { type: \"string\", description: \"Extension id.\" },\n            slotId: {\n              type: \"string\",\n              description:\n                'Slot identifier — e.g. \"mail.contact-sidebar.bottom\".',\n            },\n            config: {\n              type: \"string\",\n              description:\n                \"Optional JSON string with slot-specific config (defaults, hints, etc.).\",\n            },\n          },\n          required: [\"extensionId\", \"slotId\"],\n        },\n      },\n      run: async (args) => {\n        const extensionId = String(args?.extensionId ?? \"\").trim();\n        const slotId = String(args?.slotId ?? \"\").trim();\n        if (!extensionId) return \"Error: extensionId is required.\";\n        if (!slotId) return \"Error: slotId is required.\";\n        const row = await addExtensionSlotTarget(\n          extensionId,\n          slotId,\n          args?.config ? String(args.config) : undefined,\n        );\n        return { ok: true, slot: row };\n      },\n    },\n\n    \"install-extension\": {\n      tool: {\n        description:\n          \"Install an extension as a widget in an extension-point slot for the current user. The extension must already declare the slot via add-extension-slot-target. Per-user installation — only affects the calling user's view. Use after creating an extension that targets a slot, or when the user asks to add an existing widget to a slot.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            extensionId: {\n              type: \"string\",\n              description: \"Extension id to install.\",\n            },\n            slotId: {\n              type: \"string\",\n              description:\n                'Slot identifier — e.g. \"mail.contact-sidebar.bottom\".',\n            },\n            position: {\n              type: \"number\",\n              description:\n                \"Optional integer position within the slot (lower = earlier). Defaults to end.\",\n            },\n            config: {\n              type: \"string\",\n              description:\n                \"Optional JSON string with per-install config (overrides, settings).\",\n            },\n          },\n          required: [\"extensionId\", \"slotId\"],\n        },\n      },\n      run: async (args) => {\n        const extensionId = String(args?.extensionId ?? \"\").trim();\n        const slotId = String(args?.slotId ?? \"\").trim();\n        if (!extensionId) return \"Error: extensionId is required.\";\n        if (!slotId) return \"Error: slotId is required.\";\n        const position =\n          args?.position !== undefined && args.position !== null\n            ? Number(args.position)\n            : undefined;\n        const row = await installExtensionSlot(extensionId, slotId, {\n          position: Number.isFinite(position as number) ? position : undefined,\n          config: args?.config ? String(args.config) : undefined,\n        });\n        return { ok: true, install: row };\n      },\n    },\n\n    \"uninstall-extension\": {\n      tool: {\n        description:\n          \"Remove an extension from an extension-point slot for the current user. Does not delete the extension itself.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            extensionId: { type: \"string\", description: \"Extension id.\" },\n            slotId: { type: \"string\", description: \"Slot identifier.\" },\n          },\n          required: [\"extensionId\", \"slotId\"],\n        },\n      },\n      run: async (args) => {\n        const extensionId = String(args?.extensionId ?? \"\").trim();\n        const slotId = String(args?.slotId ?? \"\").trim();\n        if (!extensionId) return \"Error: extensionId is required.\";\n        if (!slotId) return \"Error: slotId is required.\";\n        await uninstallExtensionSlot(extensionId, slotId);\n        return { ok: true };\n      },\n    },\n\n    \"list-extensions-for-slot\": {\n      tool: {\n        description:\n          \"List extensions the current user has access to that declare a given extension-point slot. Use to discover what's available to install into a slot the user mentioned.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            slotId: { type: \"string\", description: \"Slot identifier.\" },\n          },\n          required: [\"slotId\"],\n        },\n      },\n      run: async (args) => {\n        const slotId = String(args?.slotId ?? \"\").trim();\n        if (!slotId) return \"Error: slotId is required.\";\n        return { extensions: await listExtensionsForSlot(slotId) };\n      },\n      readOnly: true,\n    },\n\n    \"list-extension-slots\": {\n      tool: {\n        description:\n          \"List the extension-point slots a specific extension declares it can render in. Caller must have viewer access to the extension.\",\n        parameters: {\n          type: \"object\",\n          properties: {\n            extensionId: { type: \"string\", description: \"Extension id.\" },\n          },\n          required: [\"extensionId\"],\n        },\n      },\n      run: async (args) => {\n        const extensionId = String(args?.extensionId ?? \"\").trim();\n        if (!extensionId) return \"Error: extensionId is required.\";\n        return { slots: await listSlotsForExtension(extensionId) };\n      },\n      readOnly: true,\n    },\n  };\n}\n\nfunction parsePatches(value: unknown): ExtensionPatch[] | undefined {\n  if (value === undefined) return undefined;\n  const parsed = typeof value === \"string\" ? JSON.parse(value) : value;\n  if (!Array.isArray(parsed)) return undefined;\n  if (\n    parsed.some(\n      (patch) =>\n        !patch ||\n        typeof patch.find !== \"string\" ||\n        typeof patch.replace !== \"string\",\n    )\n  ) {\n    return undefined;\n  }\n  return parsed;\n}\n"]}

package/dist/extensions/routes.js

@@ -561,7 +561,7 @@ const DESTRUCTIVE_SQL_RE = /\b(CREATE\s+(?:(?:LOCAL|GLOBAL)\s+)?(?:TEMPORARY|TEM
 // identity tables, framework infrastructure (tracing, evals, automations,
 // integrations, notifications, scheduling, sharing/orgs), and Postgres
 // catalogs that would let a extension enumerate or read internals.
-const SENSITIVE_SQL_RE = /\b(app_secrets|user|users|session|sessions|account|accounts|verification|oauth_tokens|extensions|tool_shares|tool_slots|tool_slot_installs|member|organization|invitation|jwks|agent_trace_spans|agent_trace_summaries|agent_feedback|agent_satisfaction_scores|agent_evals|agent_runs|agent_run_events|notifications|progress_runs|integration_configs|integration_pending_tasks|integration_thread_mappings|resources|org_members|org_invitations|bigquery_cache|dashboard_views|pg_catalog|information_schema|pg_class|pg_proc|pg_namespace|pg_user|pg_roles|pg_authid|pg_shadow)\b/i;
+const SENSITIVE_SQL_RE = /\b(app_secrets|user|users|session|sessions|account|accounts|verification|oauth_tokens|tools|extensions|tool_shares|tool_slots|tool_slot_installs|member|organization|invitation|jwks|agent_trace_spans|agent_trace_summaries|agent_feedback|agent_satisfaction_scores|agent_evals|agent_runs|agent_run_events|notifications|progress_runs|integration_configs|integration_pending_tasks|integration_thread_mappings|resources|org_members|org_invitations|bigquery_cache|dashboard_views|pg_catalog|information_schema|pg_class|pg_proc|pg_namespace|pg_user|pg_roles|pg_authid|pg_shadow)\b/i;
 // Refuses positional INSERTs (no column list). `INSERT INTO recordings VALUES
 // (...)` would let a extension stuff arbitrary owner_email values into a row.
 // `INSERT INTO recordings (col1, col2) VALUES (...)` is required so the

package/dist/extensions/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/extensions/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,qBAAqB,EACrB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,aAAa,EACb,YAAY,EACZ,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,UAAU,uBAAuB;IACrC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAElD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;QAEzC,IAAI,CAAC;YACH,OAAO,MAAM,qBAAqB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAC1C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAc,EACd,MAAc,EACd,KAAe,EACf,SAAiB;IAEjB,wDAAwD;IACxD,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EACpB,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,mDAAmD;IACnD,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EACnB,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,kEAAkE;IAClE,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACrE,OAAO,yBAAyB,CAC9B,KAAK,EACL,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,CAAC,EACR,SAAS,CACV,CAAC;IACJ,CAAC;IAED,cAAc;IACd,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACpE,OAAO,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,eAAe;IACf,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACvC,mEAAmE;QACnE,gEAAgE;QAChE,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC;QAEpD,MAAM,IAAI,GAAG,kBAAkB,CAC7B,SAAS,CAAC,OAAO,EACjB,SAAS,EACT,MAAM,EACN,KAAK,CAAC,CAAC,CAAC,EACR;YACE,WAAW,EAAE,SAAS,CAAC,UAAU;YACjC,WAAW,EAAE,SAAS;YACtB,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CACF,CAAC;QACF,yEAAyE;QACzE,2DAA2D;QAC3D,yEAAyE;QACzE,gEAAgE;QAChE,qEAAqE;QACrE,gDAAgD;QAChD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9D,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW;IACX,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,WAAW;IACX,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,gBAAgB,GACpB,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;QAC3D,MAAM,aAAa,GACjB,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,WAAW,KAAK,SAAS;YAC9B,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC;QAEhC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;IACd,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,UAAU,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,KAAK,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;gBAIK;YACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;;gBAKK;YACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;cAIK;QACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,cAAc,GAAG,EAAE;QACvB,CAAC,CAAC;4EACsE;QACxE,CAAC,CAAC;4EACsE,CAAC;IAE3E,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;OAEF,cAAc,EAAE;QACnB,IAAI,EAAE;YACJ,UAAU,EAAE;YACZ,WAAW;YACX,UAAU;YACV,MAAM;YACN,IAAI;YACJ,SAAS;YACT,KAAK;YACL,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,IAAI;YAC/B,QAAQ;YACR,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,MAAM;QACV,WAAW;QACX,UAAU;QACV,IAAI;QACJ,UAAU,EAAE,SAAS;QACrB,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,2HAA2H;YAChI,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iIAAiI;QACtI,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAc,EACd,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,gFAAgF;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAA2B,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAE1B,IAAI,WAAW,GAAG,MAAM,CAAC;IACzB,IAAI,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,YAAY,GAAG,OAAO,CAAC;IAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,eAAe,EACf,MAAM,EACN,SAAS,CACV,CAAC;QACF,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,eAAe,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAEnD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAC3C,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAC/D,MAAM,EACN,SAAS,CACV,CAAC;YACF,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;YACnC,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACzC,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0BAA0B,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAE1D,IAAI,MAAM,4BAA4B,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IAC7E,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,QAAQ,OAAO,sCAAsC;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAA+B,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAE7D,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,UAAU,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,IAAI,SAAS,CAAC;IAEnE,IAAI,CAAC;QACH,MAAM,SAAS,GAA2C;YACxD,MAAM;YACN,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAClD,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC;YACtD,SAAS,CAAC,IAAI,GAAG,YAAY;gBAC3B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACjC,kEAAkE;YAClE,qEAAqE;YACrE,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,YAAY,GAChB,CAAC,YAAY;oBACb,CAAC,OAAO,YAAY,KAAK,QAAQ;wBAC/B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;wBAC7B,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;gBAChC,IAAI,YAAY;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAErD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,IAAI,WAAW,IAAI,CAAC,MAAM,4BAA4B,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACrE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC3C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;oBACpE,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;wBAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;wBAC9B,OAAO;4BACL,KAAK,EAAE,wCAAwC,OAAO,GAAG;yBAC1D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW;wBACnB,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC;wBACzC,CAAC,CAAC,QAAQ;iBACb;aACF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC;SAChD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QACjD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,yBAAyB,aAAa,CAC3C,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAC3B,YAAY,CACb,EAAE;SACJ,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,qBAAqB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAE7D,KAAK,UAAU,gBAAgB,CAC7B,EAAqC,EACrC,IAAc;IAEd,MAAM,eAAe,GAAG,qBAAqB,CAAC;IAC9C,IAAI,cAA2B,CAAC;IAChC,qBAAqB,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACpD,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,CAAC;IAEtB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;IAChC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7C,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE;QAClC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAU,EAAE,EAAE;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC,CAAQ,CAAC;IACV,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;QACtB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,eAAe,CAAC;QACvC,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,kBAAkB,GACtB,kcAAkc,CAAC;AAErc,iFAAiF;AACjF,0EAA0E;AAC1E,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,gBAAgB,GACpB,yjBAAyjB,CAAC;AAE5jB,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,4DAA4D;AAC5D,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAE7E,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,oEAAoE;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,2HAA2H;SAC9H,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,aAAa,EAAE,CAAC;IAClD,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { recordChange } from \"../server/poll.js\";\nimport {\n  runWithRequestContext,\n  getRequestOrgId,\n} from \"../server/request-context.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport {\n  listExtensions,\n  getExtension,\n  createExtension,\n  updateExtension,\n  updateExtensionContent,\n  deleteExtension,\n  ensureExtensionsTables,\n} from \"./store.js\";\nimport { buildExtensionHtml, EXTENSION_IFRAME_CSP } from \"./html-shell.js\";\nimport { getThemeVars } from \"./theme.js\";\nimport {\n  resolveKeyReferences,\n  validateUrlAllowlist,\n  getKeyAllowlist,\n} from \"../secrets/substitution.js\";\nimport {\n  collectSecretValues,\n  normalizeExtensionProxyMethod,\n  readResponseTextWithLimit,\n  redactSecrets,\n  redactString,\n  sanitizeOutboundHeaders,\n} from \"./proxy-security.js\";\nimport {\n  createSsrfSafeDispatcher,\n  isBlockedExtensionUrlWithDns,\n} from \"./url-safety.js\";\nimport { ForbiddenError, resolveAccess } from \"../sharing/access.js\";\n\nexport function createExtensionsHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    const method = getMethod(event);\n    const pathname = (event.url?.pathname || \"\")\n      .replace(/^\\/+/, \"\")\n      .replace(/\\/+$/, \"\");\n    const parts = pathname ? pathname.split(\"/\") : [];\n\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Authentication required\" };\n    }\n\n    const orgCtx = await getOrgContext(event).catch(() => null);\n    const userEmail = session.email;\n    const orgId = orgCtx?.orgId ?? undefined;\n\n    try {\n      return await runWithRequestContext({ userEmail, orgId }, () =>\n        dispatch(event, method, parts, userEmail),\n      );\n    } catch (err) {\n      if (err instanceof ForbiddenError) {\n        setResponseStatus(event, 403);\n        return { error: err.message };\n      }\n      throw err;\n    }\n  });\n}\n\nasync function dispatch(\n  event: H3Event,\n  method: string,\n  parts: string[],\n  userEmail: string,\n): Promise<unknown> {\n  // POST /sql/query — read-only SQL for extension iframes\n  if (\n    method === \"POST\" &&\n    parts.length === 2 &&\n    parts[0] === \"sql\" &&\n    parts[1] === \"query\"\n  ) {\n    return handleSqlQuery(event);\n  }\n\n  // POST /sql/exec — write SQL for extension iframes\n  if (\n    method === \"POST\" &&\n    parts.length === 2 &&\n    parts[0] === \"sql\" &&\n    parts[1] === \"exec\"\n  ) {\n    return handleSqlExec(event);\n  }\n\n  // GET /data/:extensionId/:collection — list items in a collection\n  if (method === \"GET\" && parts.length === 3 && parts[0] === \"data\") {\n    return handleExtensionDataList(event, parts[1], parts[2], userEmail);\n  }\n\n  // POST /data/:extensionId/:collection — create/upsert an item\n  if (method === \"POST\" && parts.length === 3 && parts[0] === \"data\") {\n    return handleExtensionDataUpsert(event, parts[1], parts[2], userEmail);\n  }\n\n  // DELETE /data/:extensionId/:collection/:itemId — delete an item\n  if (method === \"DELETE\" && parts.length === 4 && parts[0] === \"data\") {\n    return handleExtensionDataDelete(\n      event,\n      parts[1],\n      parts[2],\n      parts[3],\n      userEmail,\n    );\n  }\n\n  // POST /proxy\n  if (method === \"POST\" && parts.length === 1 && parts[0] === \"proxy\") {\n    return handleProxy(event, userEmail);\n  }\n\n  // GET / — list\n  if (method === \"GET\" && parts.length === 0) {\n    return listExtensions();\n  }\n\n  // POST / — create\n  if (method === \"POST\" && parts.length === 0) {\n    const body = await readBody(event);\n    if (!body.name) {\n      setResponseStatus(event, 400);\n      return { error: \"name is required\" };\n    }\n    const extension = await createExtension(body);\n    recordChange({ source: \"action\", type: \"change\" });\n    setResponseStatus(event, 201);\n    return extension;\n  }\n\n  // GET /:id/render\n  if (method === \"GET\" && parts.length === 2 && parts[1] === \"render\") {\n    const access = await resolveAccess(\"extension\", parts[0]);\n    const extension = access?.resource;\n    if (!extension) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    const search = event.url?.search || \"\";\n    const isDark = search.includes(\"dark=1\") || search.includes(\"dark=true\");\n    const themeVars = getThemeVars(isDark);\n    // Compute viewer-vs-author binding so the iframe can warn when the\n    // viewer is NOT the author. The role is plumbed through to gate\n    // dangerous bridge helpers in iframe-bridge.ts (audit H4).\n    const isAuthor = extension.ownerEmail === userEmail;\n\n    const html = buildExtensionHtml(\n      extension.content,\n      themeVars,\n      isDark,\n      parts[0],\n      {\n        authorEmail: extension.ownerEmail,\n        viewerEmail: userEmail,\n        isAuthor,\n        role: access.role,\n      },\n    );\n    // Security headers per render. We set these explicitly here (rather than\n    // rely on the global security-headers middleware) because:\n    //   - The global middleware sets X-Frame-Options: DENY which would break\n    //     the legitimate iframe usage of this route inside the app.\n    //   - frame-ancestors in the CSP must be set as an HTTP header to be\n    //     enforced; meta-CSP can't set it per spec.\n    setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n    setResponseHeader(event, \"Content-Security-Policy\", EXTENSION_IFRAME_CSP);\n    setResponseHeader(event, \"X-Frame-Options\", \"SAMEORIGIN\");\n    setResponseHeader(event, \"X-Content-Type-Options\", \"nosniff\");\n    setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n    return html;\n  }\n\n  // GET /:id\n  if (method === \"GET\" && parts.length === 1) {\n    const extension = await getExtension(parts[0]);\n    if (!extension) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return extension;\n  }\n\n  // PUT /:id\n  if (method === \"PUT\" && parts.length === 1) {\n    const body = await readBody(event);\n    const hasContentUpdate =\n      body.content !== undefined || body.patches !== undefined;\n    const hasMetaUpdate =\n      body.name !== undefined ||\n      body.description !== undefined ||\n      body.icon !== undefined ||\n      body.visibility !== undefined;\n\n    let result = null;\n    if (hasContentUpdate) {\n      result = await updateExtensionContent(parts[0], {\n        content: body.content,\n        patches: body.patches,\n      });\n    }\n    if (hasMetaUpdate) {\n      result = await updateExtension(parts[0], body);\n    }\n    if (!hasContentUpdate && !hasMetaUpdate) {\n      result = await getExtension(parts[0]);\n    }\n    if (!result) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    recordChange({ source: \"action\", type: \"change\" });\n    return result;\n  }\n\n  // DELETE /:id\n  if (method === \"DELETE\" && parts.length === 1) {\n    const ok = await deleteExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    recordChange({ source: \"action\", type: \"change\" });\n    return { ok: true };\n  }\n\n  setResponseStatus(event, 404);\n  return { error: \"Not found\" };\n}\n\nasync function handleExtensionDataList(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const client = getDbExec();\n  const url = event.url;\n  const limitParam = url?.searchParams?.get(\"limit\");\n  const limit = limitParam\n    ? Math.min(Math.max(1, Number(limitParam)), 1000)\n    : 100;\n  const scope = url?.searchParams?.get(\"scope\") || \"user\";\n  const orgId = getRequestOrgId();\n\n  if (scope === \"org\") {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"Org context required for scope=org\" };\n    }\n    const result = await client.execute({\n      sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n        FROM tool_data\n        WHERE tool_id = ? AND collection = ? AND scope = 'org' AND org_id = ?\n        ORDER BY created_at DESC\n        LIMIT ?`,\n      args: [extensionId, collection, orgId, limit],\n    });\n    return result.rows ?? [];\n  }\n\n  if (scope === \"all\") {\n    const result = await client.execute({\n      sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n        FROM tool_data\n        WHERE tool_id = ? AND collection = ?\n          AND ((scope = 'user' AND owner_email = ?) OR (scope = 'org' AND org_id = ?))\n        ORDER BY created_at DESC\n        LIMIT ?`,\n      args: [extensionId, collection, userEmail, orgId ?? \"\", limit],\n    });\n    return result.rows ?? [];\n  }\n\n  const result = await client.execute({\n    sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n      FROM tool_data\n      WHERE tool_id = ? AND collection = ? AND scope = 'user' AND owner_email = ?\n      ORDER BY updated_at DESC\n      LIMIT ?`,\n    args: [extensionId, collection, userEmail, limit],\n  });\n  return result.rows ?? [];\n}\n\nasync function handleExtensionDataUpsert(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const body = await readBody(event);\n  if (body.data === undefined) {\n    setResponseStatus(event, 400);\n    return { error: \"data is required\" };\n  }\n  const itemId = String(body.id || randomUUID());\n  const data =\n    typeof body.data === \"string\" ? body.data : JSON.stringify(body.data);\n  const now = new Date().toISOString();\n  const scope = body.scope === \"org\" ? \"org\" : \"user\";\n  const orgId = getRequestOrgId();\n\n  if (scope === \"org\" && !orgId) {\n    setResponseStatus(event, 400);\n    return { error: \"Org context required for scope=org\" };\n  }\n\n  const scopeKey = scope === \"org\" ? `org:${orgId}` : userEmail;\n  const client = getDbExec();\n  const pg = isPostgres();\n  const conflictClause = pg\n    ? `ON CONFLICT (tool_id, collection, scope_key, item_id)\n       DO UPDATE SET data = EXCLUDED.data, updated_at = EXCLUDED.updated_at`\n    : `ON CONFLICT (tool_id, collection, scope_key, item_id)\n       DO UPDATE SET data = excluded.data, updated_at = excluded.updated_at`;\n\n  await client.execute({\n    sql: `INSERT INTO tool_data (id, tool_id, collection, item_id, data, owner_email, scope, org_id, scope_key, created_at, updated_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n     ${conflictClause}`,\n    args: [\n      randomUUID(),\n      extensionId,\n      collection,\n      itemId,\n      data,\n      userEmail,\n      scope,\n      scope === \"org\" ? orgId! : null,\n      scopeKey,\n      now,\n      now,\n    ],\n  });\n  return {\n    id: itemId,\n    extensionId,\n    collection,\n    data,\n    ownerEmail: userEmail,\n    scope,\n    orgId: scope === \"org\" ? orgId : null,\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n\nasync function handleExtensionDataDelete(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  itemId: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const url = event.url;\n  const scope = url?.searchParams?.get(\"scope\") || \"user\";\n  const orgId = getRequestOrgId();\n  const client = getDbExec();\n\n  if (scope === \"org\") {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"Org context required for scope=org\" };\n    }\n    await client.execute({\n      sql: `DELETE FROM tool_data WHERE COALESCE(item_id, id) = ? AND tool_id = ? AND collection = ? AND scope = 'org' AND org_id = ?`,\n      args: [itemId, extensionId, collection, orgId],\n    });\n    return { ok: true };\n  }\n\n  await client.execute({\n    sql: `DELETE FROM tool_data WHERE COALESCE(item_id, id) = ? AND tool_id = ? AND collection = ? AND scope = 'user' AND owner_email = ?`,\n    args: [itemId, extensionId, collection, userEmail],\n  });\n  return { ok: true };\n}\n\nasync function handleProxy(\n  event: H3Event,\n  userEmail: string,\n): Promise<unknown> {\n  const body = await readBody(event);\n  const rawUrl = body.url;\n  if (!rawUrl || typeof rawUrl !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"url is required\" };\n  }\n\n  const method = normalizeExtensionProxyMethod(body.method || \"GET\");\n  if (!method) {\n    setResponseStatus(event, 405);\n    return {\n      error:\n        \"Unsupported HTTP method. Allowed methods: GET, POST, PUT, PATCH, DELETE, HEAD.\",\n    };\n  }\n  const rawHeaders: Record<string, string> = body.headers || {};\n  const rawBody = body.body;\n\n  let resolvedUrl = rawUrl;\n  let resolvedHeaders = JSON.stringify(rawHeaders);\n  let resolvedBody = rawBody;\n  const allUsedKeys: string[] = [];\n  const allSecretValues: string[] = [];\n\n  try {\n    const urlResult = await resolveKeyReferences(rawUrl, \"user\", userEmail);\n    resolvedUrl = urlResult.resolved;\n    allUsedKeys.push(...urlResult.usedKeys);\n    allSecretValues.push(...urlResult.secretValues);\n\n    const headerResult = await resolveKeyReferences(\n      resolvedHeaders,\n      \"user\",\n      userEmail,\n    );\n    resolvedHeaders = headerResult.resolved;\n    allUsedKeys.push(...headerResult.usedKeys);\n    allSecretValues.push(...headerResult.secretValues);\n\n    if (rawBody) {\n      const bodyResult = await resolveKeyReferences(\n        typeof rawBody === \"string\" ? rawBody : JSON.stringify(rawBody),\n        \"user\",\n        userEmail,\n      );\n      resolvedBody = bodyResult.resolved;\n      allUsedKeys.push(...bodyResult.usedKeys);\n      allSecretValues.push(...bodyResult.secretValues);\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 400);\n    return { error: `Key resolution failed: ${err?.message ?? err}` };\n  }\n  const secretValues = collectSecretValues(allSecretValues);\n\n  if (await isBlockedExtensionUrlWithDns(resolvedUrl)) {\n    setResponseStatus(event, 403);\n    return { error: \"Requests to private/internal addresses are not allowed\" };\n  }\n\n  for (const keyName of new Set(allUsedKeys)) {\n    const allowlist = await getKeyAllowlist(keyName, \"user\", userEmail);\n    if (!validateUrlAllowlist(resolvedUrl, allowlist)) {\n      setResponseStatus(event, 403);\n      return {\n        error: `Key \"${keyName}\" is not allowed for this URL origin`,\n      };\n    }\n  }\n\n  let headers: Record<string, string>;\n  try {\n    headers = sanitizeOutboundHeaders(JSON.parse(resolvedHeaders));\n  } catch {\n    headers = sanitizeOutboundHeaders(rawHeaders);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), 15_000);\n\n  // Best-effort connect-time SSRF guard. When undici is available (it ships\n  // with Node 18+ but is not always exposed as an importable module), the\n  // dispatcher re-checks the resolved IP at TCP-connect time, closing the\n  // TOCTOU between the pre-flight `isBlockedExtensionUrlWithDns` lookup and the\n  // actual fetch lookup. If undici is not importable, fall through to plain\n  // fetch — the pre-flight remains the primary protection.\n  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;\n\n  try {\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      method,\n      headers,\n      signal: controller.signal,\n      redirect: \"manual\",\n    };\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\n    if (resolvedBody && [\"POST\", \"PUT\", \"PATCH\"].includes(method)) {\n      const isStringBody = typeof resolvedBody === \"string\";\n      fetchOpts.body = isStringBody\n        ? resolvedBody\n        : JSON.stringify(resolvedBody);\n      // Only inject Content-Type when (a) the caller didn't set one and\n      // (b) the body is actually JSON-shaped (object or stringified JSON).\n      // Otherwise leave it unset so the runtime fetch picks an appropriate\n      // default and we don't misrepresent text/plain bodies as JSON.\n      const hasContentType = Object.keys(headers).some(\n        (k) => k.toLowerCase() === \"content-type\",\n      );\n      if (!hasContentType) {\n        const isJsonShaped =\n          !isStringBody ||\n          (typeof resolvedBody === \"string\" &&\n            /^\\s*[{[]/.test(resolvedBody) &&\n            isLikelyJson(resolvedBody));\n        if (isJsonShaped) headers[\"Content-Type\"] = \"application/json\";\n      }\n    }\n\n    const response = await fetch(resolvedUrl, fetchOpts);\n\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      const redirectUrl = location ? new URL(location, resolvedUrl).href : null;\n      if (redirectUrl && (await isBlockedExtensionUrlWithDns(redirectUrl))) {\n        setResponseStatus(event, 403);\n        return { error: \"Redirect to private/internal address blocked\" };\n      }\n      if (redirectUrl) {\n        for (const keyName of new Set(allUsedKeys)) {\n          const allowlist = await getKeyAllowlist(keyName, \"user\", userEmail);\n          if (!validateUrlAllowlist(redirectUrl, allowlist)) {\n            setResponseStatus(event, 403);\n            return {\n              error: `Redirect URL is not allowed for key \"${keyName}\"`,\n            };\n          }\n        }\n      }\n      return {\n        status: response.status,\n        body: {\n          redirect: redirectUrl\n            ? redactString(redirectUrl, secretValues)\n            : location,\n        },\n      };\n    }\n\n    const { text } = await readResponseTextWithLimit(response);\n    let responseBody: unknown;\n    try {\n      responseBody = JSON.parse(text);\n    } catch {\n      responseBody = text;\n    }\n\n    return {\n      status: response.status,\n      body: redactSecrets(responseBody, secretValues),\n    };\n  } catch (err: any) {\n    if (err?.name === \"AbortError\") {\n      setResponseStatus(event, 504);\n      return { error: \"Upstream request timed out\" };\n    }\n    setResponseStatus(event, 502);\n    return {\n      error: `Proxy request failed: ${redactSecrets(\n        err?.message ?? String(err),\n        secretValues,\n      )}`,\n    };\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Capture console output from a CLI script that uses console.log for results.\n * Same technique as wrapCliScript in agent-chat-plugin.ts.\n */\nlet captureCliOutputQueue: Promise<void> = Promise.resolve();\n\nasync function captureCliOutput(\n  fn: (args: string[]) => Promise<void>,\n  args: string[],\n): Promise<string> {\n  const previousCapture = captureCliOutputQueue;\n  let releaseCapture!: () => void;\n  captureCliOutputQueue = new Promise<void>((resolve) => {\n    releaseCapture = resolve;\n  });\n  await previousCapture;\n\n  const logs: string[] = [];\n  const origLog = console.log;\n  const origError = console.error;\n  const origStdoutWrite = process.stdout.write;\n  console.log = (...a: unknown[]) => {\n    logs.push(a.map(String).join(\" \"));\n  };\n  console.error = (...a: unknown[]) => {\n    logs.push(a.map(String).join(\" \"));\n  };\n  process.stdout.write = ((chunk: any) => {\n    if (typeof chunk === \"string\") logs.push(chunk);\n    else if (Buffer.isBuffer(chunk)) logs.push(chunk.toString());\n    return true;\n  }) as any;\n  try {\n    await fn(args);\n  } catch (err: any) {\n    logs.push(`Error: ${err?.message ?? String(err)}`);\n  } finally {\n    console.log = origLog;\n    console.error = origError;\n    process.stdout.write = origStdoutWrite;\n    releaseCapture();\n  }\n  return logs.join(\"\\n\") || \"(no output)\";\n}\n\nasync function handleSqlQuery(event: H3Event): Promise<unknown> {\n  const body = await readBody(event);\n  const sql = body.sql;\n  if (!sql || typeof sql !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"sql is required\" };\n  }\n\n  const cleanSql = stripSqlComments(sql);\n  if (!/^\\s*(SELECT|WITH)\\b/i.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return { error: \"Only SELECT queries are allowed from extensions\" };\n  }\n  if (SENSITIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"Sensitive framework tables are not readable from extensions\",\n    };\n  }\n\n  try {\n    const mod = await import(\"../scripts/db/query.js\");\n    const args = [\"--sql\", sql, \"--format\", \"json\"];\n    if (body.limit) args.push(\"--limit\", String(body.limit));\n    if (body.args !== undefined) {\n      if (!Array.isArray(body.args)) {\n        setResponseStatus(event, 400);\n        return { error: \"args must be an array\" };\n      }\n      args.push(\"--args\", JSON.stringify(body.args));\n    }\n    const output = await captureCliOutput(mod.default, args);\n    try {\n      return JSON.parse(output);\n    } catch {\n      return { output };\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 500);\n    return { error: err?.message ?? \"Query failed\" };\n  }\n}\n\n// TODO(security): replace this regex blocklist with a SQL parser + an explicit\n// allowlist of tables a extension may read/write (e.g. only `tool_data`, plus a\n// per-template list). The current blocklist is best-effort defense in depth\n// and is by design bypassable via SQL constructions that don't include the\n// blocklisted token literally (string concat, dynamic SQL, etc). The temp-\n// view scoping in scripts/db/scoping.ts is the actual ownership boundary.\nconst DESTRUCTIVE_SQL_RE =\n  /\\b(CREATE\\s+(?:(?:LOCAL|GLOBAL)\\s+)?(?:TEMPORARY|TEMP)?\\s*(TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|EXTENSION|ROLE|TABLESPACE|PUBLICATION|SUBSCRIPTION)|DROP\\s+(TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|EXTENSION|ROLE)|TRUNCATE|DELETE\\s+FROM\\s+(?!tool_data\\b)|ALTER\\s+(TABLE|VIEW|SCHEMA|DATABASE|FUNCTION|ROLE|EXTENSION|PUBLICATION)\\s+(?!tool_data\\b)|ATTACH|DETACH|VACUUM|REINDEX|PRAGMA|GRANT|REVOKE|SET\\s+ROLE|RESET\\s+ROLE|COPY)\\b/i;\n\n// Sensitive tables that extensions must not touch directly. Includes Better Auth\n// identity tables, framework infrastructure (tracing, evals, automations,\n// integrations, notifications, scheduling, sharing/orgs), and Postgres\n// catalogs that would let a extension enumerate or read internals.\nconst SENSITIVE_SQL_RE =\n  /\\b(app_secrets|user|users|session|sessions|account|accounts|verification|oauth_tokens|extensions|tool_shares|tool_slots|tool_slot_installs|member|organization|invitation|jwks|agent_trace_spans|agent_trace_summaries|agent_feedback|agent_satisfaction_scores|agent_evals|agent_runs|agent_run_events|notifications|progress_runs|integration_configs|integration_pending_tasks|integration_thread_mappings|resources|org_members|org_invitations|bigquery_cache|dashboard_views|pg_catalog|information_schema|pg_class|pg_proc|pg_namespace|pg_user|pg_roles|pg_authid|pg_shadow)\\b/i;\n\n// Refuses positional INSERTs (no column list). `INSERT INTO recordings VALUES\n// (...)` would let a extension stuff arbitrary owner_email values into a row.\n// `INSERT INTO recordings (col1, col2) VALUES (...)` is required so the\n// downstream injectOwnership helper can append owner_email.\nconst POSITIONAL_INSERT_RE = /\\bINSERT\\s+INTO\\s+[\"'`]?\\w+[\"'`]?\\s+VALUES\\b/i;\n\nfunction stripSqlComments(sql: string): string {\n  return sql.replace(/\\/\\*[\\s\\S]*?\\*\\//g, \" \").replace(/--[^\\n]*/g, \" \");\n}\n\nfunction isLikelyJson(text: string): boolean {\n  try {\n    const parsed = JSON.parse(text);\n    return parsed !== null && typeof parsed === \"object\";\n  } catch {\n    return false;\n  }\n}\n\nasync function handleSqlExec(event: H3Event): Promise<unknown> {\n  const body = await readBody(event);\n  const sql = body.sql;\n  if (!sql || typeof sql !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"sql is required\" };\n  }\n\n  const cleanSql = stripSqlComments(sql);\n  if (DESTRUCTIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Schema changes and destructive SQL are not allowed from extensions\",\n    };\n  }\n  if (SENSITIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"Sensitive framework tables are not writable from extensions\",\n    };\n  }\n  if (POSITIONAL_INSERT_RE.test(cleanSql)) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"INSERT must specify an explicit column list (e.g. INSERT INTO t (col1, col2) VALUES (?, ?)) so ownership can be injected.\",\n    };\n  }\n\n  try {\n    const mod = await import(\"../scripts/db/exec.js\");\n    const args = [\"--sql\", sql, \"--format\", \"json\"];\n    if (body.args !== undefined) {\n      if (!Array.isArray(body.args)) {\n        setResponseStatus(event, 400);\n        return { error: \"args must be an array\" };\n      }\n      args.push(\"--args\", JSON.stringify(body.args));\n    }\n    const output = await captureCliOutput(mod.default, args);\n    try {\n      return JSON.parse(output);\n    } catch {\n      return { output };\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 500);\n    return { error: err?.message ?? \"Exec failed\" };\n  }\n}\n"]}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/extensions/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,qBAAqB,EACrB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,aAAa,EACb,YAAY,EACZ,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,UAAU,uBAAuB;IACrC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;aACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAElD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC;QAEzC,IAAI,CAAC;YACH,OAAO,MAAM,qBAAqB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAC1C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,KAAc,EACd,MAAc,EACd,KAAe,EACf,SAAiB;IAEjB,wDAAwD;IACxD,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EACpB,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,mDAAmD;IACnD,IACE,MAAM,KAAK,MAAM;QACjB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EACnB,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,kEAAkE;IAClE,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,iEAAiE;IACjE,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACrE,OAAO,yBAAyB,CAC9B,KAAK,EACL,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,CAAC,EACR,KAAK,CAAC,CAAC,CAAC,EACR,SAAS,CACV,CAAC;IACJ,CAAC;IAED,cAAc;IACd,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACpE,OAAO,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,eAAe;IACf,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,cAAc,EAAE,CAAC;IAC1B,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,EAAE,QAAQ,CAAC;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACvC,mEAAmE;QACnE,gEAAgE;QAChE,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC;QAEpD,MAAM,IAAI,GAAG,kBAAkB,CAC7B,SAAS,CAAC,OAAO,EACjB,SAAS,EACT,MAAM,EACN,KAAK,CAAC,CAAC,CAAC,EACR;YACE,WAAW,EAAE,SAAS,CAAC,UAAU;YACjC,WAAW,EAAE,SAAS;YACtB,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CACF,CAAC;QACF,yEAAyE;QACzE,2DAA2D;QAC3D,yEAAyE;QACzE,gEAAgE;QAChE,qEAAqE;QACrE,gDAAgD;QAChD,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAC;QACrE,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;QAC1E,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;QAC1D,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9D,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW;IACX,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,WAAW;IACX,IAAI,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,gBAAgB,GACpB,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;QAC3D,MAAM,aAAa,GACjB,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,WAAW,KAAK,SAAS;YAC9B,IAAI,CAAC,IAAI,KAAK,SAAS;YACvB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC;QAEhC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;IACd,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QACD,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,UAAU,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,KAAK,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;gBAIK;YACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YAClC,GAAG,EAAE;;;;;gBAKK;YACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;cAIK;QACV,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;IAC/C,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,cAAc,GAAG,EAAE;QACvB,CAAC,CAAC;4EACsE;QACxE,CAAC,CAAC;4EACsE,CAAC;IAE3E,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;OAEF,cAAc,EAAE;QACnB,IAAI,EAAE;YACJ,UAAU,EAAE;YACZ,WAAW;YACX,UAAU;YACV,MAAM;YACN,IAAI;YACJ,SAAS;YACT,KAAK;YACL,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,IAAI;YAC/B,QAAQ;YACR,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,MAAM;QACV,WAAW;QACX,UAAU;QACV,IAAI;QACJ,UAAU,EAAE,SAAS;QACrB,KAAK;QACL,KAAK,EAAE,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACrC,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,WAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,MAAM,sBAAsB,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,2HAA2H;YAChI,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC;SAC/C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iIAAiI;QACtI,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAc,EACd,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC;IACxB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,gFAAgF;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAA2B,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAE1B,IAAI,WAAW,GAAG,MAAM,CAAC;IACzB,IAAI,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,YAAY,GAAG,OAAO,CAAC;IAC3B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,eAAe,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,eAAe,EACf,MAAM,EACN,SAAS,CACV,CAAC;QACF,eAAe,GAAG,YAAY,CAAC,QAAQ,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,eAAe,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAEnD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAC3C,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAC/D,MAAM,EACN,SAAS,CACV,CAAC;YACF,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;YACnC,WAAW,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACzC,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,0BAA0B,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAE1D,IAAI,MAAM,4BAA4B,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAC;IAC7E,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,QAAQ,OAAO,sCAAsC;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAA+B,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAE7D,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,UAAU,GAAG,CAAC,MAAM,wBAAwB,EAAE,CAAC,IAAI,SAAS,CAAC;IAEnE,IAAI,CAAC;QACH,MAAM,SAAS,GAA2C;YACxD,MAAM;YACN,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAClD,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC;YACtD,SAAS,CAAC,IAAI,GAAG,YAAY;gBAC3B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACjC,kEAAkE;YAClE,qEAAqE;YACrE,qEAAqE;YACrE,+DAA+D;YAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,YAAY,GAChB,CAAC,YAAY;oBACb,CAAC,OAAO,YAAY,KAAK,QAAQ;wBAC/B,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;wBAC7B,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;gBAChC,IAAI,YAAY;oBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAErD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,IAAI,WAAW,IAAI,CAAC,MAAM,4BAA4B,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACrE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC3C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;oBACpE,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;wBAClD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;wBAC9B,OAAO;4BACL,KAAK,EAAE,wCAAwC,OAAO,GAAG;yBAC1D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE;oBACJ,QAAQ,EAAE,WAAW;wBACnB,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC;wBACzC,CAAC,CAAC,QAAQ;iBACb;aACF,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,CAAC;SAChD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QACjD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,yBAAyB,aAAa,CAC3C,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAC3B,YAAY,CACb,EAAE;SACJ,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,qBAAqB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAE7D,KAAK,UAAU,gBAAgB,CAC7B,EAAqC,EACrC,IAAc;IAEd,MAAM,eAAe,GAAG,qBAAqB,CAAC;IAC9C,IAAI,cAA2B,CAAC;IAChC,qBAAqB,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACpD,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,eAAe,CAAC;IAEtB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;IAChC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IAC7C,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE;QAChC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE;QAClC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAU,EAAE,EAAE;QACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC,CAAQ,CAAC;IACV,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;QACtB,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,eAAe,CAAC;QACvC,cAAc,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,cAAc,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,kBAAkB,GACtB,kcAAkc,CAAC;AAErc,iFAAiF;AACjF,0EAA0E;AAC1E,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,gBAAgB,GACpB,+jBAA+jB,CAAC;AAElkB,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,4DAA4D;AAC5D,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAE7E,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAc;IACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,oEAAoE;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,2HAA2H;SAC9H,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,aAAa,EAAE,CAAC;IAClD,CAAC;AACH,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { getSession } from \"../server/auth.js\";\nimport { recordChange } from \"../server/poll.js\";\nimport {\n  runWithRequestContext,\n  getRequestOrgId,\n} from \"../server/request-context.js\";\nimport { getOrgContext } from \"../org/context.js\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport {\n  listExtensions,\n  getExtension,\n  createExtension,\n  updateExtension,\n  updateExtensionContent,\n  deleteExtension,\n  ensureExtensionsTables,\n} from \"./store.js\";\nimport { buildExtensionHtml, EXTENSION_IFRAME_CSP } from \"./html-shell.js\";\nimport { getThemeVars } from \"./theme.js\";\nimport {\n  resolveKeyReferences,\n  validateUrlAllowlist,\n  getKeyAllowlist,\n} from \"../secrets/substitution.js\";\nimport {\n  collectSecretValues,\n  normalizeExtensionProxyMethod,\n  readResponseTextWithLimit,\n  redactSecrets,\n  redactString,\n  sanitizeOutboundHeaders,\n} from \"./proxy-security.js\";\nimport {\n  createSsrfSafeDispatcher,\n  isBlockedExtensionUrlWithDns,\n} from \"./url-safety.js\";\nimport { ForbiddenError, resolveAccess } from \"../sharing/access.js\";\n\nexport function createExtensionsHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    const method = getMethod(event);\n    const pathname = (event.url?.pathname || \"\")\n      .replace(/^\\/+/, \"\")\n      .replace(/\\/+$/, \"\");\n    const parts = pathname ? pathname.split(\"/\") : [];\n\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Authentication required\" };\n    }\n\n    const orgCtx = await getOrgContext(event).catch(() => null);\n    const userEmail = session.email;\n    const orgId = orgCtx?.orgId ?? undefined;\n\n    try {\n      return await runWithRequestContext({ userEmail, orgId }, () =>\n        dispatch(event, method, parts, userEmail),\n      );\n    } catch (err) {\n      if (err instanceof ForbiddenError) {\n        setResponseStatus(event, 403);\n        return { error: err.message };\n      }\n      throw err;\n    }\n  });\n}\n\nasync function dispatch(\n  event: H3Event,\n  method: string,\n  parts: string[],\n  userEmail: string,\n): Promise<unknown> {\n  // POST /sql/query — read-only SQL for extension iframes\n  if (\n    method === \"POST\" &&\n    parts.length === 2 &&\n    parts[0] === \"sql\" &&\n    parts[1] === \"query\"\n  ) {\n    return handleSqlQuery(event);\n  }\n\n  // POST /sql/exec — write SQL for extension iframes\n  if (\n    method === \"POST\" &&\n    parts.length === 2 &&\n    parts[0] === \"sql\" &&\n    parts[1] === \"exec\"\n  ) {\n    return handleSqlExec(event);\n  }\n\n  // GET /data/:extensionId/:collection — list items in a collection\n  if (method === \"GET\" && parts.length === 3 && parts[0] === \"data\") {\n    return handleExtensionDataList(event, parts[1], parts[2], userEmail);\n  }\n\n  // POST /data/:extensionId/:collection — create/upsert an item\n  if (method === \"POST\" && parts.length === 3 && parts[0] === \"data\") {\n    return handleExtensionDataUpsert(event, parts[1], parts[2], userEmail);\n  }\n\n  // DELETE /data/:extensionId/:collection/:itemId — delete an item\n  if (method === \"DELETE\" && parts.length === 4 && parts[0] === \"data\") {\n    return handleExtensionDataDelete(\n      event,\n      parts[1],\n      parts[2],\n      parts[3],\n      userEmail,\n    );\n  }\n\n  // POST /proxy\n  if (method === \"POST\" && parts.length === 1 && parts[0] === \"proxy\") {\n    return handleProxy(event, userEmail);\n  }\n\n  // GET / — list\n  if (method === \"GET\" && parts.length === 0) {\n    return listExtensions();\n  }\n\n  // POST / — create\n  if (method === \"POST\" && parts.length === 0) {\n    const body = await readBody(event);\n    if (!body.name) {\n      setResponseStatus(event, 400);\n      return { error: \"name is required\" };\n    }\n    const extension = await createExtension(body);\n    recordChange({ source: \"action\", type: \"change\" });\n    setResponseStatus(event, 201);\n    return extension;\n  }\n\n  // GET /:id/render\n  if (method === \"GET\" && parts.length === 2 && parts[1] === \"render\") {\n    const access = await resolveAccess(\"extension\", parts[0]);\n    const extension = access?.resource;\n    if (!extension) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    const search = event.url?.search || \"\";\n    const isDark = search.includes(\"dark=1\") || search.includes(\"dark=true\");\n    const themeVars = getThemeVars(isDark);\n    // Compute viewer-vs-author binding so the iframe can warn when the\n    // viewer is NOT the author. The role is plumbed through to gate\n    // dangerous bridge helpers in iframe-bridge.ts (audit H4).\n    const isAuthor = extension.ownerEmail === userEmail;\n\n    const html = buildExtensionHtml(\n      extension.content,\n      themeVars,\n      isDark,\n      parts[0],\n      {\n        authorEmail: extension.ownerEmail,\n        viewerEmail: userEmail,\n        isAuthor,\n        role: access.role,\n      },\n    );\n    // Security headers per render. We set these explicitly here (rather than\n    // rely on the global security-headers middleware) because:\n    //   - The global middleware sets X-Frame-Options: DENY which would break\n    //     the legitimate iframe usage of this route inside the app.\n    //   - frame-ancestors in the CSP must be set as an HTTP header to be\n    //     enforced; meta-CSP can't set it per spec.\n    setResponseHeader(event, \"Content-Type\", \"text/html; charset=utf-8\");\n    setResponseHeader(event, \"Content-Security-Policy\", EXTENSION_IFRAME_CSP);\n    setResponseHeader(event, \"X-Frame-Options\", \"SAMEORIGIN\");\n    setResponseHeader(event, \"X-Content-Type-Options\", \"nosniff\");\n    setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n    return html;\n  }\n\n  // GET /:id\n  if (method === \"GET\" && parts.length === 1) {\n    const extension = await getExtension(parts[0]);\n    if (!extension) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    return extension;\n  }\n\n  // PUT /:id\n  if (method === \"PUT\" && parts.length === 1) {\n    const body = await readBody(event);\n    const hasContentUpdate =\n      body.content !== undefined || body.patches !== undefined;\n    const hasMetaUpdate =\n      body.name !== undefined ||\n      body.description !== undefined ||\n      body.icon !== undefined ||\n      body.visibility !== undefined;\n\n    let result = null;\n    if (hasContentUpdate) {\n      result = await updateExtensionContent(parts[0], {\n        content: body.content,\n        patches: body.patches,\n      });\n    }\n    if (hasMetaUpdate) {\n      result = await updateExtension(parts[0], body);\n    }\n    if (!hasContentUpdate && !hasMetaUpdate) {\n      result = await getExtension(parts[0]);\n    }\n    if (!result) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    recordChange({ source: \"action\", type: \"change\" });\n    return result;\n  }\n\n  // DELETE /:id\n  if (method === \"DELETE\" && parts.length === 1) {\n    const ok = await deleteExtension(parts[0]);\n    if (!ok) {\n      setResponseStatus(event, 404);\n      return { error: \"Extension not found\" };\n    }\n    recordChange({ source: \"action\", type: \"change\" });\n    return { ok: true };\n  }\n\n  setResponseStatus(event, 404);\n  return { error: \"Not found\" };\n}\n\nasync function handleExtensionDataList(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const client = getDbExec();\n  const url = event.url;\n  const limitParam = url?.searchParams?.get(\"limit\");\n  const limit = limitParam\n    ? Math.min(Math.max(1, Number(limitParam)), 1000)\n    : 100;\n  const scope = url?.searchParams?.get(\"scope\") || \"user\";\n  const orgId = getRequestOrgId();\n\n  if (scope === \"org\") {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"Org context required for scope=org\" };\n    }\n    const result = await client.execute({\n      sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n        FROM tool_data\n        WHERE tool_id = ? AND collection = ? AND scope = 'org' AND org_id = ?\n        ORDER BY created_at DESC\n        LIMIT ?`,\n      args: [extensionId, collection, orgId, limit],\n    });\n    return result.rows ?? [];\n  }\n\n  if (scope === \"all\") {\n    const result = await client.execute({\n      sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n        FROM tool_data\n        WHERE tool_id = ? AND collection = ?\n          AND ((scope = 'user' AND owner_email = ?) OR (scope = 'org' AND org_id = ?))\n        ORDER BY created_at DESC\n        LIMIT ?`,\n      args: [extensionId, collection, userEmail, orgId ?? \"\", limit],\n    });\n    return result.rows ?? [];\n  }\n\n  const result = await client.execute({\n    sql: `SELECT COALESCE(item_id, id) AS id, tool_id, collection, data, owner_email, scope, org_id, created_at, updated_at\n      FROM tool_data\n      WHERE tool_id = ? AND collection = ? AND scope = 'user' AND owner_email = ?\n      ORDER BY updated_at DESC\n      LIMIT ?`,\n    args: [extensionId, collection, userEmail, limit],\n  });\n  return result.rows ?? [];\n}\n\nasync function handleExtensionDataUpsert(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const body = await readBody(event);\n  if (body.data === undefined) {\n    setResponseStatus(event, 400);\n    return { error: \"data is required\" };\n  }\n  const itemId = String(body.id || randomUUID());\n  const data =\n    typeof body.data === \"string\" ? body.data : JSON.stringify(body.data);\n  const now = new Date().toISOString();\n  const scope = body.scope === \"org\" ? \"org\" : \"user\";\n  const orgId = getRequestOrgId();\n\n  if (scope === \"org\" && !orgId) {\n    setResponseStatus(event, 400);\n    return { error: \"Org context required for scope=org\" };\n  }\n\n  const scopeKey = scope === \"org\" ? `org:${orgId}` : userEmail;\n  const client = getDbExec();\n  const pg = isPostgres();\n  const conflictClause = pg\n    ? `ON CONFLICT (tool_id, collection, scope_key, item_id)\n       DO UPDATE SET data = EXCLUDED.data, updated_at = EXCLUDED.updated_at`\n    : `ON CONFLICT (tool_id, collection, scope_key, item_id)\n       DO UPDATE SET data = excluded.data, updated_at = excluded.updated_at`;\n\n  await client.execute({\n    sql: `INSERT INTO tool_data (id, tool_id, collection, item_id, data, owner_email, scope, org_id, scope_key, created_at, updated_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)\n     ${conflictClause}`,\n    args: [\n      randomUUID(),\n      extensionId,\n      collection,\n      itemId,\n      data,\n      userEmail,\n      scope,\n      scope === \"org\" ? orgId! : null,\n      scopeKey,\n      now,\n      now,\n    ],\n  });\n  return {\n    id: itemId,\n    extensionId,\n    collection,\n    data,\n    ownerEmail: userEmail,\n    scope,\n    orgId: scope === \"org\" ? orgId : null,\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n\nasync function handleExtensionDataDelete(\n  event: H3Event,\n  extensionId: string,\n  collection: string,\n  itemId: string,\n  userEmail: string,\n): Promise<unknown> {\n  await ensureExtensionsTables();\n  const extension = await getExtension(extensionId);\n  if (!extension) {\n    setResponseStatus(event, 404);\n    return { error: \"Extension not found\" };\n  }\n  const url = event.url;\n  const scope = url?.searchParams?.get(\"scope\") || \"user\";\n  const orgId = getRequestOrgId();\n  const client = getDbExec();\n\n  if (scope === \"org\") {\n    if (!orgId) {\n      setResponseStatus(event, 400);\n      return { error: \"Org context required for scope=org\" };\n    }\n    await client.execute({\n      sql: `DELETE FROM tool_data WHERE COALESCE(item_id, id) = ? AND tool_id = ? AND collection = ? AND scope = 'org' AND org_id = ?`,\n      args: [itemId, extensionId, collection, orgId],\n    });\n    return { ok: true };\n  }\n\n  await client.execute({\n    sql: `DELETE FROM tool_data WHERE COALESCE(item_id, id) = ? AND tool_id = ? AND collection = ? AND scope = 'user' AND owner_email = ?`,\n    args: [itemId, extensionId, collection, userEmail],\n  });\n  return { ok: true };\n}\n\nasync function handleProxy(\n  event: H3Event,\n  userEmail: string,\n): Promise<unknown> {\n  const body = await readBody(event);\n  const rawUrl = body.url;\n  if (!rawUrl || typeof rawUrl !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"url is required\" };\n  }\n\n  const method = normalizeExtensionProxyMethod(body.method || \"GET\");\n  if (!method) {\n    setResponseStatus(event, 405);\n    return {\n      error:\n        \"Unsupported HTTP method. Allowed methods: GET, POST, PUT, PATCH, DELETE, HEAD.\",\n    };\n  }\n  const rawHeaders: Record<string, string> = body.headers || {};\n  const rawBody = body.body;\n\n  let resolvedUrl = rawUrl;\n  let resolvedHeaders = JSON.stringify(rawHeaders);\n  let resolvedBody = rawBody;\n  const allUsedKeys: string[] = [];\n  const allSecretValues: string[] = [];\n\n  try {\n    const urlResult = await resolveKeyReferences(rawUrl, \"user\", userEmail);\n    resolvedUrl = urlResult.resolved;\n    allUsedKeys.push(...urlResult.usedKeys);\n    allSecretValues.push(...urlResult.secretValues);\n\n    const headerResult = await resolveKeyReferences(\n      resolvedHeaders,\n      \"user\",\n      userEmail,\n    );\n    resolvedHeaders = headerResult.resolved;\n    allUsedKeys.push(...headerResult.usedKeys);\n    allSecretValues.push(...headerResult.secretValues);\n\n    if (rawBody) {\n      const bodyResult = await resolveKeyReferences(\n        typeof rawBody === \"string\" ? rawBody : JSON.stringify(rawBody),\n        \"user\",\n        userEmail,\n      );\n      resolvedBody = bodyResult.resolved;\n      allUsedKeys.push(...bodyResult.usedKeys);\n      allSecretValues.push(...bodyResult.secretValues);\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 400);\n    return { error: `Key resolution failed: ${err?.message ?? err}` };\n  }\n  const secretValues = collectSecretValues(allSecretValues);\n\n  if (await isBlockedExtensionUrlWithDns(resolvedUrl)) {\n    setResponseStatus(event, 403);\n    return { error: \"Requests to private/internal addresses are not allowed\" };\n  }\n\n  for (const keyName of new Set(allUsedKeys)) {\n    const allowlist = await getKeyAllowlist(keyName, \"user\", userEmail);\n    if (!validateUrlAllowlist(resolvedUrl, allowlist)) {\n      setResponseStatus(event, 403);\n      return {\n        error: `Key \"${keyName}\" is not allowed for this URL origin`,\n      };\n    }\n  }\n\n  let headers: Record<string, string>;\n  try {\n    headers = sanitizeOutboundHeaders(JSON.parse(resolvedHeaders));\n  } catch {\n    headers = sanitizeOutboundHeaders(rawHeaders);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), 15_000);\n\n  // Best-effort connect-time SSRF guard. When undici is available (it ships\n  // with Node 18+ but is not always exposed as an importable module), the\n  // dispatcher re-checks the resolved IP at TCP-connect time, closing the\n  // TOCTOU between the pre-flight `isBlockedExtensionUrlWithDns` lookup and the\n  // actual fetch lookup. If undici is not importable, fall through to plain\n  // fetch — the pre-flight remains the primary protection.\n  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;\n\n  try {\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      method,\n      headers,\n      signal: controller.signal,\n      redirect: \"manual\",\n    };\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\n    if (resolvedBody && [\"POST\", \"PUT\", \"PATCH\"].includes(method)) {\n      const isStringBody = typeof resolvedBody === \"string\";\n      fetchOpts.body = isStringBody\n        ? resolvedBody\n        : JSON.stringify(resolvedBody);\n      // Only inject Content-Type when (a) the caller didn't set one and\n      // (b) the body is actually JSON-shaped (object or stringified JSON).\n      // Otherwise leave it unset so the runtime fetch picks an appropriate\n      // default and we don't misrepresent text/plain bodies as JSON.\n      const hasContentType = Object.keys(headers).some(\n        (k) => k.toLowerCase() === \"content-type\",\n      );\n      if (!hasContentType) {\n        const isJsonShaped =\n          !isStringBody ||\n          (typeof resolvedBody === \"string\" &&\n            /^\\s*[{[]/.test(resolvedBody) &&\n            isLikelyJson(resolvedBody));\n        if (isJsonShaped) headers[\"Content-Type\"] = \"application/json\";\n      }\n    }\n\n    const response = await fetch(resolvedUrl, fetchOpts);\n\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      const redirectUrl = location ? new URL(location, resolvedUrl).href : null;\n      if (redirectUrl && (await isBlockedExtensionUrlWithDns(redirectUrl))) {\n        setResponseStatus(event, 403);\n        return { error: \"Redirect to private/internal address blocked\" };\n      }\n      if (redirectUrl) {\n        for (const keyName of new Set(allUsedKeys)) {\n          const allowlist = await getKeyAllowlist(keyName, \"user\", userEmail);\n          if (!validateUrlAllowlist(redirectUrl, allowlist)) {\n            setResponseStatus(event, 403);\n            return {\n              error: `Redirect URL is not allowed for key \"${keyName}\"`,\n            };\n          }\n        }\n      }\n      return {\n        status: response.status,\n        body: {\n          redirect: redirectUrl\n            ? redactString(redirectUrl, secretValues)\n            : location,\n        },\n      };\n    }\n\n    const { text } = await readResponseTextWithLimit(response);\n    let responseBody: unknown;\n    try {\n      responseBody = JSON.parse(text);\n    } catch {\n      responseBody = text;\n    }\n\n    return {\n      status: response.status,\n      body: redactSecrets(responseBody, secretValues),\n    };\n  } catch (err: any) {\n    if (err?.name === \"AbortError\") {\n      setResponseStatus(event, 504);\n      return { error: \"Upstream request timed out\" };\n    }\n    setResponseStatus(event, 502);\n    return {\n      error: `Proxy request failed: ${redactSecrets(\n        err?.message ?? String(err),\n        secretValues,\n      )}`,\n    };\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Capture console output from a CLI script that uses console.log for results.\n * Same technique as wrapCliScript in agent-chat-plugin.ts.\n */\nlet captureCliOutputQueue: Promise<void> = Promise.resolve();\n\nasync function captureCliOutput(\n  fn: (args: string[]) => Promise<void>,\n  args: string[],\n): Promise<string> {\n  const previousCapture = captureCliOutputQueue;\n  let releaseCapture!: () => void;\n  captureCliOutputQueue = new Promise<void>((resolve) => {\n    releaseCapture = resolve;\n  });\n  await previousCapture;\n\n  const logs: string[] = [];\n  const origLog = console.log;\n  const origError = console.error;\n  const origStdoutWrite = process.stdout.write;\n  console.log = (...a: unknown[]) => {\n    logs.push(a.map(String).join(\" \"));\n  };\n  console.error = (...a: unknown[]) => {\n    logs.push(a.map(String).join(\" \"));\n  };\n  process.stdout.write = ((chunk: any) => {\n    if (typeof chunk === \"string\") logs.push(chunk);\n    else if (Buffer.isBuffer(chunk)) logs.push(chunk.toString());\n    return true;\n  }) as any;\n  try {\n    await fn(args);\n  } catch (err: any) {\n    logs.push(`Error: ${err?.message ?? String(err)}`);\n  } finally {\n    console.log = origLog;\n    console.error = origError;\n    process.stdout.write = origStdoutWrite;\n    releaseCapture();\n  }\n  return logs.join(\"\\n\") || \"(no output)\";\n}\n\nasync function handleSqlQuery(event: H3Event): Promise<unknown> {\n  const body = await readBody(event);\n  const sql = body.sql;\n  if (!sql || typeof sql !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"sql is required\" };\n  }\n\n  const cleanSql = stripSqlComments(sql);\n  if (!/^\\s*(SELECT|WITH)\\b/i.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return { error: \"Only SELECT queries are allowed from extensions\" };\n  }\n  if (SENSITIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"Sensitive framework tables are not readable from extensions\",\n    };\n  }\n\n  try {\n    const mod = await import(\"../scripts/db/query.js\");\n    const args = [\"--sql\", sql, \"--format\", \"json\"];\n    if (body.limit) args.push(\"--limit\", String(body.limit));\n    if (body.args !== undefined) {\n      if (!Array.isArray(body.args)) {\n        setResponseStatus(event, 400);\n        return { error: \"args must be an array\" };\n      }\n      args.push(\"--args\", JSON.stringify(body.args));\n    }\n    const output = await captureCliOutput(mod.default, args);\n    try {\n      return JSON.parse(output);\n    } catch {\n      return { output };\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 500);\n    return { error: err?.message ?? \"Query failed\" };\n  }\n}\n\n// TODO(security): replace this regex blocklist with a SQL parser + an explicit\n// allowlist of tables a extension may read/write (e.g. only `tool_data`, plus a\n// per-template list). The current blocklist is best-effort defense in depth\n// and is by design bypassable via SQL constructions that don't include the\n// blocklisted token literally (string concat, dynamic SQL, etc). The temp-\n// view scoping in scripts/db/scoping.ts is the actual ownership boundary.\nconst DESTRUCTIVE_SQL_RE =\n  /\\b(CREATE\\s+(?:(?:LOCAL|GLOBAL)\\s+)?(?:TEMPORARY|TEMP)?\\s*(TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|EXTENSION|ROLE|TABLESPACE|PUBLICATION|SUBSCRIPTION)|DROP\\s+(TABLE|INDEX|VIEW|SCHEMA|DATABASE|TRIGGER|FUNCTION|EXTENSION|ROLE)|TRUNCATE|DELETE\\s+FROM\\s+(?!tool_data\\b)|ALTER\\s+(TABLE|VIEW|SCHEMA|DATABASE|FUNCTION|ROLE|EXTENSION|PUBLICATION)\\s+(?!tool_data\\b)|ATTACH|DETACH|VACUUM|REINDEX|PRAGMA|GRANT|REVOKE|SET\\s+ROLE|RESET\\s+ROLE|COPY)\\b/i;\n\n// Sensitive tables that extensions must not touch directly. Includes Better Auth\n// identity tables, framework infrastructure (tracing, evals, automations,\n// integrations, notifications, scheduling, sharing/orgs), and Postgres\n// catalogs that would let a extension enumerate or read internals.\nconst SENSITIVE_SQL_RE =\n  /\\b(app_secrets|user|users|session|sessions|account|accounts|verification|oauth_tokens|tools|extensions|tool_shares|tool_slots|tool_slot_installs|member|organization|invitation|jwks|agent_trace_spans|agent_trace_summaries|agent_feedback|agent_satisfaction_scores|agent_evals|agent_runs|agent_run_events|notifications|progress_runs|integration_configs|integration_pending_tasks|integration_thread_mappings|resources|org_members|org_invitations|bigquery_cache|dashboard_views|pg_catalog|information_schema|pg_class|pg_proc|pg_namespace|pg_user|pg_roles|pg_authid|pg_shadow)\\b/i;\n\n// Refuses positional INSERTs (no column list). `INSERT INTO recordings VALUES\n// (...)` would let a extension stuff arbitrary owner_email values into a row.\n// `INSERT INTO recordings (col1, col2) VALUES (...)` is required so the\n// downstream injectOwnership helper can append owner_email.\nconst POSITIONAL_INSERT_RE = /\\bINSERT\\s+INTO\\s+[\"'`]?\\w+[\"'`]?\\s+VALUES\\b/i;\n\nfunction stripSqlComments(sql: string): string {\n  return sql.replace(/\\/\\*[\\s\\S]*?\\*\\//g, \" \").replace(/--[^\\n]*/g, \" \");\n}\n\nfunction isLikelyJson(text: string): boolean {\n  try {\n    const parsed = JSON.parse(text);\n    return parsed !== null && typeof parsed === \"object\";\n  } catch {\n    return false;\n  }\n}\n\nasync function handleSqlExec(event: H3Event): Promise<unknown> {\n  const body = await readBody(event);\n  const sql = body.sql;\n  if (!sql || typeof sql !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"sql is required\" };\n  }\n\n  const cleanSql = stripSqlComments(sql);\n  if (DESTRUCTIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"Schema changes and destructive SQL are not allowed from extensions\",\n    };\n  }\n  if (SENSITIVE_SQL_RE.test(cleanSql)) {\n    setResponseStatus(event, 403);\n    return {\n      error: \"Sensitive framework tables are not writable from extensions\",\n    };\n  }\n  if (POSITIONAL_INSERT_RE.test(cleanSql)) {\n    setResponseStatus(event, 400);\n    return {\n      error:\n        \"INSERT must specify an explicit column list (e.g. INSERT INTO t (col1, col2) VALUES (?, ?)) so ownership can be injected.\",\n    };\n  }\n\n  try {\n    const mod = await import(\"../scripts/db/exec.js\");\n    const args = [\"--sql\", sql, \"--format\", \"json\"];\n    if (body.args !== undefined) {\n      if (!Array.isArray(body.args)) {\n        setResponseStatus(event, 400);\n        return { error: \"args must be an array\" };\n      }\n      args.push(\"--args\", JSON.stringify(body.args));\n    }\n    const output = await captureCliOutput(mod.default, args);\n    try {\n      return JSON.parse(output);\n    } catch {\n      return { output };\n    }\n  } catch (err: any) {\n    setResponseStatus(event, 500);\n    return { error: err?.message ?? \"Exec failed\" };\n  }\n}\n"]}

package/dist/extensions/schema.d.ts

@@ -9,19 +9,19 @@
  * The tables are auto-created at server boot via `ensureTable()` in store.ts,
  * following the same pattern as `app_secrets`.
  *
- * NOTE: physical SQL table/column names stay as `extensions`, `tool_data`,
+ * NOTE: physical SQL table/column names stay as `tools`, `tool_data`,
  * `tool_shares`, `tool_consents`, `tool_id`, etc. — additive-only schema
  * policy means we never rename DB-level identifiers. The JS/TS surface is
  * renamed to `extensions`/`extension*`; the DB-side names stay so existing
  * deployed rows remain readable.
  */
 export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
-    name: "extensions";
+    name: "tools";
     schema: undefined;
     columns: {
         ownerEmail: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "owner_email";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -40,7 +40,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         orgId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "org_id";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -59,7 +59,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         visibility: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "visibility";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: "org" | "private" | "public";
@@ -78,7 +78,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "id";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -97,7 +97,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         name: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "name";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -116,7 +116,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         description: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "description";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -135,7 +135,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         content: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "content";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -154,7 +154,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         icon: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "icon";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -173,7 +173,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "created_at";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -192,7 +192,7 @@ export declare const extensions: import("drizzle-orm/sqlite-core").SQLiteTableWi
         }>;
         updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "updated_at";
-            tableName: "extensions";
+            tableName: "tools";
             dataType: "string";
             columnType: "SQLiteText";
             data: string;
@@ -352,8 +352,8 @@ export declare const extensionShares: import("drizzle-orm/sqlite-core").SQLiteTa
     };
     dialect: "sqlite";
 }>;
-export declare const EXTENSIONS_CREATE_SQL = "CREATE TABLE IF NOT EXISTS extensions (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  updated_at TEXT NOT NULL DEFAULT (datetime('now')),\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)";
-export declare const EXTENSIONS_CREATE_SQL_PG = "CREATE TABLE IF NOT EXISTS extensions (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT now(),\n  updated_at TEXT NOT NULL DEFAULT now(),\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)";
+export declare const EXTENSIONS_CREATE_SQL = "CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  updated_at TEXT NOT NULL DEFAULT (datetime('now')),\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)";
+export declare const EXTENSIONS_CREATE_SQL_PG = "CREATE TABLE IF NOT EXISTS tools (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  description TEXT NOT NULL DEFAULT '',\n  content TEXT NOT NULL DEFAULT '',\n  icon TEXT,\n  created_at TEXT NOT NULL DEFAULT now(),\n  updated_at TEXT NOT NULL DEFAULT now(),\n  owner_email TEXT NOT NULL DEFAULT 'local@localhost',\n  org_id TEXT,\n  visibility TEXT NOT NULL DEFAULT 'private'\n)";
 export declare const EXTENSION_SHARES_CREATE_SQL = "CREATE TABLE IF NOT EXISTS tool_shares (\n  id TEXT PRIMARY KEY,\n  resource_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL,\n  principal_id TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  created_by TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now'))\n)";
 export declare const EXTENSION_SHARES_CREATE_SQL_PG = "CREATE TABLE IF NOT EXISTS tool_shares (\n  id TEXT PRIMARY KEY,\n  resource_id TEXT NOT NULL,\n  principal_type TEXT NOT NULL,\n  principal_id TEXT NOT NULL,\n  role TEXT NOT NULL DEFAULT 'viewer',\n  created_by TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT now()\n)";
 export declare const extensionData: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{