@agent-native/core 0.92.12 → 0.94.0

package/dist/integrations/installations-store.js

@@ -0,0 +1,493 @@
+/**
+ * Durable metadata and encrypted credentials for managed messaging installs.
+ *
+ * The installation row deliberately contains only provider metadata and an
+ * opaque `app_secrets` key. OAuth access and refresh tokens are serialized as
+ * one bundle and encrypted by the framework secrets vault. List/read helpers
+ * never expose the secret key or token values.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { getDbExec, intType, isPostgres, isUniqueViolation, retryOnDdlRace, } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
+import { deleteAppSecret, readAppSecret, writeAppSecret, } from "../secrets/storage.js";
+const TABLE = "integration_installations";
+let _initPromise;
+function createSql() {
+    const integer = intType();
+    return `CREATE TABLE IF NOT EXISTS ${TABLE} (
+    id TEXT PRIMARY KEY,
+    platform TEXT NOT NULL,
+    installation_key TEXT NOT NULL,
+    team_id TEXT,
+    team_name TEXT,
+    enterprise_id TEXT,
+    enterprise_name TEXT,
+    is_enterprise_install ${integer} NOT NULL DEFAULT 0,
+    api_app_id TEXT,
+    bot_user_id TEXT,
+    scopes_json TEXT NOT NULL DEFAULT '[]',
+    installed_by_external_user_id TEXT,
+    owner_email TEXT NOT NULL,
+    org_id TEXT,
+    token_secret_key TEXT NOT NULL,
+    secret_scope TEXT NOT NULL,
+    secret_scope_id TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'connected',
+    health TEXT NOT NULL DEFAULT 'unknown',
+    last_error TEXT,
+    health_checked_at ${integer},
+    last_healthy_at ${integer},
+    token_expires_at ${integer},
+    created_at ${integer} NOT NULL,
+    updated_at ${integer} NOT NULL,
+    disconnected_at ${integer}
+  )`;
+}
+const INDEXES = [
+    [
+        "idx_integration_installations_key",
+        `CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_installations_key ON ${TABLE}(platform, installation_key)`,
+    ],
+    [
+        "idx_integration_installations_team",
+        `CREATE INDEX IF NOT EXISTS idx_integration_installations_team ON ${TABLE}(platform, team_id, status)`,
+    ],
+    [
+        "idx_integration_installations_owner",
+        `CREATE INDEX IF NOT EXISTS idx_integration_installations_owner ON ${TABLE}(owner_email, updated_at)`,
+    ],
+    [
+        "idx_integration_installations_org",
+        `CREATE INDEX IF NOT EXISTS idx_integration_installations_org ON ${TABLE}(org_id, updated_at)`,
+    ],
+];
+async function ensureTable() {
+    if (!_initPromise) {
+        _initPromise = (async () => {
+            const client = getDbExec();
+            const ddl = createSql();
+            if (isPostgres()) {
+                await ensureTableExists(TABLE, ddl);
+                for (const [name, sql] of INDEXES) {
+                    await ensureIndexExists(name, sql);
+                }
+                return;
+            }
+            await retryOnDdlRace(() => client.execute(ddl));
+            for (const [, sql] of INDEXES) {
+                await retryOnDdlRace(() => client.execute(sql));
+            }
+        })().catch((error) => {
+            _initPromise = undefined;
+            throw error;
+        });
+    }
+    return _initPromise;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`${name} is required`);
+    if (normalized.length > 512)
+        throw new Error(`${name} is too long`);
+    return normalized;
+}
+function normalizePlatform(value) {
+    return required(value, "platform").toLowerCase();
+}
+function normalizeEmail(value) {
+    return required(value, "ownerEmail").toLowerCase();
+}
+function normalizeScopes(scopes) {
+    return Array.from(new Set((scopes ?? [])
+        .map((scope) => scope.trim())
+        .filter(Boolean)
+        .sort()));
+}
+function parseScopes(value) {
+    if (typeof value !== "string")
+        return [];
+    try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) &&
+            parsed.every((item) => typeof item === "string")
+            ? parsed
+            : [];
+    }
+    catch {
+        return [];
+    }
+}
+function toBoolean(value) {
+    return value === true || value === 1 || value === "1" || value === "true";
+}
+function nullableNumber(value) {
+    return value == null ? null : Number(value);
+}
+function rowToRaw(row) {
+    return {
+        id: String(row.id),
+        platform: String(row.platform),
+        installationKey: String(row.installation_key),
+        teamId: row.team_id ?? null,
+        teamName: row.team_name ?? null,
+        enterpriseId: row.enterprise_id ?? null,
+        enterpriseName: row.enterprise_name ?? null,
+        isEnterpriseInstall: toBoolean(row.is_enterprise_install),
+        apiAppId: row.api_app_id ?? null,
+        botUserId: row.bot_user_id ?? null,
+        scopes: parseScopes(row.scopes_json),
+        installedByExternalUserId: row.installed_by_external_user_id ?? null,
+        ownerEmail: String(row.owner_email),
+        orgId: row.org_id ?? null,
+        tokenSecretKey: String(row.token_secret_key),
+        secretScope: row.secret_scope,
+        secretScopeId: String(row.secret_scope_id),
+        status: row.status,
+        health: row.health,
+        lastError: row.last_error ?? null,
+        healthCheckedAt: nullableNumber(row.health_checked_at),
+        lastHealthyAt: nullableNumber(row.last_healthy_at),
+        tokenExpiresAt: nullableNumber(row.token_expires_at),
+        createdAt: Number(row.created_at ?? 0),
+        updatedAt: Number(row.updated_at ?? 0),
+        disconnectedAt: nullableNumber(row.disconnected_at),
+    };
+}
+function toSafeInstallation(row) {
+    const { tokenSecretKey: _tokenSecretKey, secretScope: _scope, secretScopeId: _scopeId, ...safe } = row;
+    return safe;
+}
+function tokenSecretKey(platform, installationKey) {
+    const digest = createHash("sha256")
+        .update(`${platform}\0${installationKey}`)
+        .digest("hex")
+        .slice(0, 32);
+    return `integration:${platform}:${digest}:oauth-token-bundle`;
+}
+function sameOwner(a, b) {
+    return a.trim().toLowerCase() === b.trim().toLowerCase();
+}
+function sameScope(row, ownerEmail, orgId) {
+    if (row.orgId || orgId)
+        return !!row.orgId && row.orgId === orgId;
+    return sameOwner(row.ownerEmail, ownerEmail);
+}
+function canMutate(row, actor) {
+    if (row.orgId) {
+        return actor.orgId === row.orgId && actor.isOrgAdmin === true;
+    }
+    return sameOwner(row.ownerEmail, actor.userEmail);
+}
+async function selectRawById(id) {
+    await ensureTable();
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT * FROM ${TABLE} WHERE id = ? LIMIT 1`,
+        args: [id],
+    });
+    return rows[0] ? rowToRaw(rows[0]) : null;
+}
+async function selectRawByKey(platform, installationKey) {
+    await ensureTable();
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT * FROM ${TABLE} WHERE platform = ? AND installation_key = ? LIMIT 1`,
+        args: [
+            normalizePlatform(platform),
+            required(installationKey, "installationKey"),
+        ],
+    });
+    return rows[0] ? rowToRaw(rows[0]) : null;
+}
+/**
+ * Create or refresh a managed install. Re-installs may rotate tokens inside
+ * the same owner/org scope, but cannot silently move an existing provider
+ * installation into another Agent Native tenant.
+ */
+export async function upsertIntegrationInstallation(input) {
+    await ensureTable();
+    const platform = normalizePlatform(input.platform);
+    const installationKey = required(input.installationKey, "installationKey");
+    const ownerEmail = normalizeEmail(input.ownerEmail);
+    const orgId = input.orgId?.trim() || null;
+    const secretScopeId = required(input.secretScopeId, "secretScopeId");
+    const accessToken = input.tokenBundle.accessToken?.trim();
+    if (!accessToken)
+        throw new Error("tokenBundle.accessToken is required");
+    const existing = await selectRawByKey(platform, installationKey);
+    if (existing && !sameScope(existing, ownerEmail, orgId)) {
+        throw new Error("This provider installation is already connected to another owner or organization.");
+    }
+    const secretKey = existing?.tokenSecretKey ?? tokenSecretKey(platform, installationKey);
+    const persistTokenBundle = (key) => writeAppSecret({
+        key,
+        value: JSON.stringify(input.tokenBundle),
+        scope: input.secretScope,
+        scopeId: secretScopeId,
+        description: `${platform} OAuth token bundle for a managed installation`,
+    });
+    await persistTokenBundle(secretKey);
+    const now = Date.now();
+    let id = existing?.id ?? randomUUID();
+    const scopesJson = JSON.stringify(normalizeScopes(input.scopes));
+    const tokenExpiresAt = input.tokenExpiresAt ?? input.tokenBundle.expiresAt ?? null;
+    const updateExisting = async (rowId, rowSecretKey) => {
+        await getDbExec().execute({
+            sql: `UPDATE ${TABLE} SET
+        team_id = ?, team_name = ?, enterprise_id = ?, enterprise_name = ?,
+        is_enterprise_install = ?, api_app_id = ?, bot_user_id = ?, scopes_json = ?,
+        installed_by_external_user_id = ?, owner_email = ?, org_id = ?,
+        token_secret_key = ?, secret_scope = ?, secret_scope_id = ?, status = ?,
+        health = ?, last_error = ?, health_checked_at = ?, last_healthy_at = ?,
+        token_expires_at = ?, updated_at = ?, disconnected_at = ?
+        WHERE id = ?`,
+            args: [
+                input.teamId ?? null,
+                input.teamName ?? null,
+                input.enterpriseId ?? null,
+                input.enterpriseName ?? null,
+                input.isEnterpriseInstall ? 1 : 0,
+                input.apiAppId ?? null,
+                input.botUserId ?? null,
+                scopesJson,
+                input.installedByExternalUserId ?? null,
+                ownerEmail,
+                orgId,
+                rowSecretKey,
+                input.secretScope,
+                secretScopeId,
+                input.status ?? "connected",
+                input.health ?? "unknown",
+                input.lastError ?? null,
+                input.healthCheckedAt ?? null,
+                input.lastHealthyAt ?? null,
+                tokenExpiresAt,
+                now,
+                null,
+                rowId,
+            ],
+        });
+    };
+    if (existing) {
+        await updateExisting(existing.id, existing.tokenSecretKey);
+    }
+    else {
+        try {
+            await getDbExec().execute({
+                sql: `INSERT INTO ${TABLE} (
+          id, platform, installation_key, team_id, team_name, enterprise_id,
+          enterprise_name, is_enterprise_install, api_app_id, bot_user_id,
+          scopes_json, installed_by_external_user_id, owner_email, org_id,
+          token_secret_key, secret_scope, secret_scope_id, status, health,
+          last_error, health_checked_at, last_healthy_at, token_expires_at,
+          created_at, updated_at, disconnected_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+                args: [
+                    id,
+                    platform,
+                    installationKey,
+                    input.teamId ?? null,
+                    input.teamName ?? null,
+                    input.enterpriseId ?? null,
+                    input.enterpriseName ?? null,
+                    input.isEnterpriseInstall ? 1 : 0,
+                    input.apiAppId ?? null,
+                    input.botUserId ?? null,
+                    scopesJson,
+                    input.installedByExternalUserId ?? null,
+                    ownerEmail,
+                    orgId,
+                    secretKey,
+                    input.secretScope,
+                    secretScopeId,
+                    input.status ?? "connected",
+                    input.health ?? "unknown",
+                    input.lastError ?? null,
+                    input.healthCheckedAt ?? null,
+                    input.lastHealthyAt ?? null,
+                    tokenExpiresAt,
+                    now,
+                    now,
+                    null,
+                ],
+            });
+        }
+        catch (error) {
+            if (!isUniqueViolation(error))
+                throw error;
+            const raced = await selectRawByKey(platform, installationKey);
+            if (!raced)
+                throw error;
+            if (!sameScope(raced, ownerEmail, orgId)) {
+                throw new Error("This provider installation is already connected to another owner or organization.");
+            }
+            id = raced.id;
+            if (raced.tokenSecretKey !== secretKey) {
+                await persistTokenBundle(raced.tokenSecretKey);
+            }
+            await updateExisting(raced.id, raced.tokenSecretKey);
+        }
+    }
+    const stored = await selectRawById(id);
+    if (!stored)
+        throw new Error("Managed installation was not persisted");
+    return toSafeInstallation(stored);
+}
+/** List installations visible to the owner or active organization member. */
+export async function listIntegrationInstallations(actor, platform) {
+    await ensureTable();
+    const ownerEmail = normalizeEmail(actor.userEmail);
+    const args = [ownerEmail];
+    let visibility = "owner_email = ?";
+    if (actor.orgId) {
+        visibility = `(owner_email = ? OR org_id = ?)`;
+        args.push(actor.orgId);
+    }
+    let platformFilter = "";
+    if (platform) {
+        platformFilter = " AND platform = ?";
+        args.push(normalizePlatform(platform));
+    }
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT * FROM ${TABLE} WHERE ${visibility}${platformFilter} ORDER BY updated_at DESC`,
+        args,
+    });
+    return rows.map((row) => toSafeInstallation(rowToRaw(row)));
+}
+/** Read one installation through owner/org visibility scoping. */
+export async function getIntegrationInstallation(id, actor) {
+    const row = await selectRawById(id);
+    if (!row)
+        return null;
+    if (!sameOwner(row.ownerEmail, actor.userEmail) &&
+        (!row.orgId || row.orgId !== actor.orgId)) {
+        return null;
+    }
+    return toSafeInstallation(row);
+}
+/** Update non-secret installation metadata after an owner/admin access check. */
+export async function updateIntegrationInstallation(id, actor, patch) {
+    const row = await selectRawById(id);
+    if (!row)
+        return null;
+    if (!canMutate(row, actor)) {
+        throw new Error("You do not have access to update this installation.");
+    }
+    const next = {
+        teamName: patch.teamName === undefined ? row.teamName : patch.teamName,
+        enterpriseName: patch.enterpriseName === undefined
+            ? row.enterpriseName
+            : patch.enterpriseName,
+        botUserId: patch.botUserId === undefined ? row.botUserId : patch.botUserId,
+        scopes: patch.scopes === undefined ? row.scopes : normalizeScopes(patch.scopes),
+        status: patch.status ?? row.status,
+        health: patch.health ?? row.health,
+        lastError: patch.lastError === undefined ? row.lastError : patch.lastError,
+        healthCheckedAt: patch.healthCheckedAt === undefined
+            ? row.healthCheckedAt
+            : patch.healthCheckedAt,
+        lastHealthyAt: patch.lastHealthyAt === undefined
+            ? row.lastHealthyAt
+            : patch.lastHealthyAt,
+        tokenExpiresAt: patch.tokenExpiresAt === undefined
+            ? row.tokenExpiresAt
+            : patch.tokenExpiresAt,
+    };
+    await getDbExec().execute({
+        sql: `UPDATE ${TABLE} SET team_name = ?, enterprise_name = ?, bot_user_id = ?,
+      scopes_json = ?, status = ?, health = ?, last_error = ?, health_checked_at = ?,
+      last_healthy_at = ?, token_expires_at = ?, updated_at = ? WHERE id = ?`,
+        args: [
+            next.teamName,
+            next.enterpriseName,
+            next.botUserId,
+            JSON.stringify(next.scopes),
+            next.status,
+            next.health,
+            next.lastError,
+            next.healthCheckedAt,
+            next.lastHealthyAt,
+            next.tokenExpiresAt,
+            Date.now(),
+            id,
+        ],
+    });
+    const updated = await selectRawById(id);
+    return updated ? toSafeInstallation(updated) : null;
+}
+/** Delete the encrypted token bundle and retain disconnected audit metadata. */
+export async function disconnectIntegrationInstallation(id, actor) {
+    const row = await selectRawById(id);
+    if (!row)
+        return null;
+    if (!canMutate(row, actor)) {
+        throw new Error("You do not have access to disconnect this installation.");
+    }
+    await deleteAppSecret({
+        key: row.tokenSecretKey,
+        scope: row.secretScope,
+        scopeId: row.secretScopeId,
+    });
+    const now = Date.now();
+    await getDbExec().execute({
+        sql: `UPDATE ${TABLE} SET status = 'disconnected', health = 'unknown',
+      last_error = NULL, token_expires_at = NULL, disconnected_at = ?, updated_at = ?
+      WHERE id = ?`,
+        args: [now, now, id],
+    });
+    const updated = await selectRawById(id);
+    return updated ? toSafeInstallation(updated) : null;
+}
+/**
+ * Resolve credentials for a verified provider webhook/runtime path.
+ *
+ * This is intentionally separate from every user-facing list/read helper.
+ * Callers must first authenticate the provider webhook (or run inside a
+ * trusted OAuth callback) and must never log or return the result.
+ */
+export async function resolveIntegrationTokenBundle(platform, installationKey) {
+    const row = await selectRawByKey(platform, installationKey);
+    if (!row || row.status !== "connected" || row.health === "revoked")
+        return null;
+    const secret = await readAppSecret({
+        key: row.tokenSecretKey,
+        scope: row.secretScope,
+        scopeId: row.secretScopeId,
+    });
+    if (!secret)
+        return null;
+    try {
+        const parsed = JSON.parse(secret.value);
+        if (typeof parsed.accessToken !== "string" || !parsed.accessToken)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Safe metadata lookup for a verified provider event. */
+export async function getActiveIntegrationInstallationByKey(platform, installationKey) {
+    const row = await selectRawByKey(platform, installationKey);
+    if (!row || row.status !== "connected")
+        return null;
+    return toSafeInstallation(row);
+}
+/** Resolve a connected installation by workspace or enterprise tenant id. */
+export async function getActiveIntegrationInstallationForTenant(platform, tenantId) {
+    await ensureTable();
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT * FROM ${TABLE}
+      WHERE platform = ? AND (team_id = ? OR enterprise_id = ?)
+        AND status = 'connected'
+      ORDER BY updated_at DESC LIMIT 1`,
+        args: [
+            normalizePlatform(platform),
+            required(tenantId, "tenantId"),
+            required(tenantId, "tenantId"),
+        ],
+    });
+    return rows[0]
+        ? toSafeInstallation(rowToRaw(rows[0]))
+        : null;
+}
+//# sourceMappingURL=installations-store.js.map

package/dist/integrations/installations-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installations-store.js","sourceRoot":"","sources":["../../src/integrations/installations-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EACL,eAAe,EACf,aAAa,EACb,cAAc,GACf,MAAM,uBAAuB,CAAC;AAE/B,MAAM,KAAK,GAAG,2BAA2B,CAAC;AAC1C,IAAI,YAAuC,CAAC;AAmG5C,SAAS,SAAS;IAChB,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;IAC1B,OAAO,8BAA8B,KAAK;;;;;;;;4BAQhB,OAAO;;;;;;;;;;;;;wBAaX,OAAO;sBACT,OAAO;uBACN,OAAO;iBACb,OAAO;iBACP,OAAO;sBACF,OAAO;IACzB,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG;IACd;QACE,mCAAmC;QACnC,0EAA0E,KAAK,8BAA8B;KAC9G;IACD;QACE,oCAAoC;QACpC,oEAAoE,KAAK,6BAA6B;KACvG;IACD;QACE,qCAAqC;QACrC,qEAAqE,KAAK,2BAA2B;KACtG;IACD;QACE,mCAAmC;QACnC,mEAAmE,KAAK,sBAAsB;KAC/F;CACO,CAAC;AAEX,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACpC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;oBAClC,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,MAAqC;IAC5D,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,CAAC,MAAM,IAAI,EAAE,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,EAAE,CACV,CACF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;YAChD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,GAA4B;IAC5C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC7C,MAAM,EAAG,GAAG,CAAC,OAAyB,IAAI,IAAI;QAC9C,QAAQ,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;QAClD,YAAY,EAAG,GAAG,CAAC,aAA+B,IAAI,IAAI;QAC1D,cAAc,EAAG,GAAG,CAAC,eAAiC,IAAI,IAAI;QAC9D,mBAAmB,EAAE,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACzD,QAAQ,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;QACnD,SAAS,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACrD,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;QACpC,yBAAyB,EACtB,GAAG,CAAC,6BAA+C,IAAI,IAAI;QAC9D,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,KAAK,EAAG,GAAG,CAAC,MAAwB,IAAI,IAAI;QAC5C,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC5C,WAAW,EAAE,GAAG,CAAC,YAA2B;QAC5C,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAC1C,MAAM,EAAE,GAAG,CAAC,MAAuC;QACnD,MAAM,EAAE,GAAG,CAAC,MAAuC;QACnD,SAAS,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;QACpD,eAAe,EAAE,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACtD,aAAa,EAAE,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC;QAClD,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACpD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAoB;IAC9C,MAAM,EACJ,cAAc,EAAE,eAAe,EAC/B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,QAAQ,EACvB,GAAG,IAAI,EACR,GAAG,GAAG,CAAC;IACR,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,eAAuB;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,QAAQ,KAAK,eAAe,EAAE,CAAC;SACzC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,eAAe,QAAQ,IAAI,MAAM,qBAAqB,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAChB,GAAkD,EAClD,UAAkB,EAClB,KAAoB;IAEpB,IAAI,GAAG,CAAC,KAAK,IAAI,KAAK;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC;IAClE,OAAO,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,SAAS,CAAC,GAAoB,EAAE,KAAwB;IAC/D,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,EAAU;IACrC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,iBAAiB,KAAK,uBAAuB;QAClD,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,eAAuB;IAEvB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,iBAAiB,KAAK,sDAAsD;QACjF,IAAI,EAAE;YACJ,iBAAiB,CAAC,QAAQ,CAAC;YAC3B,QAAQ,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAC7C;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAAyC;IAEzC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC1C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACjE,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GACb,QAAQ,EAAE,cAAc,IAAI,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,EAAE,CACzC,cAAc,CAAC;QACb,GAAG;QACH,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC;QACxC,KAAK,EAAE,KAAK,CAAC,WAAW;QACxB,OAAO,EAAE,aAAa;QACtB,WAAW,EAAE,GAAG,QAAQ,gDAAgD;KACzE,CAAC,CAAC;IACL,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,QAAQ,EAAE,EAAE,IAAI,UAAU,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,WAAW,CAAC,SAAS,IAAI,IAAI,CAAC;IAE9D,MAAM,cAAc,GAAG,KAAK,EAAE,KAAa,EAAE,YAAoB,EAAE,EAAE;QACnE,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACxB,GAAG,EAAE,UAAU,KAAK;;;;;;;qBAOL;YACf,IAAI,EAAE;gBACJ,KAAK,CAAC,MAAM,IAAI,IAAI;gBACpB,KAAK,CAAC,QAAQ,IAAI,IAAI;gBACtB,KAAK,CAAC,YAAY,IAAI,IAAI;gBAC1B,KAAK,CAAC,cAAc,IAAI,IAAI;gBAC5B,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,KAAK,CAAC,QAAQ,IAAI,IAAI;gBACtB,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,UAAU;gBACV,KAAK,CAAC,yBAAyB,IAAI,IAAI;gBACvC,UAAU;gBACV,KAAK;gBACL,YAAY;gBACZ,KAAK,CAAC,WAAW;gBACjB,aAAa;gBACb,KAAK,CAAC,MAAM,IAAI,WAAW;gBAC3B,KAAK,CAAC,MAAM,IAAI,SAAS;gBACzB,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,eAAe,IAAI,IAAI;gBAC7B,KAAK,CAAC,aAAa,IAAI,IAAI;gBAC3B,cAAc;gBACd,GAAG;gBACH,IAAI;gBACJ,KAAK;aACN;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;gBACxB,GAAG,EAAE,eAAe,KAAK;;;;;;;gGAO+D;gBACxF,IAAI,EAAE;oBACJ,EAAE;oBACF,QAAQ;oBACR,eAAe;oBACf,KAAK,CAAC,MAAM,IAAI,IAAI;oBACpB,KAAK,CAAC,QAAQ,IAAI,IAAI;oBACtB,KAAK,CAAC,YAAY,IAAI,IAAI;oBAC1B,KAAK,CAAC,cAAc,IAAI,IAAI;oBAC5B,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjC,KAAK,CAAC,QAAQ,IAAI,IAAI;oBACtB,KAAK,CAAC,SAAS,IAAI,IAAI;oBACvB,UAAU;oBACV,KAAK,CAAC,yBAAyB,IAAI,IAAI;oBACvC,UAAU;oBACV,KAAK;oBACL,SAAS;oBACT,KAAK,CAAC,WAAW;oBACjB,aAAa;oBACb,KAAK,CAAC,MAAM,IAAI,WAAW;oBAC3B,KAAK,CAAC,MAAM,IAAI,SAAS;oBACzB,KAAK,CAAC,SAAS,IAAI,IAAI;oBACvB,KAAK,CAAC,eAAe,IAAI,IAAI;oBAC7B,KAAK,CAAC,aAAa,IAAI,IAAI;oBAC3B,cAAc;oBACd,GAAG;oBACH,GAAG;oBACH,IAAI;iBACL;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAE3C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK;gBAAE,MAAM,KAAK,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;YACJ,CAAC;YAED,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACd,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACvE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAwB,EACxB,QAAiB;IAEjB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,IAAI,GAAc,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,UAAU,GAAG,iBAAiB,CAAC;IACnC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,UAAU,GAAG,iCAAiC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,cAAc,GAAG,EAAE,CAAC;IACxB,IAAI,QAAQ,EAAE,CAAC;QACb,cAAc,GAAG,mBAAmB,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,iBAAiB,KAAK,UAAU,UAAU,GAAG,cAAc,2BAA2B;QAC3F,IAAI;KACL,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACtB,kBAAkB,CAAC,QAAQ,CAAC,GAA8B,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAU,EACV,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IACE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,EACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,EAAU,EACV,KAAwB,EACxB,KAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ;QACtE,cAAc,EACZ,KAAK,CAAC,cAAc,KAAK,SAAS;YAChC,CAAC,CAAC,GAAG,CAAC,cAAc;YACpB,CAAC,CAAC,KAAK,CAAC,cAAc;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QAC1E,MAAM,EACJ,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;QACzE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;QAClC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QAC1E,eAAe,EACb,KAAK,CAAC,eAAe,KAAK,SAAS;YACjC,CAAC,CAAC,GAAG,CAAC,eAAe;YACrB,CAAC,CAAC,KAAK,CAAC,eAAe;QAC3B,aAAa,EACX,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,GAAG,CAAC,aAAa;YACnB,CAAC,CAAC,KAAK,CAAC,aAAa;QACzB,cAAc,EACZ,KAAK,CAAC,cAAc,KAAK,SAAS;YAChC,CAAC,CAAC,GAAG,CAAC,cAAc;YACpB,CAAC,CAAC,KAAK,CAAC,cAAc;KAC3B,CAAC;IACF,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE,UAAU,KAAK;;6EAEqD;QACzE,IAAI,EAAE;YACJ,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,MAAM;YACX,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,eAAe;YACpB,IAAI,CAAC,aAAa;YAClB,IAAI,CAAC,cAAc;YACnB,IAAI,CAAC,GAAG,EAAE;YACV,EAAE;SACH;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,EAAU,EACV,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,eAAe,CAAC;QACpB,GAAG,EAAE,GAAG,CAAC,cAAc;QACvB,KAAK,EAAE,GAAG,CAAC,WAAW;QACtB,OAAO,EAAE,GAAG,CAAC,aAAa;KAC3B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EAAE,UAAU,KAAK;;mBAEL;QACf,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAgB,EAChB,eAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAChE,OAAO,IAAI,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACjC,GAAG,EAAE,GAAG,CAAC,cAAc;QACvB,KAAK,EAAE,GAAG,CAAC,WAAW;QACtB,OAAO,EAAE,GAAG,CAAC,aAAa;KAC3B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAoC,CAAC;QAC3E,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;YAC/D,OAAO,IAAI,CAAC;QACd,OAAO,MAAgC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,QAAgB,EAChB,eAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,QAAgB,EAChB,QAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,iBAAiB,KAAK;;;uCAGQ;QACnC,IAAI,EAAE;YACJ,iBAAiB,CAAC,QAAQ,CAAC;YAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC;AACX,CAAC","sourcesContent":["/**\n * Durable metadata and encrypted credentials for managed messaging installs.\n *\n * The installation row deliberately contains only provider metadata and an\n * opaque `app_secrets` key. OAuth access and refresh tokens are serialized as\n * one bundle and encrypted by the framework secrets vault. List/read helpers\n * never expose the secret key or token values.\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\n\nimport {\n  getDbExec,\n  intType,\n  isPostgres,\n  isUniqueViolation,\n  retryOnDdlRace,\n} from \"../db/client.js\";\nimport { ensureIndexExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport type { SecretScope } from \"../secrets/register.js\";\nimport {\n  deleteAppSecret,\n  readAppSecret,\n  writeAppSecret,\n} from \"../secrets/storage.js\";\n\nconst TABLE = \"integration_installations\";\nlet _initPromise: Promise<void> | undefined;\n\nexport type IntegrationInstallationStatus =\n  | \"connected\"\n  | \"disconnected\"\n  | \"revoked\"\n  | \"error\";\n\nexport type IntegrationInstallationHealth =\n  | \"unknown\"\n  | \"healthy\"\n  | \"degraded\"\n  | \"revoked\";\n\nexport interface IntegrationTokenBundle {\n  accessToken: string;\n  refreshToken?: string;\n  tokenType?: string;\n  expiresAt?: number;\n}\n\n/** Safe-to-return installation metadata. No secret reference or token value. */\nexport interface IntegrationInstallation {\n  id: string;\n  platform: string;\n  installationKey: string;\n  teamId: string | null;\n  teamName: string | null;\n  enterpriseId: string | null;\n  enterpriseName: string | null;\n  isEnterpriseInstall: boolean;\n  apiAppId: string | null;\n  botUserId: string | null;\n  scopes: string[];\n  installedByExternalUserId: string | null;\n  ownerEmail: string;\n  orgId: string | null;\n  status: IntegrationInstallationStatus;\n  health: IntegrationInstallationHealth;\n  lastError: string | null;\n  healthCheckedAt: number | null;\n  lastHealthyAt: number | null;\n  tokenExpiresAt: number | null;\n  createdAt: number;\n  updatedAt: number;\n  disconnectedAt: number | null;\n}\n\ninterface RawInstallation extends IntegrationInstallation {\n  tokenSecretKey: string;\n  secretScope: SecretScope;\n  secretScopeId: string;\n}\n\nexport interface InstallationActor {\n  userEmail: string;\n  orgId?: string | null;\n  /** Must come from a verified active organization membership. */\n  isOrgAdmin?: boolean;\n}\n\nexport interface UpsertIntegrationInstallationInput {\n  platform: string;\n  installationKey: string;\n  teamId?: string | null;\n  teamName?: string | null;\n  enterpriseId?: string | null;\n  enterpriseName?: string | null;\n  isEnterpriseInstall?: boolean;\n  apiAppId?: string | null;\n  botUserId?: string | null;\n  scopes?: readonly string[];\n  installedByExternalUserId?: string | null;\n  ownerEmail: string;\n  orgId?: string | null;\n  secretScope: SecretScope;\n  secretScopeId: string;\n  tokenBundle: IntegrationTokenBundle;\n  status?: IntegrationInstallationStatus;\n  health?: IntegrationInstallationHealth;\n  lastError?: string | null;\n  healthCheckedAt?: number | null;\n  lastHealthyAt?: number | null;\n  tokenExpiresAt?: number | null;\n}\n\nexport interface IntegrationInstallationUpdate {\n  teamName?: string | null;\n  enterpriseName?: string | null;\n  botUserId?: string | null;\n  scopes?: readonly string[];\n  status?: IntegrationInstallationStatus;\n  health?: IntegrationInstallationHealth;\n  lastError?: string | null;\n  healthCheckedAt?: number | null;\n  lastHealthyAt?: number | null;\n  tokenExpiresAt?: number | null;\n}\n\nfunction createSql(): string {\n  const integer = intType();\n  return `CREATE TABLE IF NOT EXISTS ${TABLE} (\n    id TEXT PRIMARY KEY,\n    platform TEXT NOT NULL,\n    installation_key TEXT NOT NULL,\n    team_id TEXT,\n    team_name TEXT,\n    enterprise_id TEXT,\n    enterprise_name TEXT,\n    is_enterprise_install ${integer} NOT NULL DEFAULT 0,\n    api_app_id TEXT,\n    bot_user_id TEXT,\n    scopes_json TEXT NOT NULL DEFAULT '[]',\n    installed_by_external_user_id TEXT,\n    owner_email TEXT NOT NULL,\n    org_id TEXT,\n    token_secret_key TEXT NOT NULL,\n    secret_scope TEXT NOT NULL,\n    secret_scope_id TEXT NOT NULL,\n    status TEXT NOT NULL DEFAULT 'connected',\n    health TEXT NOT NULL DEFAULT 'unknown',\n    last_error TEXT,\n    health_checked_at ${integer},\n    last_healthy_at ${integer},\n    token_expires_at ${integer},\n    created_at ${integer} NOT NULL,\n    updated_at ${integer} NOT NULL,\n    disconnected_at ${integer}\n  )`;\n}\n\nconst INDEXES = [\n  [\n    \"idx_integration_installations_key\",\n    `CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_installations_key ON ${TABLE}(platform, installation_key)`,\n  ],\n  [\n    \"idx_integration_installations_team\",\n    `CREATE INDEX IF NOT EXISTS idx_integration_installations_team ON ${TABLE}(platform, team_id, status)`,\n  ],\n  [\n    \"idx_integration_installations_owner\",\n    `CREATE INDEX IF NOT EXISTS idx_integration_installations_owner ON ${TABLE}(owner_email, updated_at)`,\n  ],\n  [\n    \"idx_integration_installations_org\",\n    `CREATE INDEX IF NOT EXISTS idx_integration_installations_org ON ${TABLE}(org_id, updated_at)`,\n  ],\n] as const;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const ddl = createSql();\n      if (isPostgres()) {\n        await ensureTableExists(TABLE, ddl);\n        for (const [name, sql] of INDEXES) {\n          await ensureIndexExists(name, sql);\n        }\n        return;\n      }\n      await retryOnDdlRace(() => client.execute(ddl));\n      for (const [, sql] of INDEXES) {\n        await retryOnDdlRace(() => client.execute(sql));\n      }\n    })().catch((error) => {\n      _initPromise = undefined;\n      throw error;\n    });\n  }\n  return _initPromise;\n}\n\nfunction required(value: string, name: string): string {\n  const normalized = value.trim();\n  if (!normalized) throw new Error(`${name} is required`);\n  if (normalized.length > 512) throw new Error(`${name} is too long`);\n  return normalized;\n}\n\nfunction normalizePlatform(value: string): string {\n  return required(value, \"platform\").toLowerCase();\n}\n\nfunction normalizeEmail(value: string): string {\n  return required(value, \"ownerEmail\").toLowerCase();\n}\n\nfunction normalizeScopes(scopes: readonly string[] | undefined): string[] {\n  return Array.from(\n    new Set(\n      (scopes ?? [])\n        .map((scope) => scope.trim())\n        .filter(Boolean)\n        .sort(),\n    ),\n  );\n}\n\nfunction parseScopes(value: unknown): string[] {\n  if (typeof value !== \"string\") return [];\n  try {\n    const parsed: unknown = JSON.parse(value);\n    return Array.isArray(parsed) &&\n      parsed.every((item) => typeof item === \"string\")\n      ? parsed\n      : [];\n  } catch {\n    return [];\n  }\n}\n\nfunction toBoolean(value: unknown): boolean {\n  return value === true || value === 1 || value === \"1\" || value === \"true\";\n}\n\nfunction nullableNumber(value: unknown): number | null {\n  return value == null ? null : Number(value);\n}\n\nfunction rowToRaw(row: Record<string, unknown>): RawInstallation {\n  return {\n    id: String(row.id),\n    platform: String(row.platform),\n    installationKey: String(row.installation_key),\n    teamId: (row.team_id as string | null) ?? null,\n    teamName: (row.team_name as string | null) ?? null,\n    enterpriseId: (row.enterprise_id as string | null) ?? null,\n    enterpriseName: (row.enterprise_name as string | null) ?? null,\n    isEnterpriseInstall: toBoolean(row.is_enterprise_install),\n    apiAppId: (row.api_app_id as string | null) ?? null,\n    botUserId: (row.bot_user_id as string | null) ?? null,\n    scopes: parseScopes(row.scopes_json),\n    installedByExternalUserId:\n      (row.installed_by_external_user_id as string | null) ?? null,\n    ownerEmail: String(row.owner_email),\n    orgId: (row.org_id as string | null) ?? null,\n    tokenSecretKey: String(row.token_secret_key),\n    secretScope: row.secret_scope as SecretScope,\n    secretScopeId: String(row.secret_scope_id),\n    status: row.status as IntegrationInstallationStatus,\n    health: row.health as IntegrationInstallationHealth,\n    lastError: (row.last_error as string | null) ?? null,\n    healthCheckedAt: nullableNumber(row.health_checked_at),\n    lastHealthyAt: nullableNumber(row.last_healthy_at),\n    tokenExpiresAt: nullableNumber(row.token_expires_at),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n    disconnectedAt: nullableNumber(row.disconnected_at),\n  };\n}\n\nfunction toSafeInstallation(row: RawInstallation): IntegrationInstallation {\n  const {\n    tokenSecretKey: _tokenSecretKey,\n    secretScope: _scope,\n    secretScopeId: _scopeId,\n    ...safe\n  } = row;\n  return safe;\n}\n\nfunction tokenSecretKey(platform: string, installationKey: string): string {\n  const digest = createHash(\"sha256\")\n    .update(`${platform}\\0${installationKey}`)\n    .digest(\"hex\")\n    .slice(0, 32);\n  return `integration:${platform}:${digest}:oauth-token-bundle`;\n}\n\nfunction sameOwner(a: string, b: string): boolean {\n  return a.trim().toLowerCase() === b.trim().toLowerCase();\n}\n\nfunction sameScope(\n  row: Pick<RawInstallation, \"ownerEmail\" | \"orgId\">,\n  ownerEmail: string,\n  orgId: string | null,\n): boolean {\n  if (row.orgId || orgId) return !!row.orgId && row.orgId === orgId;\n  return sameOwner(row.ownerEmail, ownerEmail);\n}\n\nfunction canMutate(row: RawInstallation, actor: InstallationActor): boolean {\n  if (row.orgId) {\n    return actor.orgId === row.orgId && actor.isOrgAdmin === true;\n  }\n  return sameOwner(row.ownerEmail, actor.userEmail);\n}\n\nasync function selectRawById(id: string): Promise<RawInstallation | null> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM ${TABLE} WHERE id = ? LIMIT 1`,\n    args: [id],\n  });\n  return rows[0] ? rowToRaw(rows[0] as Record<string, unknown>) : null;\n}\n\nasync function selectRawByKey(\n  platform: string,\n  installationKey: string,\n): Promise<RawInstallation | null> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM ${TABLE} WHERE platform = ? AND installation_key = ? LIMIT 1`,\n    args: [\n      normalizePlatform(platform),\n      required(installationKey, \"installationKey\"),\n    ],\n  });\n  return rows[0] ? rowToRaw(rows[0] as Record<string, unknown>) : null;\n}\n\n/**\n * Create or refresh a managed install. Re-installs may rotate tokens inside\n * the same owner/org scope, but cannot silently move an existing provider\n * installation into another Agent Native tenant.\n */\nexport async function upsertIntegrationInstallation(\n  input: UpsertIntegrationInstallationInput,\n): Promise<IntegrationInstallation> {\n  await ensureTable();\n  const platform = normalizePlatform(input.platform);\n  const installationKey = required(input.installationKey, \"installationKey\");\n  const ownerEmail = normalizeEmail(input.ownerEmail);\n  const orgId = input.orgId?.trim() || null;\n  const secretScopeId = required(input.secretScopeId, \"secretScopeId\");\n  const accessToken = input.tokenBundle.accessToken?.trim();\n  if (!accessToken) throw new Error(\"tokenBundle.accessToken is required\");\n\n  const existing = await selectRawByKey(platform, installationKey);\n  if (existing && !sameScope(existing, ownerEmail, orgId)) {\n    throw new Error(\n      \"This provider installation is already connected to another owner or organization.\",\n    );\n  }\n\n  const secretKey =\n    existing?.tokenSecretKey ?? tokenSecretKey(platform, installationKey);\n  const persistTokenBundle = (key: string) =>\n    writeAppSecret({\n      key,\n      value: JSON.stringify(input.tokenBundle),\n      scope: input.secretScope,\n      scopeId: secretScopeId,\n      description: `${platform} OAuth token bundle for a managed installation`,\n    });\n  await persistTokenBundle(secretKey);\n\n  const now = Date.now();\n  let id = existing?.id ?? randomUUID();\n  const scopesJson = JSON.stringify(normalizeScopes(input.scopes));\n  const tokenExpiresAt =\n    input.tokenExpiresAt ?? input.tokenBundle.expiresAt ?? null;\n\n  const updateExisting = async (rowId: string, rowSecretKey: string) => {\n    await getDbExec().execute({\n      sql: `UPDATE ${TABLE} SET\n        team_id = ?, team_name = ?, enterprise_id = ?, enterprise_name = ?,\n        is_enterprise_install = ?, api_app_id = ?, bot_user_id = ?, scopes_json = ?,\n        installed_by_external_user_id = ?, owner_email = ?, org_id = ?,\n        token_secret_key = ?, secret_scope = ?, secret_scope_id = ?, status = ?,\n        health = ?, last_error = ?, health_checked_at = ?, last_healthy_at = ?,\n        token_expires_at = ?, updated_at = ?, disconnected_at = ?\n        WHERE id = ?`,\n      args: [\n        input.teamId ?? null,\n        input.teamName ?? null,\n        input.enterpriseId ?? null,\n        input.enterpriseName ?? null,\n        input.isEnterpriseInstall ? 1 : 0,\n        input.apiAppId ?? null,\n        input.botUserId ?? null,\n        scopesJson,\n        input.installedByExternalUserId ?? null,\n        ownerEmail,\n        orgId,\n        rowSecretKey,\n        input.secretScope,\n        secretScopeId,\n        input.status ?? \"connected\",\n        input.health ?? \"unknown\",\n        input.lastError ?? null,\n        input.healthCheckedAt ?? null,\n        input.lastHealthyAt ?? null,\n        tokenExpiresAt,\n        now,\n        null,\n        rowId,\n      ],\n    });\n  };\n\n  if (existing) {\n    await updateExisting(existing.id, existing.tokenSecretKey);\n  } else {\n    try {\n      await getDbExec().execute({\n        sql: `INSERT INTO ${TABLE} (\n          id, platform, installation_key, team_id, team_name, enterprise_id,\n          enterprise_name, is_enterprise_install, api_app_id, bot_user_id,\n          scopes_json, installed_by_external_user_id, owner_email, org_id,\n          token_secret_key, secret_scope, secret_scope_id, status, health,\n          last_error, health_checked_at, last_healthy_at, token_expires_at,\n          created_at, updated_at, disconnected_at\n        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n        args: [\n          id,\n          platform,\n          installationKey,\n          input.teamId ?? null,\n          input.teamName ?? null,\n          input.enterpriseId ?? null,\n          input.enterpriseName ?? null,\n          input.isEnterpriseInstall ? 1 : 0,\n          input.apiAppId ?? null,\n          input.botUserId ?? null,\n          scopesJson,\n          input.installedByExternalUserId ?? null,\n          ownerEmail,\n          orgId,\n          secretKey,\n          input.secretScope,\n          secretScopeId,\n          input.status ?? \"connected\",\n          input.health ?? \"unknown\",\n          input.lastError ?? null,\n          input.healthCheckedAt ?? null,\n          input.lastHealthyAt ?? null,\n          tokenExpiresAt,\n          now,\n          now,\n          null,\n        ],\n      });\n    } catch (error) {\n      if (!isUniqueViolation(error)) throw error;\n\n      const raced = await selectRawByKey(platform, installationKey);\n      if (!raced) throw error;\n      if (!sameScope(raced, ownerEmail, orgId)) {\n        throw new Error(\n          \"This provider installation is already connected to another owner or organization.\",\n        );\n      }\n\n      id = raced.id;\n      if (raced.tokenSecretKey !== secretKey) {\n        await persistTokenBundle(raced.tokenSecretKey);\n      }\n      await updateExisting(raced.id, raced.tokenSecretKey);\n    }\n  }\n\n  const stored = await selectRawById(id);\n  if (!stored) throw new Error(\"Managed installation was not persisted\");\n  return toSafeInstallation(stored);\n}\n\n/** List installations visible to the owner or active organization member. */\nexport async function listIntegrationInstallations(\n  actor: InstallationActor,\n  platform?: string,\n): Promise<IntegrationInstallation[]> {\n  await ensureTable();\n  const ownerEmail = normalizeEmail(actor.userEmail);\n  const args: unknown[] = [ownerEmail];\n  let visibility = \"owner_email = ?\";\n  if (actor.orgId) {\n    visibility = `(owner_email = ? OR org_id = ?)`;\n    args.push(actor.orgId);\n  }\n  let platformFilter = \"\";\n  if (platform) {\n    platformFilter = \" AND platform = ?\";\n    args.push(normalizePlatform(platform));\n  }\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM ${TABLE} WHERE ${visibility}${platformFilter} ORDER BY updated_at DESC`,\n    args,\n  });\n  return rows.map((row) =>\n    toSafeInstallation(rowToRaw(row as Record<string, unknown>)),\n  );\n}\n\n/** Read one installation through owner/org visibility scoping. */\nexport async function getIntegrationInstallation(\n  id: string,\n  actor: InstallationActor,\n): Promise<IntegrationInstallation | null> {\n  const row = await selectRawById(id);\n  if (!row) return null;\n  if (\n    !sameOwner(row.ownerEmail, actor.userEmail) &&\n    (!row.orgId || row.orgId !== actor.orgId)\n  ) {\n    return null;\n  }\n  return toSafeInstallation(row);\n}\n\n/** Update non-secret installation metadata after an owner/admin access check. */\nexport async function updateIntegrationInstallation(\n  id: string,\n  actor: InstallationActor,\n  patch: IntegrationInstallationUpdate,\n): Promise<IntegrationInstallation | null> {\n  const row = await selectRawById(id);\n  if (!row) return null;\n  if (!canMutate(row, actor)) {\n    throw new Error(\"You do not have access to update this installation.\");\n  }\n  const next = {\n    teamName: patch.teamName === undefined ? row.teamName : patch.teamName,\n    enterpriseName:\n      patch.enterpriseName === undefined\n        ? row.enterpriseName\n        : patch.enterpriseName,\n    botUserId: patch.botUserId === undefined ? row.botUserId : patch.botUserId,\n    scopes:\n      patch.scopes === undefined ? row.scopes : normalizeScopes(patch.scopes),\n    status: patch.status ?? row.status,\n    health: patch.health ?? row.health,\n    lastError: patch.lastError === undefined ? row.lastError : patch.lastError,\n    healthCheckedAt:\n      patch.healthCheckedAt === undefined\n        ? row.healthCheckedAt\n        : patch.healthCheckedAt,\n    lastHealthyAt:\n      patch.lastHealthyAt === undefined\n        ? row.lastHealthyAt\n        : patch.lastHealthyAt,\n    tokenExpiresAt:\n      patch.tokenExpiresAt === undefined\n        ? row.tokenExpiresAt\n        : patch.tokenExpiresAt,\n  };\n  await getDbExec().execute({\n    sql: `UPDATE ${TABLE} SET team_name = ?, enterprise_name = ?, bot_user_id = ?,\n      scopes_json = ?, status = ?, health = ?, last_error = ?, health_checked_at = ?,\n      last_healthy_at = ?, token_expires_at = ?, updated_at = ? WHERE id = ?`,\n    args: [\n      next.teamName,\n      next.enterpriseName,\n      next.botUserId,\n      JSON.stringify(next.scopes),\n      next.status,\n      next.health,\n      next.lastError,\n      next.healthCheckedAt,\n      next.lastHealthyAt,\n      next.tokenExpiresAt,\n      Date.now(),\n      id,\n    ],\n  });\n  const updated = await selectRawById(id);\n  return updated ? toSafeInstallation(updated) : null;\n}\n\n/** Delete the encrypted token bundle and retain disconnected audit metadata. */\nexport async function disconnectIntegrationInstallation(\n  id: string,\n  actor: InstallationActor,\n): Promise<IntegrationInstallation | null> {\n  const row = await selectRawById(id);\n  if (!row) return null;\n  if (!canMutate(row, actor)) {\n    throw new Error(\"You do not have access to disconnect this installation.\");\n  }\n  await deleteAppSecret({\n    key: row.tokenSecretKey,\n    scope: row.secretScope,\n    scopeId: row.secretScopeId,\n  });\n  const now = Date.now();\n  await getDbExec().execute({\n    sql: `UPDATE ${TABLE} SET status = 'disconnected', health = 'unknown',\n      last_error = NULL, token_expires_at = NULL, disconnected_at = ?, updated_at = ?\n      WHERE id = ?`,\n    args: [now, now, id],\n  });\n  const updated = await selectRawById(id);\n  return updated ? toSafeInstallation(updated) : null;\n}\n\n/**\n * Resolve credentials for a verified provider webhook/runtime path.\n *\n * This is intentionally separate from every user-facing list/read helper.\n * Callers must first authenticate the provider webhook (or run inside a\n * trusted OAuth callback) and must never log or return the result.\n */\nexport async function resolveIntegrationTokenBundle(\n  platform: string,\n  installationKey: string,\n): Promise<IntegrationTokenBundle | null> {\n  const row = await selectRawByKey(platform, installationKey);\n  if (!row || row.status !== \"connected\" || row.health === \"revoked\")\n    return null;\n  const secret = await readAppSecret({\n    key: row.tokenSecretKey,\n    scope: row.secretScope,\n    scopeId: row.secretScopeId,\n  });\n  if (!secret) return null;\n  try {\n    const parsed = JSON.parse(secret.value) as Partial<IntegrationTokenBundle>;\n    if (typeof parsed.accessToken !== \"string\" || !parsed.accessToken)\n      return null;\n    return parsed as IntegrationTokenBundle;\n  } catch {\n    return null;\n  }\n}\n\n/** Safe metadata lookup for a verified provider event. */\nexport async function getActiveIntegrationInstallationByKey(\n  platform: string,\n  installationKey: string,\n): Promise<IntegrationInstallation | null> {\n  const row = await selectRawByKey(platform, installationKey);\n  if (!row || row.status !== \"connected\") return null;\n  return toSafeInstallation(row);\n}\n\n/** Resolve a connected installation by workspace or enterprise tenant id. */\nexport async function getActiveIntegrationInstallationForTenant(\n  platform: string,\n  tenantId: string,\n): Promise<IntegrationInstallation | null> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM ${TABLE}\n      WHERE platform = ? AND (team_id = ? OR enterprise_id = ?)\n        AND status = 'connected'\n      ORDER BY updated_at DESC LIMIT 1`,\n    args: [\n      normalizePlatform(platform),\n      required(tenantId, \"tenantId\"),\n      required(tenantId, \"tenantId\"),\n    ],\n  });\n  return rows[0]\n    ? toSafeInstallation(rowToRaw(rows[0] as Record<string, unknown>))\n    : null;\n}\n"]}

package/dist/integrations/integration-memory.d.ts

@@ -0,0 +1,24 @@
+import type { ActionEntry } from "../agent/production-agent.js";
+export declare function listIntegrationMemory(scopeId?: string): Promise<{
+    name: string;
+    path: string;
+    updatedAt: number;
+    size: number;
+}[]>;
+export declare function rememberForIntegrationScope(input: {
+    name: string;
+    description: string;
+    content: string;
+}, scopeId?: string): Promise<{
+    name: string;
+    description: string;
+}>;
+export declare function forgetIntegrationMemory(input: {
+    name: string;
+}, scopeId?: string): Promise<{
+    name: string;
+    deleted: boolean;
+}>;
+export declare function loadIntegrationMemoryPrompt(scopeId: string | undefined): Promise<string>;
+export declare function integrationMemoryActions(): Record<string, ActionEntry>;
+//# sourceMappingURL=integration-memory.d.ts.map

package/dist/integrations/integration-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-memory.d.ts","sourceRoot":"","sources":["../../src/integrations/integration-memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA6ChE,wBAAsB,qBAAqB,CAAC,OAAO,SAAmB;;;;;KAWrE;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB,EACD,OAAO,SAAmB,GACzB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBhD;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;CACd,EACD,OAAO,SAAmB,GACzB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAc7C;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAmDtE"}