@agent-native/core 0.95.0 → 0.95.1

package/dist/server/credential-provider.d.ts

@@ -51,9 +51,11 @@ export declare function readDeployCredentialEnv(key: string): string | undefined
  * single-tenant contexts. In hosted production with a shared database, every
  * signed-in user needs their own user/org/workspace credential for
  * identity-bearing provider keys so one deploy key does not silently
- * impersonate another tenant. App-provided LLM provider keys are different:
- * they intentionally let the app developer pay for model usage for users of
- * that deployed app, so key-aware callers may use those env vars.
+ * impersonate another tenant. App-provided service credentials are different:
+ * they configure the deployed app itself rather than identifying a user. This
+ * includes LLM keys that let the app developer pay for model usage and OAuth
+ * client credentials whose per-user identity remains in scoped OAuth tokens.
+ * Key-aware callers may use those env vars.
  *
  * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
  * provider secrets. This stricter helper remains for legacy call sites with

package/dist/server/credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-provider.d.ts","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK5C;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,YAAY,IAAI,EAAE;QAChB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EASA;CACF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEvE;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,IAAI,OAAO,CAG3D;AAED,wBAAgB,wCAAwC,CACtD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAOT;AA2GD,KAAK,uBAAuB,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;AA0BpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAuMD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvE;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC,OAAO,CAAC,CAG5E;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAO9F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B,CAAC,CA0ED;AAID,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,GAAG,IAAI,CAQf;AAMD,wBAAsB,+BAA+B,CACnD,KAAK,GAAE;IACL,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACL,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CA0B9C;AAED,wBAAsB,kCAAkC,CAAC,OAAO,CAAC,EAAE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAGD,4FAA4F;AAC5F,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAE3D,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,GAAG,IAAI,CAUf;AAMD,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAqChD;AAED,wBAAsB,mCAAmC,CAAC,IAAI,EAAE;IAC9D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE;IAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC,EACD,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAcD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyGvE;AAOD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,IAAI,MAAM,CAO9C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAKjD;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAKzD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAGpD"}
+{"version":3,"file":"credential-provider.d.ts","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK5C;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,YAAY,IAAI,EAAE;QAChB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EASA;CACF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEvE;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iCAAiC,IAAI,OAAO,CAG3D;AAED,wBAAgB,wCAAwC,CACtD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAOT;AA2GD,KAAK,uBAAuB,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;AA0BpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAuMD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvE;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC,OAAO,CAAC,CAG5E;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAO9F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B,CAAC,CA0ED;AAID,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,GAAG,IAAI,CAQf;AAMD,wBAAsB,+BAA+B,CACnD,KAAK,GAAE;IACL,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACL,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CA0B9C;AAED,wBAAsB,kCAAkC,CAAC,OAAO,CAAC,EAAE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAGD,4FAA4F;AAC5F,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAE3D,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,GAAG,IAAI,CAUf;AAMD,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAqChD;AAED,wBAAsB,mCAAmC,CAAC,IAAI,EAAE;IAC9D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE;IAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC,EACD,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAcD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyGvE;AAOD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,IAAI,MAAM,CAO9C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAKjD;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAKzD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAGpD"}

package/dist/server/credential-provider.js

@@ -60,6 +60,8 @@ const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
     "OPENAI_API_KEY",
     "OPENAI_BASE_URL",
     "OPENROUTER_API_KEY",
+    "GOOGLE_CLIENT_ID",
+    "GOOGLE_CLIENT_SECRET",
     "GOOGLE_GENERATIVE_AI_API_KEY",
     "GROQ_API_KEY",
     "MISTRAL_API_KEY",
@@ -73,9 +75,11 @@ function isAppProvidedDeployCredentialKey(key) {
  * single-tenant contexts. In hosted production with a shared database, every
  * signed-in user needs their own user/org/workspace credential for
  * identity-bearing provider keys so one deploy key does not silently
- * impersonate another tenant. App-provided LLM provider keys are different:
- * they intentionally let the app developer pay for model usage for users of
- * that deployed app, so key-aware callers may use those env vars.
+ * impersonate another tenant. App-provided service credentials are different:
+ * they configure the deployed app itself rather than identifying a user. This
+ * includes LLM keys that let the app developer pay for model usage and OAuth
+ * client credentials whose per-user identity remains in scoped OAuth tokens.
+ * Key-aware callers may use those env vars.
  *
  * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
  * provider secrets. This stricter helper remains for legacy call sites with

package/dist/server/credential-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-provider.js","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,KAAgC,EAChC,IAA+B;IAE/B,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,iBAAiB,CAAU;IAC3B,WAAW,CAAU;IAE9B,YAAY,IAKX;QACC,KAAK,CACH,IAAI,CAAC,OAAO;YACV,gCAAgC,IAAI,CAAC,kBAAkB,yCAAyC,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IAClD,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,8BAA8B;IAC9B,cAAc;IACd,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,gCAAgC,CAAC,GAAuB;IAC/D,OAAO,CAAC,CAAC,GAAG,IAAI,mCAAmC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iCAAiC;IAC/C,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,GAAY;IAEZ,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,gCAAgC,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,wBAAwB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,sBAAsB;IACtB,4BAA4B;IAC5B,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;CACjB,CAAC;AAEX,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAQ,uBAA6C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,gBAAgB,GAAG,OAAO,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CACnC,CAAC;IACF,OAAO,CACL,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QAC5D,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAAC;QACjE,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC9C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC7B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,SAAS;YACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CACnB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,+CAA+C;IACtD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,6EAA6E;IAC7E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,aAAa,GACjB,CAAC,mBAAmB;QACpB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAEvE,IAAI,wBAAwB,EAAE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAE/D,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,aAAa,CAAC,IAAI,CACvB,OAAO,CAAC,GAAG,CAAC,qCAAqC;QAC/C,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,EAAE,CACL,CAAC;AACJ,CAAC;AAgCD,SAAS,2BAA2B,CAAC,KAAiC;IACpE,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,aAAmE,EACnE,KAAmC,EACnC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,CAAU,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAwB,MAAM,CAAC,CAAC;IACnD,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAClD,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI;QAChD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAC1C,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI;QAC5C,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI;QAC5C,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,IAAI;QACrD,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,IAAI;QAChE,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,IAAI;QAC9D,YAAY,EAAE,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC1E,aAAa,EAAE,0BAA0B,CACvC,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CACnC;QACD,MAAM,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK;KACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,GAAW;IAEX,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,cAAc,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEhE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;YACrC,GAAG;YACH,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,sBAAsB,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,+DAA+D;QAC/D,6DAA6D;QAC7D,mEAAmE;QACnE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;gBACpC,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,qBAAqB,CACnF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnD,CAAC;YAED,iEAAiE;YACjE,qEAAqE;YACrE,yEAAyE;YACzE,cAAc,GAAG,WAAW,CAAC;YAC7B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC;gBAC1C,GAAG;gBACH,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,2BAA2B,CACzF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/D,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,gCAAgC,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,gBAAgB,CAAC;YAClC,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC;gBAC9C,GAAG;gBACH,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,QAAQ,KAAK,EAAE;aACzB,CAAC,CAAC;YACH,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,gCAAgC,CAC/E,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,8CAA8C,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,cAAc,UAAW,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CACjH,CAAC;QACJ,CAAC;QACD,8CAA8C;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,+BAA+B;IAC5C,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,cAAc,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,CAAC,KAAiC,EAAE,OAAe,EAAE,EAAE;YACxE,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,CAAC,MAAM,YAAY,OAAO,UAAU,KAAK,aAAa,2BAA2B,CAAC,KAAK,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CACtM,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,aAAa,EACb,MAAM,EACN,KAAK,CACN,CAAC;QACF,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,2BAA2B,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAE7D,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,aAAa,EACb,KAAK,EACL,KAAK,CACN,CAAC;YACF,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC5B,IAAI,2BAA2B,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAE3D,cAAc,GAAG,WAAW,CAAC;YAC7B,MAAM,cAAc,GAAG,MAAM,0BAA0B,CACrD,aAAa,EACb,WAAW,EACX,KAAK,CACN,CAAC;YACF,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,2BAA2B,CAAC,cAAc,CAAC;gBAAE,OAAO,cAAc,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,gBAAgB,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,KAAK,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,MAAM,0BAA0B,CACrD,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;YACF,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,2BAA2B,CAAC,cAAc,CAAC;gBAAE,OAAO,cAAc,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,UAAU,cAAc,sBAAuB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,+CAA+C,EAAE;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,GAAG,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,OAAO,CAAC,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IACvD,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;IAClD,MAAM,MAAM,GAAG,MAAM,+BAA+B,EAAE,CAAC;IACvD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACjC,OAAO,+CAA+C,EAAE;QACtD,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAY7C,MAAM,MAAM,GAAG,MAAM,+BAA+B,EAAE,CAAC;IACvD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EACJ,UAAU,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,GAAG,MAAM,CAAC;QACX,OAAO;YACL,UAAU;YACV,SAAS;YACT,MAAM;YACN,OAAO;YACP,OAAO;YACP,YAAY;YACZ,iBAAiB;YACjB,gBAAgB;YAChB,YAAY;YACZ,aAAa;SACd,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,+CAA+C,EAAE;QAClE,CAAC,CAAC,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,SAAS,GAAG,+CAA+C,EAAE;QACjE,CAAC,CAAC,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,+CAA+C,EAAE;QAC9D,CAAC,CAAC,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,+CAA+C,EAAE;QAC/D,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,+CAA+C,EAAE;QAC/D,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,+CAA+C,EAAE;QACpE,CAAC,CAAC,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAG,+CAA+C,EAAE;QACzE,CAAC,CAAC,CAAC,uBAAuB,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,+CAA+C,EAAE;QACxE,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,IAAI,IAAI,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,+CAA+C,EAAE;QACpE,CAAC,CAAC,0BAA0B,CACxB,uBAAuB,CAAC,uBAAuB,CAAC,CACjD;QACH,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,+CAA+C,EAAE;QACrE,CAAC,CAAC,0BAA0B,CACxB,uBAAuB,CAAC,yBAAyB,CAAC,CACnD;QACH,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,UAAU;QACV,SAAS;QACT,MAAM;QACN,OAAO;QACP,OAAO;QACP,YAAY;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAYpE,MAAM,UAAU,4BAA4B,CAC1C,UAA0B,EAC1B,SAAyB;IAEzB,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,WAAmB;IACvD,OAAO,GAAG,mCAAmC,GAAG,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAK,GAGD,EAAE;IAEN,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,WAAW;YACX,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;gBAC5C,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,mEAAmE;YACzE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,EAAE,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YACpD,UAAU,EACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,OAIxD;IACC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,4BAA4B,CAAC,WAAW,CAAC,EAAE;YAC1D,WAAW;YACX,OAAO,EACL,OAAO,EAAE,OAAO;gBAChB,mEAAmE;YACrE,GAAG,CAAC,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5C,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI;YACzC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AACtE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAa3D,MAAM,UAAU,6BAA6B,CAC3C,GAAmB,EACnB,KAAqB;IAErB,MAAM,aAAa,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,eAAe,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,6BAA6B,CAAC,WAAmB;IACxD,OAAO,GAAG,oCAAoC,GAAG,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAGtD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,4BAA4B,EAAE,CAAC;YACnD,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjD,MAAM,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW;YACX,GAAG,EACD,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG;gBACpC,CAAC,CAAC,GAAG,CAAC,GAAG;gBACT,CAAC,CAAC,GAAG,IAAI,sBAAsB;YACnC,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;gBAC5C,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,gDAAgD;YACtD,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,EAAE;YACF,UAAU,EACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,IAMzD;IACC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,6BAA6B,CAAC,WAAW,CAAC,EAAE;YAC3D,WAAW;YACX,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gDAAgD;YACzE,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI;YACzC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,IAGxD;IACC,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,KAWC,EACD,OAAyD;IAEzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,uKAAuK,CACxK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GACvC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,EACL,OAAO,EAAE,KAAK,IAAI,IAAI,EACtB,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IAEF,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,QAAQ,GAA4B,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5E,eAAe,CAAC;QACd,GAAG;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACnB,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE5B,MAAM,OAAO,GAA0C;QACrD,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,EAAE;QACjD,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE;KAChD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,KAAK,EAAE,KAAK,CAAC,iBAAiB;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE,KAAK,CAAC,gBAAgB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,uBAAuB;YAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,yBAAyB;YAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAC7B,cAAc,CAAC;QACb,GAAG;QACH,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CACH,CACF,CAAC;IACF,MAAM,iCAAiC,CAAC;QACtC,UAAU;QACV,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,OAAyD;IAEzD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,EACL,OAAO,EAAE,KAAK,IAAI,IAAI,EACtB,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAClC,eAAe,CAAC;QACd,GAAG;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACnB,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,+DAA+D;AAC/D,gFAAgF;AAChF,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAChE,2BAA2B;YAC3B,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;gBACrC,GAAG;gBACH,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,KAAK,EAAE,CAAC;gBACtB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,sBAAsB,CACjE,CAAC;gBACJ,CAAC;gBACD,OAAO,UAAU,CAAC,KAAK,CAAC;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,kEAAkE;gBAClE,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;oBACpC,GAAG;oBACH,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;oBACrB,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,qBAAqB,CAC/E,CAAC;oBACJ,CAAC;oBACD,OAAO,SAAS,CAAC,KAAK,CAAC;gBACzB,CAAC;gBAED,6DAA6D;gBAC7D,mEAAmE;gBACnE,4BAA4B;gBAC5B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC;oBAC1C,GAAG;oBACH,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,eAAe,EAAE,KAAK,EAAE,CAAC;oBAC3B,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,2BAA2B,CACrF,CAAC;oBACJ,CAAC;oBACD,OAAO,eAAe,CAAC,KAAK,CAAC;gBAC/B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC;oBAC9C,GAAG;oBACH,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,QAAQ,KAAK,EAAE;iBACzB,CAAC,CAAC;gBACH,IAAI,mBAAmB,EAAE,KAAK,EAAE,CAAC;oBAC/B,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,gCAAgC,CAC3E,CAAC;oBACJ,CAAC;oBACD,OAAO,mBAAmB,CAAC,KAAK,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,oBAAqB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAC/F,CAAC;YACJ,CAAC;YACD,8CAA8C;QAChD,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,WAAW,GAAG,CAClB,sBAAsB,CAAC,GAAG,CAAC;YACzB,CAAC,CAAC,+CAA+C,EAAE;YACnD,CAAC,CAAC,wCAAwC,CAAC,GAAG,CAAC,CAClD;YACC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;YAC1B,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,eAAe,EAAE,IAAI,QAAQ,UAAU,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,WAAW,EAAE,CACxJ,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvC,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,yCAAyC,CAAC,CAAC,KAAK,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,iEAAiE;AACjE,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB;IACnC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iCAAiC;QAC7C,+CAA+C,CAChD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACvC,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Credential provider abstraction.\n *\n * Every feature that needs an external credential (Anthropic API key,\n * Google OAuth tokens, OpenAI key, Slack bot token, etc.) should go through\n * one of the resolve*() helpers here instead of reading `process.env`\n * directly. That way the same feature can work in three modes:\n *\n *   1. User set their own key in .env              → use it directly\n *   2. User connected Builder via `/cli-auth`      → route through Builder proxy\n *   3. Neither                                      → throw FeatureNotConfigured\n *\n * Templates catch FeatureNotConfigured and show a \"Connect Builder (1 click) /\n * set up your own key (guide)\" card.\n *\n * Today these helpers are used by the Builder-hosted LLM gateway, and the\n * shape is meant to grow to cover future managed credential integrations\n * (e.g. additional Builder-hosted services) without rewrites.\n */\n\nimport { createHash } from \"node:crypto\";\n\nimport { isLocalDatabase } from \"../db/client.js\";\nimport { getRequestUserEmail, getRequestOrgId } from \"./request-context.js\";\n\n/**\n * Decide which `app_secrets` scope a Builder/credential write should use.\n *\n * Org scope (\"everyone in this org sees these credentials\") wins when the\n * connecting user is an owner or admin of an active org — the write\n * privileges shared infra. A plain member or a user without an active\n * org falls through to per-user scope so a teammate can't silently\n * overwrite the org-shared connection.\n */\nexport function resolveCredentialWriteScope(\n  email: string,\n  orgId: string | null | undefined,\n  role: string | null | undefined,\n): { scope: \"user\" | \"org\"; scopeId: string } {\n  if (orgId && (role === \"owner\" || role === \"admin\")) {\n    return { scope: \"org\", scopeId: orgId };\n  }\n  return { scope: \"user\", scopeId: email };\n}\n\nexport class FeatureNotConfiguredError extends Error {\n  readonly requiredCredential: string;\n  readonly builderConnectUrl?: string;\n  readonly byokDocsUrl?: string;\n\n  constructor(opts: {\n    requiredCredential: string;\n    message?: string;\n    builderConnectUrl?: string;\n    byokDocsUrl?: string;\n  }) {\n    super(\n      opts.message ??\n        `Feature requires credential \"${opts.requiredCredential}\". Connect Builder or set your own key.`,\n    );\n    this.name = \"FeatureNotConfiguredError\";\n    this.requiredCredential = opts.requiredCredential;\n    this.builderConnectUrl = opts.builderConnectUrl;\n    this.byokDocsUrl = opts.byokDocsUrl;\n  }\n}\n\n/**\n * Deployment-level credential fallback for single-tenant/local operation.\n * Multi-tenant call sites must gate this explicitly before calling.\n */\nexport function readDeployCredentialEnv(key: string): string | undefined {\n  return process.env[key] || undefined;\n}\n\nconst APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([\n  \"ANTHROPIC_API_KEY\",\n  \"OPENAI_API_KEY\",\n  \"OPENAI_BASE_URL\",\n  \"OPENROUTER_API_KEY\",\n  \"GOOGLE_GENERATIVE_AI_API_KEY\",\n  \"GROQ_API_KEY\",\n  \"MISTRAL_API_KEY\",\n  \"COHERE_API_KEY\",\n]);\n\nfunction isAppProvidedDeployCredentialKey(key: string | undefined): boolean {\n  return !!key && APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS.has(key);\n}\n\n/**\n * Deployment-level credentials are safe as a runtime fallback only in local /\n * single-tenant contexts. In hosted production with a shared database, every\n * signed-in user needs their own user/org/workspace credential for\n * identity-bearing provider keys so one deploy key does not silently\n * impersonate another tenant. App-provided LLM provider keys are different:\n * they intentionally let the app developer pay for model usage for users of\n * that deployed app, so key-aware callers may use those env vars.\n *\n * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic\n * provider secrets. This stricter helper remains for legacy call sites with\n * identity-bearing deploy credentials.\n */\nexport function isDeployCredentialFallbackAllowed(): boolean {\n  if (!isProductionLikeRuntime()) return true;\n  return isLocalDatabase();\n}\n\nexport function canUseDeployCredentialFallbackForRequest(\n  key?: string,\n): boolean {\n  const email = getRequestUserEmail();\n  if (!email) return true;\n  if (isAppProvidedDeployCredentialKey(key)) return true;\n  if (isHostedWorkspaceRuntime()) return false;\n  if (!isProductionLikeRuntime()) return true;\n  return isLocalDatabase();\n}\n\nconst BUILDER_CREDENTIAL_KEYS = [\n  \"BUILDER_PRIVATE_KEY\",\n  \"BUILDER_PUBLIC_KEY\",\n  \"BUILDER_USER_ID\",\n  \"BUILDER_ORG_NAME\",\n  \"BUILDER_ORG_KIND\",\n  \"BUILDER_SUBSCRIPTION\",\n  \"BUILDER_SUBSCRIPTION_LEVEL\",\n  \"BUILDER_SUBSCRIPTION_NAME\",\n  \"BUILDER_IS_ENTERPRISE\",\n  \"BUILDER_IS_FREE_ACCOUNT\",\n] as const;\n\nfunction isBuilderCredentialKey(key: string): boolean {\n  return (BUILDER_CREDENTIAL_KEYS as readonly string[]).includes(key);\n}\n\nfunction isHostedWorkspaceRuntime(): boolean {\n  const hasFusionPreview = Boolean(\n    process.env.FUSION_ENVIRONMENT ||\n    process.env.FUSION_ENV_ORIGIN ||\n    process.env.VITE_FUSION_ENV_ORIGIN,\n  );\n  return (\n    /^(1|true)$/i.test(process.env.AGENT_NATIVE_WORKSPACE ?? \"\") ||\n    /^(1|true)$/i.test(process.env.VITE_AGENT_NATIVE_WORKSPACE ?? \"\") ||\n    hasFusionPreview\n  );\n}\n\nfunction isProductionLikeRuntime(): boolean {\n  return (\n    process.env.NODE_ENV === \"production\" ||\n    /^(1|true)$/i.test(process.env.NETLIFY ?? \"\") ||\n    /^(1|true)$/i.test(process.env.VERCEL ?? \"\") ||\n    /^(1|true)$/i.test(process.env.CF_PAGES ?? \"\") ||\n    Boolean(\n      process.env.AWS_LAMBDA_FUNCTION_NAME ||\n      process.env.AWS_EXECUTION_ENV ||\n      process.env.FUNCTIONS_WORKER_RUNTIME ||\n      process.env.K_SERVICE ||\n      process.env.RENDER,\n    )\n  );\n}\n\n/**\n * Whether deployment-level Builder env keys may back the current request.\n *\n * This is intentionally self-contained rather than delegating to\n * `canUseDeployCredentialFallbackForRequest`. That generic helper blocks the\n * deploy fallback for any signed-in user in a hosted workspace runtime, so the\n * Builder dogfooding escape hatch must apply its own hosted-workspace exception\n * here instead of inheriting the generic helper's stricter (and hatch-unaware)\n * decision. Reading the env once into locals keeps the rules legible.\n *\n * Rules (all evaluated against the live request/runtime, not a build-time value):\n *  - No signed-in user → safe to use the deploy env (nobody to mis-identify).\n *  - Hosted workspace + signed-in user → deploy-level Builder keys would\n *    impersonate that user, so block them — UNLESS a developer has explicitly\n *    opted into the local dogfooding escape hatch (non-prod only). Default OFF;\n *    hosted/shared production deployments are never affected.\n *  - Otherwise → allowed in non-prod, or on a local/single-tenant database.\n */\nfunction canUseBuilderDeployCredentialFallbackForRequest(): boolean {\n  const email = getRequestUserEmail();\n  if (!email) return true;\n\n  const isProductionRuntime = isProductionLikeRuntime();\n  // Local dogfooding escape hatch: lets the env / root-`.env` Builder key back\n  // a signed-in user so running the app locally doesn't require completing the\n  // Builder connect flow first. Non-prod only.\n  const localDevOptIn =\n    !isProductionRuntime &&\n    /^(1|true)$/i.test(process.env.AGENT_NATIVE_LOCAL_BUILDER_ENV ?? \"\");\n\n  if (isHostedWorkspaceRuntime() && !localDevOptIn) return false;\n\n  // Deploy fallback is safe in non-prod or on a local/single-tenant database.\n  return !isProductionRuntime || isLocalDatabase();\n}\n\nfunction shouldTraceCredentialResolve(): boolean {\n  return /^(1|true)$/i.test(\n    process.env.AGENT_NATIVE_DEBUG_CREDENTIAL_RESOLVE ??\n      process.env.DEBUG_CREDENTIAL_RESOLVE ??\n      \"\",\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Builder credential resolution:\n//\n//   1. **Request-scoped credentials.** A signed-in user can connect Builder\n//      through the CLI-auth flow. Owner/admin connections land at org scope;\n//      member/no-org connections land at user scope.\n//\n//   2. **Deployment fallback.** BUILDER_PRIVATE_KEY in env still makes local\n//      and single-tenant deploys work out of the box, but it no longer blocks\n//      per-user connect. Request-scoped credentials win whenever present.\n//\n// To run multi-tenant SaaS: prefer leaving BUILDER_PRIVATE_KEY unset unless a\n// shared fallback identity is intentional.\n// ---------------------------------------------------------------------------\n\ntype BuilderCredentialSource = \"user\" | \"org\" | \"workspace\" | \"env\";\ninterface BuilderResolvedCredentials {\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n  source: Exclude<BuilderCredentialSource, \"env\">;\n}\n\nfunction isCompleteBuilderConnection(creds: BuilderResolvedCredentials) {\n  return Boolean(creds.privateKey && creds.publicKey);\n}\n\nfunction readOptionalBuilderBoolean(\n  value: string | null | undefined,\n): boolean | null {\n  if (value == null || value === \"\") return null;\n  return /^(1|true)$/i.test(value);\n}\n\nexport function isBuilderPrivateKey(value: string | null | undefined): boolean {\n  return typeof value === \"string\" && value.trim().startsWith(\"bpk-\");\n}\n\nasync function readBuilderCredentialScope(\n  readAppSecret: typeof import(\"../secrets/storage.js\").readAppSecret,\n  scope: \"user\" | \"org\" | \"workspace\",\n  scopeId: string,\n): Promise<BuilderResolvedCredentials> {\n  const values = await Promise.all(\n    BUILDER_CREDENTIAL_KEYS.map(async (key) => {\n      const secret = await readAppSecret({ key, scope, scopeId });\n      return [key, secret?.value ?? null] as const;\n    }),\n  );\n  const map = new Map<string, string | null>(values);\n  return {\n    privateKey: map.get(\"BUILDER_PRIVATE_KEY\") ?? null,\n    publicKey: map.get(\"BUILDER_PUBLIC_KEY\") ?? null,\n    userId: map.get(\"BUILDER_USER_ID\") ?? null,\n    orgName: map.get(\"BUILDER_ORG_NAME\") ?? null,\n    orgKind: map.get(\"BUILDER_ORG_KIND\") ?? null,\n    subscription: map.get(\"BUILDER_SUBSCRIPTION\") ?? null,\n    subscriptionLevel: map.get(\"BUILDER_SUBSCRIPTION_LEVEL\") ?? null,\n    subscriptionName: map.get(\"BUILDER_SUBSCRIPTION_NAME\") ?? null,\n    isEnterprise: readOptionalBuilderBoolean(map.get(\"BUILDER_IS_ENTERPRISE\")),\n    isFreeAccount: readOptionalBuilderBoolean(\n      map.get(\"BUILDER_IS_FREE_ACCOUNT\"),\n    ),\n    source: scope === \"workspace\" ? \"workspace\" : scope,\n  };\n}\n\nasync function resolveScopedBuilderCredential(\n  key: string,\n): Promise<{ value: string; source: \"user\" | \"org\" | \"workspace\" } | null> {\n  const email = getRequestUserEmail();\n  if (!email) return null;\n\n  // Trace only when explicitly requested. These diagnostics are useful for\n  // support, but they include account identifiers and run on hot paths.\n  const traceLookup = shouldTraceCredentialResolve();\n  let scopeAttempted = \"user\";\n  try {\n    const { readAppSecret } = await import(\"../secrets/storage.js\");\n\n    // 1. Per-user override: a user can paste their own key in settings to\n    //    overrule the org-shared one (handy for a personal sandbox).\n    const userSecret = await readAppSecret({\n      key,\n      scope: \"user\",\n      scopeId: email,\n    });\n    if (userSecret) {\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} scope=user hit=true`,\n        );\n      }\n      return { value: userSecret.value, source: \"user\" };\n    }\n\n    // 2. Per-org shared credential: when one teammate connects Builder\n    //    as an owner/admin we write the OAuth result at org scope so\n    //    every member of that org gets the AI chat working without\n    //    re-running the connect flow. Resolution falls back here\n    //    silently — the caller never has to know which scope answered.\n    const orgId = getRequestOrgId();\n    if (orgId) {\n      scopeAttempted = \"org\";\n      const orgSecret = await readAppSecret({\n        key,\n        scope: \"org\",\n        scopeId: orgId,\n      });\n      if (orgSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} orgId=${orgId} scope=org hit=true`,\n          );\n        }\n        return { value: orgSecret.value, source: \"org\" };\n      }\n\n      // Older setup flows wrote shared credentials at workspace scope.\n      // Keep reading those rows so status UIs and runtime resolution agree\n      // for users who connected before org-scoped Builder credentials existed.\n      scopeAttempted = \"workspace\";\n      const workspaceSecret = await readAppSecret({\n        key,\n        scope: \"workspace\",\n        scopeId: orgId,\n      });\n      if (workspaceSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} orgId=${orgId} scope=workspace hit=true`,\n          );\n        }\n        return { value: workspaceSecret.value, source: \"workspace\" };\n      }\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} orgId=${orgId} miss tried=user,org,workspace`,\n        );\n      }\n    } else {\n      scopeAttempted = \"workspace-solo\";\n      const soloWorkspaceSecret = await readAppSecret({\n        key,\n        scope: \"workspace\",\n        scopeId: `solo:${email}`,\n      });\n      if (soloWorkspaceSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} scope=workspace-solo hit=true`,\n          );\n        }\n        return { value: soloWorkspaceSecret.value, source: \"workspace\" };\n      }\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} orgId=(none) miss tried=user,workspace-solo`,\n        );\n      }\n    }\n  } catch (err) {\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] key=${key} email=${email} scope=${scopeAttempted} error=${(err as Error)?.message ?? err}`,\n      );\n    }\n    // Secrets table not ready — treat as missing.\n  }\n  return null;\n}\n\nasync function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredentials | null> {\n  const email = getRequestUserEmail();\n  if (!email) return null;\n\n  const traceLookup = shouldTraceCredentialResolve();\n  let scopeAttempted = \"user\";\n  try {\n    const { readAppSecret } = await import(\"../secrets/storage.js\");\n    const traceScope = (creds: BuilderResolvedCredentials, scopeId: string) => {\n      if (!traceLookup) return;\n      console.log(\n        `[builder-credential] scope=${creds.source} scopeId=${scopeId} email=${email} complete=${isCompleteBuilderConnection(creds)} private=${Boolean(creds.privateKey)} public=${Boolean(creds.publicKey)}`,\n      );\n    };\n\n    const userCreds = await readBuilderCredentialScope(\n      readAppSecret,\n      \"user\",\n      email,\n    );\n    traceScope(userCreds, email);\n    if (isCompleteBuilderConnection(userCreds)) return userCreds;\n\n    const orgId = getRequestOrgId();\n    if (orgId) {\n      scopeAttempted = \"org\";\n      const orgCreds = await readBuilderCredentialScope(\n        readAppSecret,\n        \"org\",\n        orgId,\n      );\n      traceScope(orgCreds, orgId);\n      if (isCompleteBuilderConnection(orgCreds)) return orgCreds;\n\n      scopeAttempted = \"workspace\";\n      const workspaceCreds = await readBuilderCredentialScope(\n        readAppSecret,\n        \"workspace\",\n        orgId,\n      );\n      traceScope(workspaceCreds, orgId);\n      if (isCompleteBuilderConnection(workspaceCreds)) return workspaceCreds;\n    } else {\n      scopeAttempted = \"workspace-solo\";\n      const scopeId = `solo:${email}`;\n      const workspaceCreds = await readBuilderCredentialScope(\n        readAppSecret,\n        \"workspace\",\n        scopeId,\n      );\n      traceScope(workspaceCreds, scopeId);\n      if (isCompleteBuilderConnection(workspaceCreds)) return workspaceCreds;\n    }\n  } catch (err) {\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] email=${email} scope=${scopeAttempted} credentials error=${(err as Error)?.message ?? err}`,\n      );\n    }\n  }\n  return null;\n}\n\n/**\n * Resolve a Builder credential for the current request. User/org credentials\n * win; deployment env is only a fallback. This lets local/root .env keys keep\n * a template working while still allowing users to connect their own Builder\n * account from Settings or onboarding.\n */\nexport async function resolveBuilderCredential(\n  key: string,\n): Promise<string | null> {\n  const scoped = await resolveScopedBuilderCredential(key);\n  if (scoped) return scoped.value;\n  if (!canUseBuilderDeployCredentialFallbackForRequest()) return null;\n  return readDeployCredentialEnv(key) ?? null;\n}\n\n/**\n * True when `BUILDER_PRIVATE_KEY` is set at the deployment level. This means\n * a deploy-level fallback exists; it does not prevent per-user connect.\n */\nexport function isBuilderEnvManaged(): boolean {\n  return !!process.env.BUILDER_PRIVATE_KEY;\n}\n\n/**\n * Resolve the Builder private key for the current request. User/org OAuth\n * credentials win; deploy-level `BUILDER_PRIVATE_KEY` is the fallback.\n */\nexport async function resolveBuilderPrivateKey(): Promise<string | null> {\n  return resolveBuilderCredential(\"BUILDER_PRIVATE_KEY\");\n}\n\n/**\n * Resolve the current user's Builder auth header.\n * Returns `\"Bearer <key>\"` or null.\n */\nexport async function resolveBuilderAuthHeader(): Promise<string | null> {\n  const key = await resolveBuilderPrivateKey();\n  return key ? `Bearer ${key}` : null;\n}\n\n/**\n * Check whether the current user has a Builder private key configured\n * (per-user or deployment-level).\n */\nexport async function resolveHasBuilderPrivateKey(): Promise<boolean> {\n  return !!(await resolveBuilderPrivateKey());\n}\n\n/**\n * Check whether the current request has the complete Builder credential bundle\n * needed for Builder-backed assistant/image-generation calls.\n */\nexport async function resolveHasCompleteBuilderConnection(): Promise<boolean> {\n  const creds = await resolveBuilderCredentials();\n  return !!(creds.privateKey && creds.publicKey);\n}\n\n/**\n * Resolve where the effective Builder assistant connection came from. This\n * intentionally requires a complete private+public key pair from one scope so\n * status UIs don't report a mixed user/org credential set as connected.\n */\nexport async function resolveBuilderCredentialSource(): Promise<BuilderCredentialSource | null> {\n  const scoped = await resolveScopedBuilderCredentials();\n  if (scoped) return scoped.source;\n  return canUseBuilderDeployCredentialFallbackForRequest() &&\n    process.env.BUILDER_PRIVATE_KEY\n    ? \"env\"\n    : null;\n}\n\n/**\n * Resolve the Builder assistant credential bundle from one complete scope.\n * A partial user row is treated as a miss so the org-shared connection can\n * still power the assistant for teammates.\n */\nexport async function resolveBuilderCredentials(): Promise<{\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n}> {\n  const scoped = await resolveScopedBuilderCredentials();\n  if (scoped) {\n    const {\n      privateKey,\n      publicKey,\n      userId,\n      orgName,\n      orgKind,\n      subscription,\n      subscriptionLevel,\n      subscriptionName,\n      isEnterprise,\n      isFreeAccount,\n    } = scoped;\n    return {\n      privateKey,\n      publicKey,\n      userId,\n      orgName,\n      orgKind,\n      subscription,\n      subscriptionLevel,\n      subscriptionName,\n      isEnterprise,\n      isFreeAccount,\n    };\n  }\n  const privateKey = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_PRIVATE_KEY\") ?? null)\n    : null;\n  const publicKey = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_PUBLIC_KEY\") ?? null)\n    : null;\n  const userId = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_USER_ID\") ?? null)\n    : null;\n  const orgName = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_ORG_NAME\") ?? null)\n    : null;\n  const orgKind = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_ORG_KIND\") ?? null)\n    : null;\n  const subscription = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION\") ?? null)\n    : null;\n  const subscriptionLevel = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION_LEVEL\") ?? null)\n    : null;\n  const subscriptionName = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION_NAME\") ?? null)\n    : null;\n  const isEnterprise = canUseBuilderDeployCredentialFallbackForRequest()\n    ? readOptionalBuilderBoolean(\n        readDeployCredentialEnv(\"BUILDER_IS_ENTERPRISE\"),\n      )\n    : null;\n  const isFreeAccount = canUseBuilderDeployCredentialFallbackForRequest()\n    ? readOptionalBuilderBoolean(\n        readDeployCredentialEnv(\"BUILDER_IS_FREE_ACCOUNT\"),\n      )\n    : null;\n  return {\n    privateKey,\n    publicKey,\n    userId,\n    orgName,\n    orgKind,\n    subscription,\n    subscriptionLevel,\n    subscriptionName,\n    isEnterprise,\n    isFreeAccount,\n  };\n}\n\nconst BUILDER_AUTH_FAILURE_SETTING_PREFIX = \"builder-auth-failure:\";\n\nexport interface BuilderCredentialAuthFailure {\n  fingerprint: string;\n  message: string;\n  status?: number;\n  code?: string;\n  at: number;\n  ownerEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport function builderCredentialFingerprint(\n  privateKey?: string | null,\n  publicKey?: string | null,\n): string | null {\n  if (!privateKey || !publicKey) return null;\n  return createHash(\"sha256\")\n    .update(privateKey)\n    .update(\"\\0\")\n    .update(publicKey)\n    .digest(\"hex\")\n    .slice(0, 24);\n}\n\nfunction builderAuthFailureSettingKey(fingerprint: string): string {\n  return `${BUILDER_AUTH_FAILURE_SETTING_PREFIX}${fingerprint}`;\n}\n\nexport async function getBuilderCredentialAuthFailure(\n  creds: {\n    privateKey?: string | null;\n    publicKey?: string | null;\n  } = {},\n): Promise<BuilderCredentialAuthFailure | null> {\n  const fingerprint = builderCredentialFingerprint(\n    creds.privateKey,\n    creds.publicKey,\n  );\n  if (!fingerprint) return null;\n  try {\n    const { getSetting } = await import(\"../settings/store.js\");\n    const row = await getSetting(builderAuthFailureSettingKey(fingerprint));\n    if (!row) return null;\n    return {\n      fingerprint,\n      message:\n        typeof row.message === \"string\" && row.message\n          ? row.message\n          : \"Builder rejected the connected credentials. Reconnect Builder.io.\",\n      status: typeof row.status === \"number\" ? row.status : undefined,\n      code: typeof row.code === \"string\" ? row.code : undefined,\n      at: typeof row.at === \"number\" ? row.at : Date.now(),\n      ownerEmail:\n        typeof row.ownerEmail === \"string\" ? row.ownerEmail : undefined,\n      orgId: typeof row.orgId === \"string\" ? row.orgId : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function recordBuilderCredentialAuthFailure(details?: {\n  status?: number;\n  code?: string;\n  message?: string;\n}): Promise<void> {\n  try {\n    const creds = await resolveBuilderCredentials();\n    const fingerprint = builderCredentialFingerprint(\n      creds.privateKey,\n      creds.publicKey,\n    );\n    if (!fingerprint) return;\n    const { putSetting } = await import(\"../settings/store.js\");\n    await putSetting(builderAuthFailureSettingKey(fingerprint), {\n      fingerprint,\n      message:\n        details?.message ||\n        \"Builder rejected the connected credentials. Reconnect Builder.io.\",\n      ...(typeof details?.status === \"number\" && { status: details.status }),\n      ...(details?.code && { code: details.code }),\n      at: Date.now(),\n      ownerEmail: getRequestUserEmail() ?? null,\n      orgId: getRequestOrgId() ?? null,\n    });\n  } catch {\n    // Best-effort marker only; the chat error is still returned to the user.\n  }\n}\n\nexport async function clearBuilderCredentialAuthFailure(creds: {\n  privateKey?: string | null;\n  publicKey?: string | null;\n}): Promise<void> {\n  const fingerprint = builderCredentialFingerprint(\n    creds.privateKey,\n    creds.publicKey,\n  );\n  if (!fingerprint) return;\n  try {\n    const { deleteSetting } = await import(\"../settings/store.js\");\n    await deleteSetting(builderAuthFailureSettingKey(fingerprint));\n  } catch {\n    // A stale failure marker should not block writing fresh credentials.\n  }\n}\n\nconst PROVIDER_AUTH_FAILURE_SETTING_PREFIX = \"provider-auth-failure:\";\n/** Stale failure markers expire so a transient 401 cannot permanently block deploy keys. */\nexport const PROVIDER_AUTH_FAILURE_TTL_MS = 15 * 60 * 1000;\n\nexport interface ProviderCredentialAuthFailure {\n  fingerprint: string;\n  key: string;\n  message: string;\n  status?: number;\n  code?: string;\n  at: number;\n  ownerEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport function providerCredentialFingerprint(\n  key?: string | null,\n  value?: string | null,\n): string | null {\n  const normalizedKey = key?.trim().toUpperCase();\n  const normalizedValue = value?.trim();\n  if (!normalizedKey || !normalizedValue) return null;\n  return createHash(\"sha256\")\n    .update(normalizedKey)\n    .update(\"\\0\")\n    .update(normalizedValue)\n    .digest(\"hex\")\n    .slice(0, 24);\n}\n\nfunction providerAuthFailureSettingKey(fingerprint: string): string {\n  return `${PROVIDER_AUTH_FAILURE_SETTING_PREFIX}${fingerprint}`;\n}\n\nexport async function getProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n}): Promise<ProviderCredentialAuthFailure | null> {\n  const key = opts.key?.trim().toUpperCase() ?? \"\";\n  const fingerprint = providerCredentialFingerprint(key, opts.value);\n  if (!fingerprint) return null;\n  try {\n    const settings = await import(\"../settings/store.js\");\n    const settingKey = providerAuthFailureSettingKey(fingerprint);\n    const row = await settings.getSetting(settingKey);\n    if (!row) return null;\n    if (row.fingerprint !== fingerprint) return null;\n    const at = typeof row.at === \"number\" ? row.at : Date.now();\n    if (Date.now() - at > PROVIDER_AUTH_FAILURE_TTL_MS) {\n      if (typeof settings.deleteSetting === \"function\") {\n        await settings.deleteSetting(settingKey).catch(() => {});\n      }\n      return null;\n    }\n    return {\n      fingerprint,\n      key:\n        typeof row.key === \"string\" && row.key\n          ? row.key\n          : key || \"UNKNOWN_PROVIDER_KEY\",\n      message:\n        typeof row.message === \"string\" && row.message\n          ? row.message\n          : \"The model provider rejected the saved API key.\",\n      status: typeof row.status === \"number\" ? row.status : undefined,\n      code: typeof row.code === \"string\" ? row.code : undefined,\n      at,\n      ownerEmail:\n        typeof row.ownerEmail === \"string\" ? row.ownerEmail : undefined,\n      orgId: typeof row.orgId === \"string\" ? row.orgId : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function recordProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n  status?: number;\n  code?: string;\n  message?: string;\n}): Promise<void> {\n  try {\n    const key = opts.key?.trim().toUpperCase() ?? \"\";\n    const value = opts.value?.trim();\n    const fingerprint = providerCredentialFingerprint(key, value);\n    if (!fingerprint) return;\n    const { putSetting } = await import(\"../settings/store.js\");\n    await putSetting(providerAuthFailureSettingKey(fingerprint), {\n      fingerprint,\n      key,\n      message: opts.message || \"The model provider rejected the saved API key.\",\n      ...(typeof opts.status === \"number\" && { status: opts.status }),\n      ...(opts.code && { code: opts.code }),\n      at: Date.now(),\n      ownerEmail: getRequestUserEmail() ?? null,\n      orgId: getRequestOrgId() ?? null,\n    });\n  } catch {\n    // Best-effort marker only; the chat error is still returned to the user.\n  }\n}\n\nexport async function clearProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n}): Promise<void> {\n  const fingerprint = providerCredentialFingerprint(opts.key, opts.value);\n  if (!fingerprint) return;\n  try {\n    const { deleteSetting } = await import(\"../settings/store.js\");\n    await deleteSetting(providerAuthFailureSettingKey(fingerprint));\n  } catch {\n    // A stale failure marker should not block writing or using fresh keys.\n  }\n}\n\n/**\n * Write Builder credentials to `app_secrets`.\n *\n * Scope decision (see `resolveCredentialWriteScope`): when the connecting\n * user is owner/admin of an active org we write at `scope: \"org\"` so every\n * member of that org auto-resolves the credentials via\n * `resolveBuilderCredential`'s org fallback — no per-user re-connect\n * needed. A plain member or a user with no active org writes at\n * `scope: \"user\"` (the safe default that doesn't trample the org's shared\n * connection).\n *\n * Stale-credential cleanup: before writing the new values we (1) clear ALL\n * five BUILDER_* keys at the target scope, so optional fields the new\n * connection doesn't carry (e.g. user picked a Builder space that returns\n * no orgName) don't leave the previous connection's metadata behind, and\n * (2) when writing at org scope, also clear the writer's own user-scope\n * BUILDER_* rows so a stale personal override from an earlier connect\n * doesn't shadow the new org write on resolution (user scope wins org\n * scope by design — see `resolveScopedBuilderCredential`). The org-scope\n * row is intentionally left alone when writing at user scope: that row is\n * shared with the rest of the org and a single user's personal override\n * shouldn't blow it away. (Victoria's \"I signed in again with my Builder\n * space and it still says no credits\" report on 2026-05-11 was exactly\n * this stale-shadow case.)\n *\n * Returns the actual scope/scopeId used so the caller can show \"Connected\n * for Builder.io\" vs \"Connected (personal)\" in the UI.\n */\nexport async function writeBuilderCredentials(\n  email: string,\n  creds: {\n    privateKey: string;\n    publicKey: string;\n    userId?: string | null;\n    orgName?: string | null;\n    orgKind?: string | null;\n    subscription?: string | null;\n    subscriptionLevel?: string | null;\n    subscriptionName?: string | null;\n    isEnterprise?: boolean | null;\n    isFreeAccount?: boolean | null;\n  },\n  options?: { orgId?: string | null; role?: string | null },\n): Promise<{ scope: \"user\" | \"org\"; scopeId: string }> {\n  const privateKey = creds.privateKey.trim();\n  const publicKey = creds.publicKey.trim();\n  if (!isBuilderPrivateKey(privateKey)) {\n    throw new Error(\n      \"Builder returned a credential that is not a Builder private key (expected bpk-...). Restart the Builder connect flow and choose a space that can issue a private key.\",\n    );\n  }\n  if (!publicKey) {\n    throw new Error(\n      \"Builder did not return a public API key. Restart the Builder connect flow.\",\n    );\n  }\n\n  const { writeAppSecret, deleteAppSecret } =\n    await import(\"../secrets/storage.js\");\n  const target = resolveCredentialWriteScope(\n    email,\n    options?.orgId ?? null,\n    options?.role ?? null,\n  );\n\n  // Clear stale rows before writing the new connection. See the function's\n  // doc comment for the two cases this handles.\n  const cleanups: Array<Promise<unknown>> = BUILDER_CREDENTIAL_KEYS.map((key) =>\n    deleteAppSecret({\n      key,\n      scope: target.scope,\n      scopeId: target.scopeId,\n    }).catch(() => {}),\n  );\n  if (target.scope === \"org\") {\n    for (const key of BUILDER_CREDENTIAL_KEYS) {\n      cleanups.push(\n        deleteAppSecret({ key, scope: \"user\", scopeId: email }).catch(() => {}),\n      );\n    }\n  }\n  await Promise.all(cleanups);\n\n  const entries: Array<{ key: string; value: string }> = [\n    { key: \"BUILDER_PRIVATE_KEY\", value: privateKey },\n    { key: \"BUILDER_PUBLIC_KEY\", value: publicKey },\n  ];\n  if (creds.userId) {\n    entries.push({ key: \"BUILDER_USER_ID\", value: creds.userId });\n  }\n  if (creds.orgName) {\n    entries.push({ key: \"BUILDER_ORG_NAME\", value: creds.orgName });\n  }\n  if (creds.orgKind) {\n    entries.push({ key: \"BUILDER_ORG_KIND\", value: creds.orgKind });\n  }\n  if (creds.subscription) {\n    entries.push({ key: \"BUILDER_SUBSCRIPTION\", value: creds.subscription });\n  }\n  if (creds.subscriptionLevel) {\n    entries.push({\n      key: \"BUILDER_SUBSCRIPTION_LEVEL\",\n      value: creds.subscriptionLevel,\n    });\n  }\n  if (creds.subscriptionName) {\n    entries.push({\n      key: \"BUILDER_SUBSCRIPTION_NAME\",\n      value: creds.subscriptionName,\n    });\n  }\n  if (typeof creds.isEnterprise === \"boolean\") {\n    entries.push({\n      key: \"BUILDER_IS_ENTERPRISE\",\n      value: String(creds.isEnterprise),\n    });\n  }\n  if (typeof creds.isFreeAccount === \"boolean\") {\n    entries.push({\n      key: \"BUILDER_IS_FREE_ACCOUNT\",\n      value: String(creds.isFreeAccount),\n    });\n  }\n  await Promise.all(\n    entries.map(({ key, value }) =>\n      writeAppSecret({\n        key,\n        value,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      }),\n    ),\n  );\n  await clearBuilderCredentialAuthFailure({\n    privateKey,\n    publicKey,\n  });\n  return target;\n}\n\n/**\n * Delete Builder credentials.\n *\n * Default behaviour: clears only this user's per-user override (so a\n * member can disconnect their personal Builder identity without\n * collapsing the org-wide connection for every teammate). To revoke the\n * org's shared connection, pass `{ orgId, role }` for an owner/admin —\n * matching the same authority gate `writeBuilderCredentials` uses on\n * write. Plain members can never reach the org-scoped row.\n */\nexport async function deleteBuilderCredentials(\n  email: string,\n  options?: { orgId?: string | null; role?: string | null },\n): Promise<{ scope: \"user\" | \"org\"; scopeId: string }> {\n  const { deleteAppSecret } = await import(\"../secrets/storage.js\");\n  const target = resolveCredentialWriteScope(\n    email,\n    options?.orgId ?? null,\n    options?.role ?? null,\n  );\n  await Promise.all(\n    BUILDER_CREDENTIAL_KEYS.map((key) =>\n      deleteAppSecret({\n        key,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      }).catch(() => {}),\n    ),\n  );\n  return target;\n}\n\n// ---------------------------------------------------------------------------\n// Generic request-scoped secret resolution\n//\n// New consumers should prefer this over reading `process.env.X` directly.\n// User-pasted and shared secrets live in `app_secrets` (encrypted). The\n// settings UI / onboarding panels can write user, org, or workspace rows.\n// Deploy-level env vars are the fallback for unauthenticated/CLI/background\n// contexts where there's no user to scope by. Authenticated requests may also\n// use app-provided LLM provider keys such as OPENAI_API_KEY or\n// ANTHROPIC_API_KEY, but Builder identity keys keep the stricter scoped policy.\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve a request-scoped secret. Reads from `app_secrets` first (current\n * user override, active org, then workspace row); falls back to `process.env`\n * only when the deploy fallback policy allows it.\n */\nexport async function resolveSecret(key: string): Promise<string | null> {\n  const traceLookup = shouldTraceCredentialResolve();\n  const email = getRequestUserEmail();\n  if (email) {\n    try {\n      const { readAppSecret } = await import(\"../secrets/storage.js\");\n      // Per-user override first.\n      const userSecret = await readAppSecret({\n        key,\n        scope: \"user\",\n        scopeId: email,\n      });\n      if (userSecret?.value) {\n        if (traceLookup) {\n          console.log(\n            `[resolve-secret] key=${key} email=${email} scope=user hit=true`,\n          );\n        }\n        return userSecret.value;\n      }\n\n      const orgId = getRequestOrgId();\n      if (orgId) {\n        // Fall back to the active org's shared row, when present. Builder\n        // Connect uses this first-class org scope.\n        const orgSecret = await readAppSecret({\n          key,\n          scope: \"org\",\n          scopeId: orgId,\n        });\n        if (orgSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=org hit=true`,\n            );\n          }\n          return orgSecret.value;\n        }\n\n        // Registered secrets historically used \"workspace\" scope for\n        // org-shared configuration. Keep reading it so Settings status and\n        // runtime resolution agree.\n        const workspaceSecret = await readAppSecret({\n          key,\n          scope: \"workspace\",\n          scopeId: orgId,\n        });\n        if (workspaceSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=workspace hit=true`,\n            );\n          }\n          return workspaceSecret.value;\n        }\n      } else {\n        const soloWorkspaceSecret = await readAppSecret({\n          key,\n          scope: \"workspace\",\n          scopeId: `solo:${email}`,\n        });\n        if (soloWorkspaceSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} scope=workspace-solo hit=true`,\n            );\n          }\n          return soloWorkspaceSecret.value;\n        }\n      }\n    } catch (err) {\n      if (traceLookup) {\n        console.log(\n          `[resolve-secret] key=${key} email=${email} scope=error err=${(err as Error)?.message ?? err}`,\n        );\n      }\n      // Secrets table not ready — treat as missing.\n    }\n    // Read deployment-provided env values as fallbacks; framework code must not\n    // write to `process.env`, but keys supplied by the host remain valid config.\n    // Builder credentials keep a narrower path below because those keys carry a\n    // Builder identity rather than just enabling a provider call.\n    const envFallback = (\n      isBuilderCredentialKey(key)\n        ? canUseBuilderDeployCredentialFallbackForRequest()\n        : canUseDeployCredentialFallbackForRequest(key)\n    )\n      ? process.env[key] || null\n      : null;\n    if (traceLookup) {\n      console.log(\n        `[resolve-secret] key=${key} email=${email} orgId=${getRequestOrgId() ?? \"(none)\"} scope=${envFallback ? \"env-fallback\" : \"none\"} hit=${!!envFallback}`,\n      );\n    }\n    return envFallback;\n  }\n  // Unauthenticated / local-dev / CLI / background context: env fallback\n  // is safe because there's no user to mis-identify.\n  const value = process.env[key] || null;\n  if (traceLookup) {\n    console.log(\n      `[resolve-secret] key=${key} email=(none) scope=env-anonymous hit=${!!value}`,\n    );\n  }\n  return value;\n}\n\n// ---------------------------------------------------------------------------\n// Synchronous helpers — env-only fallbacks for contexts where per-user\n// lookup isn't possible (sync isConfigured checks, CLI scripts).\n// ---------------------------------------------------------------------------\n\n/**\n * True when a Builder private key is configured at the deployment level.\n *\n * This is the same env-only check as `isBuilderEnvManaged()`. For \"does this\n * request have access to Builder via user/org/env credentials?\" use the async\n * `resolveHasBuilderPrivateKey()`.\n */\nexport function hasBuilderPrivateKey(): boolean {\n  return !!process.env.BUILDER_PRIVATE_KEY;\n}\n\n/** The origin for Builder-proxied API calls. Overridable for testing. */\nexport function getBuilderProxyOrigin(): string {\n  return (\n    process.env.BUILDER_PROXY_ORIGIN ||\n    process.env.AIR_HOST ||\n    process.env.BUILDER_API_HOST ||\n    \"https://api.builder.io\"\n  );\n}\n\n/**\n * Base URL for the public Builder LLM gateway, which lives at\n * api.builder.io/agent-native/gateway.\n * Override via BUILDER_GATEWAY_BASE_URL for staging / testing.\n */\nexport function getBuilderGatewayBaseUrl(): string {\n  return (\n    process.env.BUILDER_GATEWAY_BASE_URL ||\n    \"https://api.builder.io/agent-native/gateway/v1\"\n  );\n}\n\n/**\n * Base URL for Builder-managed image generation.\n * Override via BUILDER_IMAGE_GENERATION_BASE_URL for staging / testing.\n */\nexport function getBuilderImageGenerationBaseUrl(): string {\n  return (\n    process.env.BUILDER_IMAGE_GENERATION_BASE_URL ||\n    \"https://api.builder.io/agent-native/images/v1\"\n  );\n}\n\n/**\n * Base URL for Builder-managed web search.\n * Override via BUILDER_WEB_SEARCH_BASE_URL for staging / testing.\n */\nexport function getBuilderWebSearchBaseUrl(): string {\n  return (\n    process.env.BUILDER_WEB_SEARCH_BASE_URL ||\n    \"https://api.builder.io/agent-native/web-search/v1\"\n  );\n}\n\n/** Authorization header value for Builder-proxied calls (env-only). */\nexport function getBuilderAuthHeader(): string | null {\n  const key = process.env.BUILDER_PRIVATE_KEY;\n  return key ? `Bearer ${key}` : null;\n}\n"]}
+{"version":3,"file":"credential-provider.js","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,KAAgC,EAChC,IAA+B;IAE/B,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,iBAAiB,CAAU;IAC3B,WAAW,CAAU;IAE9B,YAAY,IAKX;QACC,KAAK,CACH,IAAI,CAAC,OAAO;YACV,gCAAgC,IAAI,CAAC,kBAAkB,yCAAyC,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;AACvC,CAAC;AAED,MAAM,mCAAmC,GAAG,IAAI,GAAG,CAAC;IAClD,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,kBAAkB;IAClB,sBAAsB;IACtB,8BAA8B;IAC9B,cAAc;IACd,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,gCAAgC,CAAC,GAAuB;IAC/D,OAAO,CAAC,CAAC,GAAG,IAAI,mCAAmC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iCAAiC;IAC/C,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,GAAY;IAEZ,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,gCAAgC,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,wBAAwB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,uBAAuB,GAAG;IAC9B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,sBAAsB;IACtB,4BAA4B;IAC5B,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;CACjB,CAAC;AAEX,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAQ,uBAA6C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,gBAAgB,GAAG,OAAO,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,sBAAsB,CACnC,CAAC;IACF,OAAO,CACL,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;QAC5D,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAAC;QACjE,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC9C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,iBAAiB;YAC7B,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACpC,OAAO,CAAC,GAAG,CAAC,SAAS;YACrB,OAAO,CAAC,GAAG,CAAC,MAAM,CACnB,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,+CAA+C;IACtD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,6EAA6E;IAC7E,6EAA6E;IAC7E,6CAA6C;IAC7C,MAAM,aAAa,GACjB,CAAC,mBAAmB;QACpB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAEvE,IAAI,wBAAwB,EAAE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAE/D,4EAA4E;IAC5E,OAAO,CAAC,mBAAmB,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,4BAA4B;IACnC,OAAO,aAAa,CAAC,IAAI,CACvB,OAAO,CAAC,GAAG,CAAC,qCAAqC;QAC/C,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,EAAE,CACL,CAAC;AACJ,CAAC;AAgCD,SAAS,2BAA2B,CAAC,KAAiC;IACpE,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAgC;IAEhC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,aAAmE,EACnE,KAAmC,EACnC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,CAAU,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAwB,MAAM,CAAC,CAAC;IACnD,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,IAAI;QAClD,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI;QAChD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI;QAC1C,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI;QAC5C,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,IAAI;QAC5C,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,IAAI;QACrD,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,IAAI;QAChE,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,IAAI;QAC9D,YAAY,EAAE,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC1E,aAAa,EAAE,0BAA0B,CACvC,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CACnC;QACD,MAAM,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK;KACpD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,GAAW;IAEX,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,cAAc,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAEhE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;YACrC,GAAG;YACH,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,sBAAsB,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,+DAA+D;QAC/D,6DAA6D;QAC7D,mEAAmE;QACnE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;gBACpC,GAAG;gBACH,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,qBAAqB,CACnF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnD,CAAC;YAED,iEAAiE;YACjE,qEAAqE;YACrE,yEAAyE;YACzE,cAAc,GAAG,WAAW,CAAC;YAC7B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC;gBAC1C,GAAG;gBACH,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,2BAA2B,CACzF,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/D,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,KAAK,gCAAgC,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,gBAAgB,CAAC;YAClC,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC;gBAC9C,GAAG;gBACH,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,QAAQ,KAAK,EAAE;aACzB,CAAC,CAAC;YACH,IAAI,mBAAmB,EAAE,CAAC;gBACxB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,gCAAgC,CAC/E,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACnE,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,8CAA8C,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,4BAA4B,GAAG,UAAU,KAAK,UAAU,cAAc,UAAW,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CACjH,CAAC;QACJ,CAAC;QACD,8CAA8C;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,+BAA+B;IAC5C,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,cAAc,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,CAAC,KAAiC,EAAE,OAAe,EAAE,EAAE;YACxE,IAAI,CAAC,WAAW;gBAAE,OAAO;YACzB,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,CAAC,MAAM,YAAY,OAAO,UAAU,KAAK,aAAa,2BAA2B,CAAC,KAAK,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CACtM,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAChD,aAAa,EACb,MAAM,EACN,KAAK,CACN,CAAC;QACF,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,2BAA2B,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAE7D,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,cAAc,GAAG,KAAK,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,aAAa,EACb,KAAK,EACL,KAAK,CACN,CAAC;YACF,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC5B,IAAI,2BAA2B,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC;YAE3D,cAAc,GAAG,WAAW,CAAC;YAC7B,MAAM,cAAc,GAAG,MAAM,0BAA0B,CACrD,aAAa,EACb,WAAW,EACX,KAAK,CACN,CAAC;YACF,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,2BAA2B,CAAC,cAAc,CAAC;gBAAE,OAAO,cAAc,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,gBAAgB,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,KAAK,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,MAAM,0BAA0B,CACrD,aAAa,EACb,WAAW,EACX,OAAO,CACR,CAAC;YACF,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,2BAA2B,CAAC,cAAc,CAAC;gBAAE,OAAO,cAAc,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,8BAA8B,KAAK,UAAU,cAAc,sBAAuB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,+CAA+C,EAAE;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,uBAAuB,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,GAAG,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,OAAO,CAAC,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC;IACvD,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;IAClD,MAAM,MAAM,GAAG,MAAM,+BAA+B,EAAE,CAAC;IACvD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC;IACjC,OAAO,+CAA+C,EAAE;QACtD,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAY7C,MAAM,MAAM,GAAG,MAAM,+BAA+B,EAAE,CAAC;IACvD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EACJ,UAAU,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,GAAG,MAAM,CAAC;QACX,OAAO;YACL,UAAU;YACV,SAAS;YACT,MAAM;YACN,OAAO;YACP,OAAO;YACP,YAAY;YACZ,iBAAiB;YACjB,gBAAgB;YAChB,YAAY;YACZ,aAAa;SACd,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,+CAA+C,EAAE;QAClE,CAAC,CAAC,CAAC,uBAAuB,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,SAAS,GAAG,+CAA+C,EAAE;QACjE,CAAC,CAAC,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,MAAM,GAAG,+CAA+C,EAAE;QAC9D,CAAC,CAAC,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,+CAA+C,EAAE;QAC/D,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,OAAO,GAAG,+CAA+C,EAAE;QAC/D,CAAC,CAAC,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,+CAA+C,EAAE;QACpE,CAAC,CAAC,CAAC,uBAAuB,CAAC,sBAAsB,CAAC,IAAI,IAAI,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAG,+CAA+C,EAAE;QACzE,CAAC,CAAC,CAAC,uBAAuB,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC;QACjE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,+CAA+C,EAAE;QACxE,CAAC,CAAC,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,IAAI,IAAI,CAAC;QAChE,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,+CAA+C,EAAE;QACpE,CAAC,CAAC,0BAA0B,CACxB,uBAAuB,CAAC,uBAAuB,CAAC,CACjD;QACH,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,+CAA+C,EAAE;QACrE,CAAC,CAAC,0BAA0B,CACxB,uBAAuB,CAAC,yBAAyB,CAAC,CACnD;QACH,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,UAAU;QACV,SAAS;QACT,MAAM;QACN,OAAO;QACP,OAAO;QACP,YAAY;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAYpE,MAAM,UAAU,4BAA4B,CAC1C,UAA0B,EAC1B,SAAyB;IAEzB,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,WAAmB;IACvD,OAAO,GAAG,mCAAmC,GAAG,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAK,GAGD,EAAE;IAEN,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,WAAW;YACX,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;gBAC5C,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,mEAAmE;YACzE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,EAAE,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YACpD,UAAU,EACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,OAIxD;IACC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,4BAA4B,CAAC,WAAW,CAAC,EAAE;YAC1D,WAAW;YACX,OAAO,EACL,OAAO,EAAE,OAAO;gBAChB,mEAAmE;YACrE,GAAG,CAAC,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5C,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI;YACzC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAGvD;IACC,MAAM,WAAW,GAAG,4BAA4B,CAC9C,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,SAAS,CAChB,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED,MAAM,oCAAoC,GAAG,wBAAwB,CAAC;AACtE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAa3D,MAAM,UAAU,6BAA6B,CAC3C,GAAmB,EACnB,KAAqB;IAErB,MAAM,aAAa,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,eAAe,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,6BAA6B,CAAC,WAAmB;IACxD,OAAO,GAAG,oCAAoC,GAAG,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,IAGtD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,4BAA4B,EAAE,CAAC;YACnD,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;gBACjD,MAAM,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,WAAW;YACX,GAAG,EACD,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG;gBACpC,CAAC,CAAC,GAAG,CAAC,GAAG;gBACT,CAAC,CAAC,GAAG,IAAI,sBAAsB;YACnC,OAAO,EACL,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;gBAC5C,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,gDAAgD;YACtD,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC/D,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,EAAE;YACF,UAAU,EACR,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACjE,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,IAMzD;IACC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,UAAU,CAAC,6BAA6B,CAAC,WAAW,CAAC,EAAE;YAC3D,WAAW;YACX,GAAG;YACH,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gDAAgD;YACzE,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,UAAU,EAAE,mBAAmB,EAAE,IAAI,IAAI;YACzC,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,IAGxD;IACC,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC/D,MAAM,aAAa,CAAC,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,KAWC,EACD,OAAyD;IAEzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,uKAAuK,CACxK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,GACvC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,EACL,OAAO,EAAE,KAAK,IAAI,IAAI,EACtB,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IAEF,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,QAAQ,GAA4B,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5E,eAAe,CAAC;QACd,GAAG;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACnB,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE5B,MAAM,OAAO,GAA0C;QACrD,EAAE,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,EAAE;QACjD,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE;KAChD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,4BAA4B;YACjC,KAAK,EAAE,KAAK,CAAC,iBAAiB;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE,KAAK,CAAC,gBAAgB;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,uBAAuB;YAC5B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC;YACX,GAAG,EAAE,yBAAyB;YAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAC7B,cAAc,CAAC;QACb,GAAG;QACH,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CACH,CACF,CAAC;IACF,MAAM,iCAAiC,CAAC;QACtC,UAAU;QACV,SAAS;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,OAAyD;IAEzD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,2BAA2B,CACxC,KAAK,EACL,OAAO,EAAE,KAAK,IAAI,IAAI,EACtB,OAAO,EAAE,IAAI,IAAI,IAAI,CACtB,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CACf,uBAAuB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAClC,eAAe,CAAC;QACd,GAAG;QACH,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CACnB,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,+DAA+D;AAC/D,gFAAgF;AAChF,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YAChE,2BAA2B;YAC3B,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC;gBACrC,GAAG;gBACH,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,KAAK,EAAE,CAAC;gBACtB,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,sBAAsB,CACjE,CAAC;gBACJ,CAAC;gBACD,OAAO,UAAU,CAAC,KAAK,CAAC;YAC1B,CAAC;YAED,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,kEAAkE;gBAClE,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;oBACpC,GAAG;oBACH,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;oBACrB,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,qBAAqB,CAC/E,CAAC;oBACJ,CAAC;oBACD,OAAO,SAAS,CAAC,KAAK,CAAC;gBACzB,CAAC;gBAED,6DAA6D;gBAC7D,mEAAmE;gBACnE,4BAA4B;gBAC5B,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC;oBAC1C,GAAG;oBACH,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBACH,IAAI,eAAe,EAAE,KAAK,EAAE,CAAC;oBAC3B,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,KAAK,2BAA2B,CACrF,CAAC;oBACJ,CAAC;oBACD,OAAO,eAAe,CAAC,KAAK,CAAC;gBAC/B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,mBAAmB,GAAG,MAAM,aAAa,CAAC;oBAC9C,GAAG;oBACH,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,QAAQ,KAAK,EAAE;iBACzB,CAAC,CAAC;gBACH,IAAI,mBAAmB,EAAE,KAAK,EAAE,CAAC;oBAC/B,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,gCAAgC,CAC3E,CAAC;oBACJ,CAAC;oBACD,OAAO,mBAAmB,CAAC,KAAK,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,oBAAqB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAC/F,CAAC;YACJ,CAAC;YACD,8CAA8C;QAChD,CAAC;QACD,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,WAAW,GAAG,CAClB,sBAAsB,CAAC,GAAG,CAAC;YACzB,CAAC,CAAC,+CAA+C,EAAE;YACnD,CAAC,CAAC,wCAAwC,CAAC,GAAG,CAAC,CAClD;YACC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;YAC1B,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,UAAU,KAAK,UAAU,eAAe,EAAE,IAAI,QAAQ,UAAU,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,CAAC,WAAW,EAAE,CACxJ,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACvC,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,wBAAwB,GAAG,yCAAyC,CAAC,CAAC,KAAK,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,iEAAiE;AACjE,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB;IACnC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACpC,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iCAAiC;QAC7C,+CAA+C,CAChD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACvC,mDAAmD,CACpD,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Credential provider abstraction.\n *\n * Every feature that needs an external credential (Anthropic API key,\n * Google OAuth tokens, OpenAI key, Slack bot token, etc.) should go through\n * one of the resolve*() helpers here instead of reading `process.env`\n * directly. That way the same feature can work in three modes:\n *\n *   1. User set their own key in .env              → use it directly\n *   2. User connected Builder via `/cli-auth`      → route through Builder proxy\n *   3. Neither                                      → throw FeatureNotConfigured\n *\n * Templates catch FeatureNotConfigured and show a \"Connect Builder (1 click) /\n * set up your own key (guide)\" card.\n *\n * Today these helpers are used by the Builder-hosted LLM gateway, and the\n * shape is meant to grow to cover future managed credential integrations\n * (e.g. additional Builder-hosted services) without rewrites.\n */\n\nimport { createHash } from \"node:crypto\";\n\nimport { isLocalDatabase } from \"../db/client.js\";\nimport { getRequestUserEmail, getRequestOrgId } from \"./request-context.js\";\n\n/**\n * Decide which `app_secrets` scope a Builder/credential write should use.\n *\n * Org scope (\"everyone in this org sees these credentials\") wins when the\n * connecting user is an owner or admin of an active org — the write\n * privileges shared infra. A plain member or a user without an active\n * org falls through to per-user scope so a teammate can't silently\n * overwrite the org-shared connection.\n */\nexport function resolveCredentialWriteScope(\n  email: string,\n  orgId: string | null | undefined,\n  role: string | null | undefined,\n): { scope: \"user\" | \"org\"; scopeId: string } {\n  if (orgId && (role === \"owner\" || role === \"admin\")) {\n    return { scope: \"org\", scopeId: orgId };\n  }\n  return { scope: \"user\", scopeId: email };\n}\n\nexport class FeatureNotConfiguredError extends Error {\n  readonly requiredCredential: string;\n  readonly builderConnectUrl?: string;\n  readonly byokDocsUrl?: string;\n\n  constructor(opts: {\n    requiredCredential: string;\n    message?: string;\n    builderConnectUrl?: string;\n    byokDocsUrl?: string;\n  }) {\n    super(\n      opts.message ??\n        `Feature requires credential \"${opts.requiredCredential}\". Connect Builder or set your own key.`,\n    );\n    this.name = \"FeatureNotConfiguredError\";\n    this.requiredCredential = opts.requiredCredential;\n    this.builderConnectUrl = opts.builderConnectUrl;\n    this.byokDocsUrl = opts.byokDocsUrl;\n  }\n}\n\n/**\n * Deployment-level credential fallback for single-tenant/local operation.\n * Multi-tenant call sites must gate this explicitly before calling.\n */\nexport function readDeployCredentialEnv(key: string): string | undefined {\n  return process.env[key] || undefined;\n}\n\nconst APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([\n  \"ANTHROPIC_API_KEY\",\n  \"OPENAI_API_KEY\",\n  \"OPENAI_BASE_URL\",\n  \"OPENROUTER_API_KEY\",\n  \"GOOGLE_CLIENT_ID\",\n  \"GOOGLE_CLIENT_SECRET\",\n  \"GOOGLE_GENERATIVE_AI_API_KEY\",\n  \"GROQ_API_KEY\",\n  \"MISTRAL_API_KEY\",\n  \"COHERE_API_KEY\",\n]);\n\nfunction isAppProvidedDeployCredentialKey(key: string | undefined): boolean {\n  return !!key && APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS.has(key);\n}\n\n/**\n * Deployment-level credentials are safe as a runtime fallback only in local /\n * single-tenant contexts. In hosted production with a shared database, every\n * signed-in user needs their own user/org/workspace credential for\n * identity-bearing provider keys so one deploy key does not silently\n * impersonate another tenant. App-provided service credentials are different:\n * they configure the deployed app itself rather than identifying a user. This\n * includes LLM keys that let the app developer pay for model usage and OAuth\n * client credentials whose per-user identity remains in scoped OAuth tokens.\n * Key-aware callers may use those env vars.\n *\n * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic\n * provider secrets. This stricter helper remains for legacy call sites with\n * identity-bearing deploy credentials.\n */\nexport function isDeployCredentialFallbackAllowed(): boolean {\n  if (!isProductionLikeRuntime()) return true;\n  return isLocalDatabase();\n}\n\nexport function canUseDeployCredentialFallbackForRequest(\n  key?: string,\n): boolean {\n  const email = getRequestUserEmail();\n  if (!email) return true;\n  if (isAppProvidedDeployCredentialKey(key)) return true;\n  if (isHostedWorkspaceRuntime()) return false;\n  if (!isProductionLikeRuntime()) return true;\n  return isLocalDatabase();\n}\n\nconst BUILDER_CREDENTIAL_KEYS = [\n  \"BUILDER_PRIVATE_KEY\",\n  \"BUILDER_PUBLIC_KEY\",\n  \"BUILDER_USER_ID\",\n  \"BUILDER_ORG_NAME\",\n  \"BUILDER_ORG_KIND\",\n  \"BUILDER_SUBSCRIPTION\",\n  \"BUILDER_SUBSCRIPTION_LEVEL\",\n  \"BUILDER_SUBSCRIPTION_NAME\",\n  \"BUILDER_IS_ENTERPRISE\",\n  \"BUILDER_IS_FREE_ACCOUNT\",\n] as const;\n\nfunction isBuilderCredentialKey(key: string): boolean {\n  return (BUILDER_CREDENTIAL_KEYS as readonly string[]).includes(key);\n}\n\nfunction isHostedWorkspaceRuntime(): boolean {\n  const hasFusionPreview = Boolean(\n    process.env.FUSION_ENVIRONMENT ||\n    process.env.FUSION_ENV_ORIGIN ||\n    process.env.VITE_FUSION_ENV_ORIGIN,\n  );\n  return (\n    /^(1|true)$/i.test(process.env.AGENT_NATIVE_WORKSPACE ?? \"\") ||\n    /^(1|true)$/i.test(process.env.VITE_AGENT_NATIVE_WORKSPACE ?? \"\") ||\n    hasFusionPreview\n  );\n}\n\nfunction isProductionLikeRuntime(): boolean {\n  return (\n    process.env.NODE_ENV === \"production\" ||\n    /^(1|true)$/i.test(process.env.NETLIFY ?? \"\") ||\n    /^(1|true)$/i.test(process.env.VERCEL ?? \"\") ||\n    /^(1|true)$/i.test(process.env.CF_PAGES ?? \"\") ||\n    Boolean(\n      process.env.AWS_LAMBDA_FUNCTION_NAME ||\n      process.env.AWS_EXECUTION_ENV ||\n      process.env.FUNCTIONS_WORKER_RUNTIME ||\n      process.env.K_SERVICE ||\n      process.env.RENDER,\n    )\n  );\n}\n\n/**\n * Whether deployment-level Builder env keys may back the current request.\n *\n * This is intentionally self-contained rather than delegating to\n * `canUseDeployCredentialFallbackForRequest`. That generic helper blocks the\n * deploy fallback for any signed-in user in a hosted workspace runtime, so the\n * Builder dogfooding escape hatch must apply its own hosted-workspace exception\n * here instead of inheriting the generic helper's stricter (and hatch-unaware)\n * decision. Reading the env once into locals keeps the rules legible.\n *\n * Rules (all evaluated against the live request/runtime, not a build-time value):\n *  - No signed-in user → safe to use the deploy env (nobody to mis-identify).\n *  - Hosted workspace + signed-in user → deploy-level Builder keys would\n *    impersonate that user, so block them — UNLESS a developer has explicitly\n *    opted into the local dogfooding escape hatch (non-prod only). Default OFF;\n *    hosted/shared production deployments are never affected.\n *  - Otherwise → allowed in non-prod, or on a local/single-tenant database.\n */\nfunction canUseBuilderDeployCredentialFallbackForRequest(): boolean {\n  const email = getRequestUserEmail();\n  if (!email) return true;\n\n  const isProductionRuntime = isProductionLikeRuntime();\n  // Local dogfooding escape hatch: lets the env / root-`.env` Builder key back\n  // a signed-in user so running the app locally doesn't require completing the\n  // Builder connect flow first. Non-prod only.\n  const localDevOptIn =\n    !isProductionRuntime &&\n    /^(1|true)$/i.test(process.env.AGENT_NATIVE_LOCAL_BUILDER_ENV ?? \"\");\n\n  if (isHostedWorkspaceRuntime() && !localDevOptIn) return false;\n\n  // Deploy fallback is safe in non-prod or on a local/single-tenant database.\n  return !isProductionRuntime || isLocalDatabase();\n}\n\nfunction shouldTraceCredentialResolve(): boolean {\n  return /^(1|true)$/i.test(\n    process.env.AGENT_NATIVE_DEBUG_CREDENTIAL_RESOLVE ??\n      process.env.DEBUG_CREDENTIAL_RESOLVE ??\n      \"\",\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Builder credential resolution:\n//\n//   1. **Request-scoped credentials.** A signed-in user can connect Builder\n//      through the CLI-auth flow. Owner/admin connections land at org scope;\n//      member/no-org connections land at user scope.\n//\n//   2. **Deployment fallback.** BUILDER_PRIVATE_KEY in env still makes local\n//      and single-tenant deploys work out of the box, but it no longer blocks\n//      per-user connect. Request-scoped credentials win whenever present.\n//\n// To run multi-tenant SaaS: prefer leaving BUILDER_PRIVATE_KEY unset unless a\n// shared fallback identity is intentional.\n// ---------------------------------------------------------------------------\n\ntype BuilderCredentialSource = \"user\" | \"org\" | \"workspace\" | \"env\";\ninterface BuilderResolvedCredentials {\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n  source: Exclude<BuilderCredentialSource, \"env\">;\n}\n\nfunction isCompleteBuilderConnection(creds: BuilderResolvedCredentials) {\n  return Boolean(creds.privateKey && creds.publicKey);\n}\n\nfunction readOptionalBuilderBoolean(\n  value: string | null | undefined,\n): boolean | null {\n  if (value == null || value === \"\") return null;\n  return /^(1|true)$/i.test(value);\n}\n\nexport function isBuilderPrivateKey(value: string | null | undefined): boolean {\n  return typeof value === \"string\" && value.trim().startsWith(\"bpk-\");\n}\n\nasync function readBuilderCredentialScope(\n  readAppSecret: typeof import(\"../secrets/storage.js\").readAppSecret,\n  scope: \"user\" | \"org\" | \"workspace\",\n  scopeId: string,\n): Promise<BuilderResolvedCredentials> {\n  const values = await Promise.all(\n    BUILDER_CREDENTIAL_KEYS.map(async (key) => {\n      const secret = await readAppSecret({ key, scope, scopeId });\n      return [key, secret?.value ?? null] as const;\n    }),\n  );\n  const map = new Map<string, string | null>(values);\n  return {\n    privateKey: map.get(\"BUILDER_PRIVATE_KEY\") ?? null,\n    publicKey: map.get(\"BUILDER_PUBLIC_KEY\") ?? null,\n    userId: map.get(\"BUILDER_USER_ID\") ?? null,\n    orgName: map.get(\"BUILDER_ORG_NAME\") ?? null,\n    orgKind: map.get(\"BUILDER_ORG_KIND\") ?? null,\n    subscription: map.get(\"BUILDER_SUBSCRIPTION\") ?? null,\n    subscriptionLevel: map.get(\"BUILDER_SUBSCRIPTION_LEVEL\") ?? null,\n    subscriptionName: map.get(\"BUILDER_SUBSCRIPTION_NAME\") ?? null,\n    isEnterprise: readOptionalBuilderBoolean(map.get(\"BUILDER_IS_ENTERPRISE\")),\n    isFreeAccount: readOptionalBuilderBoolean(\n      map.get(\"BUILDER_IS_FREE_ACCOUNT\"),\n    ),\n    source: scope === \"workspace\" ? \"workspace\" : scope,\n  };\n}\n\nasync function resolveScopedBuilderCredential(\n  key: string,\n): Promise<{ value: string; source: \"user\" | \"org\" | \"workspace\" } | null> {\n  const email = getRequestUserEmail();\n  if (!email) return null;\n\n  // Trace only when explicitly requested. These diagnostics are useful for\n  // support, but they include account identifiers and run on hot paths.\n  const traceLookup = shouldTraceCredentialResolve();\n  let scopeAttempted = \"user\";\n  try {\n    const { readAppSecret } = await import(\"../secrets/storage.js\");\n\n    // 1. Per-user override: a user can paste their own key in settings to\n    //    overrule the org-shared one (handy for a personal sandbox).\n    const userSecret = await readAppSecret({\n      key,\n      scope: \"user\",\n      scopeId: email,\n    });\n    if (userSecret) {\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} scope=user hit=true`,\n        );\n      }\n      return { value: userSecret.value, source: \"user\" };\n    }\n\n    // 2. Per-org shared credential: when one teammate connects Builder\n    //    as an owner/admin we write the OAuth result at org scope so\n    //    every member of that org gets the AI chat working without\n    //    re-running the connect flow. Resolution falls back here\n    //    silently — the caller never has to know which scope answered.\n    const orgId = getRequestOrgId();\n    if (orgId) {\n      scopeAttempted = \"org\";\n      const orgSecret = await readAppSecret({\n        key,\n        scope: \"org\",\n        scopeId: orgId,\n      });\n      if (orgSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} orgId=${orgId} scope=org hit=true`,\n          );\n        }\n        return { value: orgSecret.value, source: \"org\" };\n      }\n\n      // Older setup flows wrote shared credentials at workspace scope.\n      // Keep reading those rows so status UIs and runtime resolution agree\n      // for users who connected before org-scoped Builder credentials existed.\n      scopeAttempted = \"workspace\";\n      const workspaceSecret = await readAppSecret({\n        key,\n        scope: \"workspace\",\n        scopeId: orgId,\n      });\n      if (workspaceSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} orgId=${orgId} scope=workspace hit=true`,\n          );\n        }\n        return { value: workspaceSecret.value, source: \"workspace\" };\n      }\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} orgId=${orgId} miss tried=user,org,workspace`,\n        );\n      }\n    } else {\n      scopeAttempted = \"workspace-solo\";\n      const soloWorkspaceSecret = await readAppSecret({\n        key,\n        scope: \"workspace\",\n        scopeId: `solo:${email}`,\n      });\n      if (soloWorkspaceSecret) {\n        if (traceLookup) {\n          console.log(\n            `[builder-credential] key=${key} email=${email} scope=workspace-solo hit=true`,\n          );\n        }\n        return { value: soloWorkspaceSecret.value, source: \"workspace\" };\n      }\n      if (traceLookup) {\n        console.log(\n          `[builder-credential] key=${key} email=${email} orgId=(none) miss tried=user,workspace-solo`,\n        );\n      }\n    }\n  } catch (err) {\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] key=${key} email=${email} scope=${scopeAttempted} error=${(err as Error)?.message ?? err}`,\n      );\n    }\n    // Secrets table not ready — treat as missing.\n  }\n  return null;\n}\n\nasync function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredentials | null> {\n  const email = getRequestUserEmail();\n  if (!email) return null;\n\n  const traceLookup = shouldTraceCredentialResolve();\n  let scopeAttempted = \"user\";\n  try {\n    const { readAppSecret } = await import(\"../secrets/storage.js\");\n    const traceScope = (creds: BuilderResolvedCredentials, scopeId: string) => {\n      if (!traceLookup) return;\n      console.log(\n        `[builder-credential] scope=${creds.source} scopeId=${scopeId} email=${email} complete=${isCompleteBuilderConnection(creds)} private=${Boolean(creds.privateKey)} public=${Boolean(creds.publicKey)}`,\n      );\n    };\n\n    const userCreds = await readBuilderCredentialScope(\n      readAppSecret,\n      \"user\",\n      email,\n    );\n    traceScope(userCreds, email);\n    if (isCompleteBuilderConnection(userCreds)) return userCreds;\n\n    const orgId = getRequestOrgId();\n    if (orgId) {\n      scopeAttempted = \"org\";\n      const orgCreds = await readBuilderCredentialScope(\n        readAppSecret,\n        \"org\",\n        orgId,\n      );\n      traceScope(orgCreds, orgId);\n      if (isCompleteBuilderConnection(orgCreds)) return orgCreds;\n\n      scopeAttempted = \"workspace\";\n      const workspaceCreds = await readBuilderCredentialScope(\n        readAppSecret,\n        \"workspace\",\n        orgId,\n      );\n      traceScope(workspaceCreds, orgId);\n      if (isCompleteBuilderConnection(workspaceCreds)) return workspaceCreds;\n    } else {\n      scopeAttempted = \"workspace-solo\";\n      const scopeId = `solo:${email}`;\n      const workspaceCreds = await readBuilderCredentialScope(\n        readAppSecret,\n        \"workspace\",\n        scopeId,\n      );\n      traceScope(workspaceCreds, scopeId);\n      if (isCompleteBuilderConnection(workspaceCreds)) return workspaceCreds;\n    }\n  } catch (err) {\n    if (traceLookup) {\n      console.log(\n        `[builder-credential] email=${email} scope=${scopeAttempted} credentials error=${(err as Error)?.message ?? err}`,\n      );\n    }\n  }\n  return null;\n}\n\n/**\n * Resolve a Builder credential for the current request. User/org credentials\n * win; deployment env is only a fallback. This lets local/root .env keys keep\n * a template working while still allowing users to connect their own Builder\n * account from Settings or onboarding.\n */\nexport async function resolveBuilderCredential(\n  key: string,\n): Promise<string | null> {\n  const scoped = await resolveScopedBuilderCredential(key);\n  if (scoped) return scoped.value;\n  if (!canUseBuilderDeployCredentialFallbackForRequest()) return null;\n  return readDeployCredentialEnv(key) ?? null;\n}\n\n/**\n * True when `BUILDER_PRIVATE_KEY` is set at the deployment level. This means\n * a deploy-level fallback exists; it does not prevent per-user connect.\n */\nexport function isBuilderEnvManaged(): boolean {\n  return !!process.env.BUILDER_PRIVATE_KEY;\n}\n\n/**\n * Resolve the Builder private key for the current request. User/org OAuth\n * credentials win; deploy-level `BUILDER_PRIVATE_KEY` is the fallback.\n */\nexport async function resolveBuilderPrivateKey(): Promise<string | null> {\n  return resolveBuilderCredential(\"BUILDER_PRIVATE_KEY\");\n}\n\n/**\n * Resolve the current user's Builder auth header.\n * Returns `\"Bearer <key>\"` or null.\n */\nexport async function resolveBuilderAuthHeader(): Promise<string | null> {\n  const key = await resolveBuilderPrivateKey();\n  return key ? `Bearer ${key}` : null;\n}\n\n/**\n * Check whether the current user has a Builder private key configured\n * (per-user or deployment-level).\n */\nexport async function resolveHasBuilderPrivateKey(): Promise<boolean> {\n  return !!(await resolveBuilderPrivateKey());\n}\n\n/**\n * Check whether the current request has the complete Builder credential bundle\n * needed for Builder-backed assistant/image-generation calls.\n */\nexport async function resolveHasCompleteBuilderConnection(): Promise<boolean> {\n  const creds = await resolveBuilderCredentials();\n  return !!(creds.privateKey && creds.publicKey);\n}\n\n/**\n * Resolve where the effective Builder assistant connection came from. This\n * intentionally requires a complete private+public key pair from one scope so\n * status UIs don't report a mixed user/org credential set as connected.\n */\nexport async function resolveBuilderCredentialSource(): Promise<BuilderCredentialSource | null> {\n  const scoped = await resolveScopedBuilderCredentials();\n  if (scoped) return scoped.source;\n  return canUseBuilderDeployCredentialFallbackForRequest() &&\n    process.env.BUILDER_PRIVATE_KEY\n    ? \"env\"\n    : null;\n}\n\n/**\n * Resolve the Builder assistant credential bundle from one complete scope.\n * A partial user row is treated as a miss so the org-shared connection can\n * still power the assistant for teammates.\n */\nexport async function resolveBuilderCredentials(): Promise<{\n  privateKey: string | null;\n  publicKey: string | null;\n  userId: string | null;\n  orgName: string | null;\n  orgKind: string | null;\n  subscription: string | null;\n  subscriptionLevel: string | null;\n  subscriptionName: string | null;\n  isEnterprise: boolean | null;\n  isFreeAccount: boolean | null;\n}> {\n  const scoped = await resolveScopedBuilderCredentials();\n  if (scoped) {\n    const {\n      privateKey,\n      publicKey,\n      userId,\n      orgName,\n      orgKind,\n      subscription,\n      subscriptionLevel,\n      subscriptionName,\n      isEnterprise,\n      isFreeAccount,\n    } = scoped;\n    return {\n      privateKey,\n      publicKey,\n      userId,\n      orgName,\n      orgKind,\n      subscription,\n      subscriptionLevel,\n      subscriptionName,\n      isEnterprise,\n      isFreeAccount,\n    };\n  }\n  const privateKey = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_PRIVATE_KEY\") ?? null)\n    : null;\n  const publicKey = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_PUBLIC_KEY\") ?? null)\n    : null;\n  const userId = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_USER_ID\") ?? null)\n    : null;\n  const orgName = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_ORG_NAME\") ?? null)\n    : null;\n  const orgKind = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_ORG_KIND\") ?? null)\n    : null;\n  const subscription = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION\") ?? null)\n    : null;\n  const subscriptionLevel = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION_LEVEL\") ?? null)\n    : null;\n  const subscriptionName = canUseBuilderDeployCredentialFallbackForRequest()\n    ? (readDeployCredentialEnv(\"BUILDER_SUBSCRIPTION_NAME\") ?? null)\n    : null;\n  const isEnterprise = canUseBuilderDeployCredentialFallbackForRequest()\n    ? readOptionalBuilderBoolean(\n        readDeployCredentialEnv(\"BUILDER_IS_ENTERPRISE\"),\n      )\n    : null;\n  const isFreeAccount = canUseBuilderDeployCredentialFallbackForRequest()\n    ? readOptionalBuilderBoolean(\n        readDeployCredentialEnv(\"BUILDER_IS_FREE_ACCOUNT\"),\n      )\n    : null;\n  return {\n    privateKey,\n    publicKey,\n    userId,\n    orgName,\n    orgKind,\n    subscription,\n    subscriptionLevel,\n    subscriptionName,\n    isEnterprise,\n    isFreeAccount,\n  };\n}\n\nconst BUILDER_AUTH_FAILURE_SETTING_PREFIX = \"builder-auth-failure:\";\n\nexport interface BuilderCredentialAuthFailure {\n  fingerprint: string;\n  message: string;\n  status?: number;\n  code?: string;\n  at: number;\n  ownerEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport function builderCredentialFingerprint(\n  privateKey?: string | null,\n  publicKey?: string | null,\n): string | null {\n  if (!privateKey || !publicKey) return null;\n  return createHash(\"sha256\")\n    .update(privateKey)\n    .update(\"\\0\")\n    .update(publicKey)\n    .digest(\"hex\")\n    .slice(0, 24);\n}\n\nfunction builderAuthFailureSettingKey(fingerprint: string): string {\n  return `${BUILDER_AUTH_FAILURE_SETTING_PREFIX}${fingerprint}`;\n}\n\nexport async function getBuilderCredentialAuthFailure(\n  creds: {\n    privateKey?: string | null;\n    publicKey?: string | null;\n  } = {},\n): Promise<BuilderCredentialAuthFailure | null> {\n  const fingerprint = builderCredentialFingerprint(\n    creds.privateKey,\n    creds.publicKey,\n  );\n  if (!fingerprint) return null;\n  try {\n    const { getSetting } = await import(\"../settings/store.js\");\n    const row = await getSetting(builderAuthFailureSettingKey(fingerprint));\n    if (!row) return null;\n    return {\n      fingerprint,\n      message:\n        typeof row.message === \"string\" && row.message\n          ? row.message\n          : \"Builder rejected the connected credentials. Reconnect Builder.io.\",\n      status: typeof row.status === \"number\" ? row.status : undefined,\n      code: typeof row.code === \"string\" ? row.code : undefined,\n      at: typeof row.at === \"number\" ? row.at : Date.now(),\n      ownerEmail:\n        typeof row.ownerEmail === \"string\" ? row.ownerEmail : undefined,\n      orgId: typeof row.orgId === \"string\" ? row.orgId : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function recordBuilderCredentialAuthFailure(details?: {\n  status?: number;\n  code?: string;\n  message?: string;\n}): Promise<void> {\n  try {\n    const creds = await resolveBuilderCredentials();\n    const fingerprint = builderCredentialFingerprint(\n      creds.privateKey,\n      creds.publicKey,\n    );\n    if (!fingerprint) return;\n    const { putSetting } = await import(\"../settings/store.js\");\n    await putSetting(builderAuthFailureSettingKey(fingerprint), {\n      fingerprint,\n      message:\n        details?.message ||\n        \"Builder rejected the connected credentials. Reconnect Builder.io.\",\n      ...(typeof details?.status === \"number\" && { status: details.status }),\n      ...(details?.code && { code: details.code }),\n      at: Date.now(),\n      ownerEmail: getRequestUserEmail() ?? null,\n      orgId: getRequestOrgId() ?? null,\n    });\n  } catch {\n    // Best-effort marker only; the chat error is still returned to the user.\n  }\n}\n\nexport async function clearBuilderCredentialAuthFailure(creds: {\n  privateKey?: string | null;\n  publicKey?: string | null;\n}): Promise<void> {\n  const fingerprint = builderCredentialFingerprint(\n    creds.privateKey,\n    creds.publicKey,\n  );\n  if (!fingerprint) return;\n  try {\n    const { deleteSetting } = await import(\"../settings/store.js\");\n    await deleteSetting(builderAuthFailureSettingKey(fingerprint));\n  } catch {\n    // A stale failure marker should not block writing fresh credentials.\n  }\n}\n\nconst PROVIDER_AUTH_FAILURE_SETTING_PREFIX = \"provider-auth-failure:\";\n/** Stale failure markers expire so a transient 401 cannot permanently block deploy keys. */\nexport const PROVIDER_AUTH_FAILURE_TTL_MS = 15 * 60 * 1000;\n\nexport interface ProviderCredentialAuthFailure {\n  fingerprint: string;\n  key: string;\n  message: string;\n  status?: number;\n  code?: string;\n  at: number;\n  ownerEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport function providerCredentialFingerprint(\n  key?: string | null,\n  value?: string | null,\n): string | null {\n  const normalizedKey = key?.trim().toUpperCase();\n  const normalizedValue = value?.trim();\n  if (!normalizedKey || !normalizedValue) return null;\n  return createHash(\"sha256\")\n    .update(normalizedKey)\n    .update(\"\\0\")\n    .update(normalizedValue)\n    .digest(\"hex\")\n    .slice(0, 24);\n}\n\nfunction providerAuthFailureSettingKey(fingerprint: string): string {\n  return `${PROVIDER_AUTH_FAILURE_SETTING_PREFIX}${fingerprint}`;\n}\n\nexport async function getProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n}): Promise<ProviderCredentialAuthFailure | null> {\n  const key = opts.key?.trim().toUpperCase() ?? \"\";\n  const fingerprint = providerCredentialFingerprint(key, opts.value);\n  if (!fingerprint) return null;\n  try {\n    const settings = await import(\"../settings/store.js\");\n    const settingKey = providerAuthFailureSettingKey(fingerprint);\n    const row = await settings.getSetting(settingKey);\n    if (!row) return null;\n    if (row.fingerprint !== fingerprint) return null;\n    const at = typeof row.at === \"number\" ? row.at : Date.now();\n    if (Date.now() - at > PROVIDER_AUTH_FAILURE_TTL_MS) {\n      if (typeof settings.deleteSetting === \"function\") {\n        await settings.deleteSetting(settingKey).catch(() => {});\n      }\n      return null;\n    }\n    return {\n      fingerprint,\n      key:\n        typeof row.key === \"string\" && row.key\n          ? row.key\n          : key || \"UNKNOWN_PROVIDER_KEY\",\n      message:\n        typeof row.message === \"string\" && row.message\n          ? row.message\n          : \"The model provider rejected the saved API key.\",\n      status: typeof row.status === \"number\" ? row.status : undefined,\n      code: typeof row.code === \"string\" ? row.code : undefined,\n      at,\n      ownerEmail:\n        typeof row.ownerEmail === \"string\" ? row.ownerEmail : undefined,\n      orgId: typeof row.orgId === \"string\" ? row.orgId : undefined,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport async function recordProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n  status?: number;\n  code?: string;\n  message?: string;\n}): Promise<void> {\n  try {\n    const key = opts.key?.trim().toUpperCase() ?? \"\";\n    const value = opts.value?.trim();\n    const fingerprint = providerCredentialFingerprint(key, value);\n    if (!fingerprint) return;\n    const { putSetting } = await import(\"../settings/store.js\");\n    await putSetting(providerAuthFailureSettingKey(fingerprint), {\n      fingerprint,\n      key,\n      message: opts.message || \"The model provider rejected the saved API key.\",\n      ...(typeof opts.status === \"number\" && { status: opts.status }),\n      ...(opts.code && { code: opts.code }),\n      at: Date.now(),\n      ownerEmail: getRequestUserEmail() ?? null,\n      orgId: getRequestOrgId() ?? null,\n    });\n  } catch {\n    // Best-effort marker only; the chat error is still returned to the user.\n  }\n}\n\nexport async function clearProviderCredentialAuthFailure(opts: {\n  key?: string | null;\n  value?: string | null;\n}): Promise<void> {\n  const fingerprint = providerCredentialFingerprint(opts.key, opts.value);\n  if (!fingerprint) return;\n  try {\n    const { deleteSetting } = await import(\"../settings/store.js\");\n    await deleteSetting(providerAuthFailureSettingKey(fingerprint));\n  } catch {\n    // A stale failure marker should not block writing or using fresh keys.\n  }\n}\n\n/**\n * Write Builder credentials to `app_secrets`.\n *\n * Scope decision (see `resolveCredentialWriteScope`): when the connecting\n * user is owner/admin of an active org we write at `scope: \"org\"` so every\n * member of that org auto-resolves the credentials via\n * `resolveBuilderCredential`'s org fallback — no per-user re-connect\n * needed. A plain member or a user with no active org writes at\n * `scope: \"user\"` (the safe default that doesn't trample the org's shared\n * connection).\n *\n * Stale-credential cleanup: before writing the new values we (1) clear ALL\n * five BUILDER_* keys at the target scope, so optional fields the new\n * connection doesn't carry (e.g. user picked a Builder space that returns\n * no orgName) don't leave the previous connection's metadata behind, and\n * (2) when writing at org scope, also clear the writer's own user-scope\n * BUILDER_* rows so a stale personal override from an earlier connect\n * doesn't shadow the new org write on resolution (user scope wins org\n * scope by design — see `resolveScopedBuilderCredential`). The org-scope\n * row is intentionally left alone when writing at user scope: that row is\n * shared with the rest of the org and a single user's personal override\n * shouldn't blow it away. (Victoria's \"I signed in again with my Builder\n * space and it still says no credits\" report on 2026-05-11 was exactly\n * this stale-shadow case.)\n *\n * Returns the actual scope/scopeId used so the caller can show \"Connected\n * for Builder.io\" vs \"Connected (personal)\" in the UI.\n */\nexport async function writeBuilderCredentials(\n  email: string,\n  creds: {\n    privateKey: string;\n    publicKey: string;\n    userId?: string | null;\n    orgName?: string | null;\n    orgKind?: string | null;\n    subscription?: string | null;\n    subscriptionLevel?: string | null;\n    subscriptionName?: string | null;\n    isEnterprise?: boolean | null;\n    isFreeAccount?: boolean | null;\n  },\n  options?: { orgId?: string | null; role?: string | null },\n): Promise<{ scope: \"user\" | \"org\"; scopeId: string }> {\n  const privateKey = creds.privateKey.trim();\n  const publicKey = creds.publicKey.trim();\n  if (!isBuilderPrivateKey(privateKey)) {\n    throw new Error(\n      \"Builder returned a credential that is not a Builder private key (expected bpk-...). Restart the Builder connect flow and choose a space that can issue a private key.\",\n    );\n  }\n  if (!publicKey) {\n    throw new Error(\n      \"Builder did not return a public API key. Restart the Builder connect flow.\",\n    );\n  }\n\n  const { writeAppSecret, deleteAppSecret } =\n    await import(\"../secrets/storage.js\");\n  const target = resolveCredentialWriteScope(\n    email,\n    options?.orgId ?? null,\n    options?.role ?? null,\n  );\n\n  // Clear stale rows before writing the new connection. See the function's\n  // doc comment for the two cases this handles.\n  const cleanups: Array<Promise<unknown>> = BUILDER_CREDENTIAL_KEYS.map((key) =>\n    deleteAppSecret({\n      key,\n      scope: target.scope,\n      scopeId: target.scopeId,\n    }).catch(() => {}),\n  );\n  if (target.scope === \"org\") {\n    for (const key of BUILDER_CREDENTIAL_KEYS) {\n      cleanups.push(\n        deleteAppSecret({ key, scope: \"user\", scopeId: email }).catch(() => {}),\n      );\n    }\n  }\n  await Promise.all(cleanups);\n\n  const entries: Array<{ key: string; value: string }> = [\n    { key: \"BUILDER_PRIVATE_KEY\", value: privateKey },\n    { key: \"BUILDER_PUBLIC_KEY\", value: publicKey },\n  ];\n  if (creds.userId) {\n    entries.push({ key: \"BUILDER_USER_ID\", value: creds.userId });\n  }\n  if (creds.orgName) {\n    entries.push({ key: \"BUILDER_ORG_NAME\", value: creds.orgName });\n  }\n  if (creds.orgKind) {\n    entries.push({ key: \"BUILDER_ORG_KIND\", value: creds.orgKind });\n  }\n  if (creds.subscription) {\n    entries.push({ key: \"BUILDER_SUBSCRIPTION\", value: creds.subscription });\n  }\n  if (creds.subscriptionLevel) {\n    entries.push({\n      key: \"BUILDER_SUBSCRIPTION_LEVEL\",\n      value: creds.subscriptionLevel,\n    });\n  }\n  if (creds.subscriptionName) {\n    entries.push({\n      key: \"BUILDER_SUBSCRIPTION_NAME\",\n      value: creds.subscriptionName,\n    });\n  }\n  if (typeof creds.isEnterprise === \"boolean\") {\n    entries.push({\n      key: \"BUILDER_IS_ENTERPRISE\",\n      value: String(creds.isEnterprise),\n    });\n  }\n  if (typeof creds.isFreeAccount === \"boolean\") {\n    entries.push({\n      key: \"BUILDER_IS_FREE_ACCOUNT\",\n      value: String(creds.isFreeAccount),\n    });\n  }\n  await Promise.all(\n    entries.map(({ key, value }) =>\n      writeAppSecret({\n        key,\n        value,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      }),\n    ),\n  );\n  await clearBuilderCredentialAuthFailure({\n    privateKey,\n    publicKey,\n  });\n  return target;\n}\n\n/**\n * Delete Builder credentials.\n *\n * Default behaviour: clears only this user's per-user override (so a\n * member can disconnect their personal Builder identity without\n * collapsing the org-wide connection for every teammate). To revoke the\n * org's shared connection, pass `{ orgId, role }` for an owner/admin —\n * matching the same authority gate `writeBuilderCredentials` uses on\n * write. Plain members can never reach the org-scoped row.\n */\nexport async function deleteBuilderCredentials(\n  email: string,\n  options?: { orgId?: string | null; role?: string | null },\n): Promise<{ scope: \"user\" | \"org\"; scopeId: string }> {\n  const { deleteAppSecret } = await import(\"../secrets/storage.js\");\n  const target = resolveCredentialWriteScope(\n    email,\n    options?.orgId ?? null,\n    options?.role ?? null,\n  );\n  await Promise.all(\n    BUILDER_CREDENTIAL_KEYS.map((key) =>\n      deleteAppSecret({\n        key,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      }).catch(() => {}),\n    ),\n  );\n  return target;\n}\n\n// ---------------------------------------------------------------------------\n// Generic request-scoped secret resolution\n//\n// New consumers should prefer this over reading `process.env.X` directly.\n// User-pasted and shared secrets live in `app_secrets` (encrypted). The\n// settings UI / onboarding panels can write user, org, or workspace rows.\n// Deploy-level env vars are the fallback for unauthenticated/CLI/background\n// contexts where there's no user to scope by. Authenticated requests may also\n// use app-provided LLM provider keys such as OPENAI_API_KEY or\n// ANTHROPIC_API_KEY, but Builder identity keys keep the stricter scoped policy.\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve a request-scoped secret. Reads from `app_secrets` first (current\n * user override, active org, then workspace row); falls back to `process.env`\n * only when the deploy fallback policy allows it.\n */\nexport async function resolveSecret(key: string): Promise<string | null> {\n  const traceLookup = shouldTraceCredentialResolve();\n  const email = getRequestUserEmail();\n  if (email) {\n    try {\n      const { readAppSecret } = await import(\"../secrets/storage.js\");\n      // Per-user override first.\n      const userSecret = await readAppSecret({\n        key,\n        scope: \"user\",\n        scopeId: email,\n      });\n      if (userSecret?.value) {\n        if (traceLookup) {\n          console.log(\n            `[resolve-secret] key=${key} email=${email} scope=user hit=true`,\n          );\n        }\n        return userSecret.value;\n      }\n\n      const orgId = getRequestOrgId();\n      if (orgId) {\n        // Fall back to the active org's shared row, when present. Builder\n        // Connect uses this first-class org scope.\n        const orgSecret = await readAppSecret({\n          key,\n          scope: \"org\",\n          scopeId: orgId,\n        });\n        if (orgSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=org hit=true`,\n            );\n          }\n          return orgSecret.value;\n        }\n\n        // Registered secrets historically used \"workspace\" scope for\n        // org-shared configuration. Keep reading it so Settings status and\n        // runtime resolution agree.\n        const workspaceSecret = await readAppSecret({\n          key,\n          scope: \"workspace\",\n          scopeId: orgId,\n        });\n        if (workspaceSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=workspace hit=true`,\n            );\n          }\n          return workspaceSecret.value;\n        }\n      } else {\n        const soloWorkspaceSecret = await readAppSecret({\n          key,\n          scope: \"workspace\",\n          scopeId: `solo:${email}`,\n        });\n        if (soloWorkspaceSecret?.value) {\n          if (traceLookup) {\n            console.log(\n              `[resolve-secret] key=${key} email=${email} scope=workspace-solo hit=true`,\n            );\n          }\n          return soloWorkspaceSecret.value;\n        }\n      }\n    } catch (err) {\n      if (traceLookup) {\n        console.log(\n          `[resolve-secret] key=${key} email=${email} scope=error err=${(err as Error)?.message ?? err}`,\n        );\n      }\n      // Secrets table not ready — treat as missing.\n    }\n    // Read deployment-provided env values as fallbacks; framework code must not\n    // write to `process.env`, but keys supplied by the host remain valid config.\n    // Builder credentials keep a narrower path below because those keys carry a\n    // Builder identity rather than just enabling a provider call.\n    const envFallback = (\n      isBuilderCredentialKey(key)\n        ? canUseBuilderDeployCredentialFallbackForRequest()\n        : canUseDeployCredentialFallbackForRequest(key)\n    )\n      ? process.env[key] || null\n      : null;\n    if (traceLookup) {\n      console.log(\n        `[resolve-secret] key=${key} email=${email} orgId=${getRequestOrgId() ?? \"(none)\"} scope=${envFallback ? \"env-fallback\" : \"none\"} hit=${!!envFallback}`,\n      );\n    }\n    return envFallback;\n  }\n  // Unauthenticated / local-dev / CLI / background context: env fallback\n  // is safe because there's no user to mis-identify.\n  const value = process.env[key] || null;\n  if (traceLookup) {\n    console.log(\n      `[resolve-secret] key=${key} email=(none) scope=env-anonymous hit=${!!value}`,\n    );\n  }\n  return value;\n}\n\n// ---------------------------------------------------------------------------\n// Synchronous helpers — env-only fallbacks for contexts where per-user\n// lookup isn't possible (sync isConfigured checks, CLI scripts).\n// ---------------------------------------------------------------------------\n\n/**\n * True when a Builder private key is configured at the deployment level.\n *\n * This is the same env-only check as `isBuilderEnvManaged()`. For \"does this\n * request have access to Builder via user/org/env credentials?\" use the async\n * `resolveHasBuilderPrivateKey()`.\n */\nexport function hasBuilderPrivateKey(): boolean {\n  return !!process.env.BUILDER_PRIVATE_KEY;\n}\n\n/** The origin for Builder-proxied API calls. Overridable for testing. */\nexport function getBuilderProxyOrigin(): string {\n  return (\n    process.env.BUILDER_PROXY_ORIGIN ||\n    process.env.AIR_HOST ||\n    process.env.BUILDER_API_HOST ||\n    \"https://api.builder.io\"\n  );\n}\n\n/**\n * Base URL for the public Builder LLM gateway, which lives at\n * api.builder.io/agent-native/gateway.\n * Override via BUILDER_GATEWAY_BASE_URL for staging / testing.\n */\nexport function getBuilderGatewayBaseUrl(): string {\n  return (\n    process.env.BUILDER_GATEWAY_BASE_URL ||\n    \"https://api.builder.io/agent-native/gateway/v1\"\n  );\n}\n\n/**\n * Base URL for Builder-managed image generation.\n * Override via BUILDER_IMAGE_GENERATION_BASE_URL for staging / testing.\n */\nexport function getBuilderImageGenerationBaseUrl(): string {\n  return (\n    process.env.BUILDER_IMAGE_GENERATION_BASE_URL ||\n    \"https://api.builder.io/agent-native/images/v1\"\n  );\n}\n\n/**\n * Base URL for Builder-managed web search.\n * Override via BUILDER_WEB_SEARCH_BASE_URL for staging / testing.\n */\nexport function getBuilderWebSearchBaseUrl(): string {\n  return (\n    process.env.BUILDER_WEB_SEARCH_BASE_URL ||\n    \"https://api.builder.io/agent-native/web-search/v1\"\n  );\n}\n\n/** Authorization header value for Builder-proxied calls (env-only). */\nexport function getBuilderAuthHeader(): string | null {\n  const key = process.env.BUILDER_PRIVATE_KEY;\n  return key ? `Bearer ${key}` : null;\n}\n"]}

package/dist/shared/cache-control.d.ts

@@ -1,10 +1,12 @@
-export declare const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
-export declare const DEFAULT_SSR_CDN_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
-export declare const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+export declare const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=0, must-revalidate";
+export declare const DEFAULT_SSR_CDN_CACHE_CONTROL = "public, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
+export declare const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
+export declare const DEFAULT_SSR_NETLIFY_VARY = "query=_routes";
 export declare const DEFAULT_SSR_CACHE_HEADERS: {
-    readonly "cache-control": "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
-    readonly "cdn-cache-control": "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
-    readonly "netlify-cdn-cache-control": "public, durable, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+    readonly "cache-control": "public, max-age=0, must-revalidate";
+    readonly "cdn-cache-control": "public, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
+    readonly "netlify-cdn-cache-control": "public, durable, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
+    readonly "netlify-vary": "query=_routes";
 };
 export declare const DEFAULT_SPECULATION_RULES_PATH = "/_agent-native/speculation-rules.json";
 export declare const DEFAULT_SPECULATION_RULES_HEADER = "\"/_agent-native/speculation-rules.json\"";

package/dist/shared/cache-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache-control.d.ts","sourceRoot":"","sources":["../../src/shared/cache-control.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,0EACmC,CAAC;AAE1E,eAAO,MAAM,6BAA6B,0EAA4B,CAAC;AAEvE,eAAO,MAAM,qCAAqC,mFACgC,CAAC;AAEnF,eAAO,MAAM,yBAAyB;aACpC,eAAe;aACf,mBAAmB;aACnB,2BAA2B;CACnB,CAAC;AAEX,eAAO,MAAM,8BAA8B,0CACF,CAAC;AAE1C,eAAO,MAAM,gCAAgC,8CAAwC,CAAC;AAEtF,eAAO,MAAM,uBAAuB;aAClC,QAAQ;aACR,SAAS;CACD,CAAC"}
+{"version":3,"file":"cache-control.d.ts","sourceRoot":"","sources":["../../src/shared/cache-control.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,uCAAuC,CAAC;AAE9E,eAAO,MAAM,6BAA6B,8EACmC,CAAC;AAE9E,eAAO,MAAM,qCAAqC,uFACoC,CAAC;AAKvF,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAExD,eAAO,MAAM,yBAAyB;aACpC,eAAe;aACf,mBAAmB;aACnB,2BAA2B;aAC3B,cAAc;CACN,CAAC;AAEX,eAAO,MAAM,8BAA8B,0CACF,CAAC;AAE1C,eAAO,MAAM,gCAAgC,8CAAwC,CAAC;AAEtF,eAAO,MAAM,uBAAuB;aAClC,QAAQ;aACR,SAAS;CACD,CAAC"}

package/dist/shared/cache-control.js

@@ -1,10 +1,15 @@
-export const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
-export const DEFAULT_SSR_CDN_CACHE_CONTROL = DEFAULT_SSR_CACHE_CONTROL;
-export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+export const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=0, must-revalidate";
+export const DEFAULT_SSR_CDN_CACHE_CONTROL = "public, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
+export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
+// React Router data requests can select a subset of route loaders with
+// `?_routes=...`. Ignore every other query parameter (UTM tags, click ids,
+// and similar tracking noise) so they cannot fragment Netlify's SSR cache.
+export const DEFAULT_SSR_NETLIFY_VARY = "query=_routes";
 export const DEFAULT_SSR_CACHE_HEADERS = {
     "cache-control": DEFAULT_SSR_CACHE_CONTROL,
     "cdn-cache-control": DEFAULT_SSR_CDN_CACHE_CONTROL,
     "netlify-cdn-cache-control": DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL,
+    "netlify-vary": DEFAULT_SSR_NETLIFY_VARY,
 };
 export const DEFAULT_SPECULATION_RULES_PATH = "/_agent-native/speculation-rules.json";
 export const DEFAULT_SPECULATION_RULES_HEADER = `"${DEFAULT_SPECULATION_RULES_PATH}"`;

package/dist/shared/cache-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache-control.js","sourceRoot":"","sources":["../../src/shared/cache-control.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GACpC,uEAAuE,CAAC;AAE1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAEvE,MAAM,CAAC,MAAM,qCAAqC,GAChD,gFAAgF,CAAC;AAEnF,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe,EAAE,yBAAyB;IAC1C,mBAAmB,EAAE,6BAA6B;IAClD,2BAA2B,EAAE,qCAAqC;CAC1D,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GACzC,uCAAuC,CAAC;AAE1C,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,8BAA8B,GAAG,CAAC;AAEtF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,EAAE;CACL,CAAC","sourcesContent":["export const DEFAULT_SSR_CACHE_CONTROL =\n  \"public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600\";\n\nexport const DEFAULT_SSR_CDN_CACHE_CONTROL = DEFAULT_SSR_CACHE_CONTROL;\n\nexport const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL =\n  \"public, durable, max-age=5, stale-while-revalidate=604800, stale-if-error=3600\";\n\nexport const DEFAULT_SSR_CACHE_HEADERS = {\n  \"cache-control\": DEFAULT_SSR_CACHE_CONTROL,\n  \"cdn-cache-control\": DEFAULT_SSR_CDN_CACHE_CONTROL,\n  \"netlify-cdn-cache-control\": DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL,\n} as const;\n\nexport const DEFAULT_SPECULATION_RULES_PATH =\n  \"/_agent-native/speculation-rules.json\";\n\nexport const DEFAULT_SPECULATION_RULES_HEADER = `\"${DEFAULT_SPECULATION_RULES_PATH}\"`;\n\nexport const EMPTY_SPECULATION_RULES = {\n  prefetch: [],\n  prerender: [],\n} as const;\n"]}
+{"version":3,"file":"cache-control.js","sourceRoot":"","sources":["../../src/shared/cache-control.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG,oCAAoC,CAAC;AAE9E,MAAM,CAAC,MAAM,6BAA6B,GACxC,2EAA2E,CAAC;AAE9E,MAAM,CAAC,MAAM,qCAAqC,GAChD,oFAAoF,CAAC;AAEvF,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAExD,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,eAAe,EAAE,yBAAyB;IAC1C,mBAAmB,EAAE,6BAA6B;IAClD,2BAA2B,EAAE,qCAAqC;IAClE,cAAc,EAAE,wBAAwB;CAChC,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GACzC,uCAAuC,CAAC;AAE1C,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,8BAA8B,GAAG,CAAC;AAEtF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,EAAE;CACL,CAAC","sourcesContent":["export const DEFAULT_SSR_CACHE_CONTROL = \"public, max-age=0, must-revalidate\";\n\nexport const DEFAULT_SSR_CDN_CACHE_CONTROL =\n  \"public, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600\";\n\nexport const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL =\n  \"public, durable, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600\";\n\n// React Router data requests can select a subset of route loaders with\n// `?_routes=...`. Ignore every other query parameter (UTM tags, click ids,\n// and similar tracking noise) so they cannot fragment Netlify's SSR cache.\nexport const DEFAULT_SSR_NETLIFY_VARY = \"query=_routes\";\n\nexport const DEFAULT_SSR_CACHE_HEADERS = {\n  \"cache-control\": DEFAULT_SSR_CACHE_CONTROL,\n  \"cdn-cache-control\": DEFAULT_SSR_CDN_CACHE_CONTROL,\n  \"netlify-cdn-cache-control\": DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL,\n  \"netlify-vary\": DEFAULT_SSR_NETLIFY_VARY,\n} as const;\n\nexport const DEFAULT_SPECULATION_RULES_PATH =\n  \"/_agent-native/speculation-rules.json\";\n\nexport const DEFAULT_SPECULATION_RULES_HEADER = `\"${DEFAULT_SPECULATION_RULES_PATH}\"`;\n\nexport const EMPTY_SPECULATION_RULES = {\n  prefetch: [],\n  prerender: [],\n} as const;\n"]}

package/docs/content/locales/ar-SA/template-design.mdx

@@ -364,6 +364,19 @@ pnpm dev
 طبقات DOM/الكود داخل ملف واحد معروض. تعكس لوحة الطبقات هذا التقسيم: الشاشات
 إطارات من المستوى الأعلى، وتحت الشاشة النشطة تظهر طبقات DOM/الكود المتداخلة.
 
+### Tweaks
+
+Tweaks هي عناصر تحكم مسماة لتغيير أهم الخصائص المرئية في التصميم بسرعة ومن دون
+تحرير المصدر. يمكن أن يوفر التصميم عينات ألوان وخيارات مقسمة وشرائط تمرير ومفاتيح
+لخصائص مثل لون التمييز ونصف قطر الزوايا والتباعد والكثافة والرؤية. يرتبط كل عنصر
+تحكم بخاصية CSS مخصصة يستخدمها التصميم المعروض، لذلك تتحدث المعاينة أثناء التعديل.
+
+تتبع Tweaks تسلسل المحرر. ترث نقاط التوقف المتجاوبة والحالات القيمة المحددة في
+التصميم الأساسي. يؤدي تغيير tweak أثناء تنشيط نقطة توقف أو حالة إلى إنشاء تجاوز
+لهذا السياق؛ وتؤدي إعادة ضبط عنصر التحكم إلى إزالة التجاوز واستعادة القيمة
+الموروثة. تبقى القيم المحفوظة مع التصميم. استخدم **إضافة الضوابط القرص** أو اطلب
+من الوكيل إظهار خاصية مرئية أخرى عندما لا تتضمن اللوحة عنصر التحكم المطلوب.
+
 ثبّت `/visual-edit` عندما يحتاج وكيل البرمجة إلى فتح تطبيق محلي يعمل في
 Design بدل إنشاء HTML نموذج أولي مستقل:
 

package/docs/content/locales/de-DE/template-design.mdx

@@ -365,6 +365,24 @@ und Bearbeitung der DOM-/Code-Ebenen in einer gerenderten Datei gedacht. Das
 Ebenenfenster spiegelt diese Trennung wider: Bildschirme sind Rahmen der
 obersten Ebene, darunter liegen die DOM-/Code-Ebenen des aktiven Bildschirms.
 
+### Tweaks
+
+Tweaks sind benannte Steuerelemente, mit denen sich die wichtigsten visuellen
+Eigenschaften eines Designs schnell und ohne Quellcodeänderung anpassen lassen.
+Ein Design kann Farbfelder, segmentierte Optionen, Schieberegler und Schalter
+für Akzentfarbe, Eckenradius, Abstände, Dichte oder Sichtbarkeit anbieten. Jedes
+Steuerelement ist mit einer vom gerenderten Design verwendeten
+CSS-Benutzereigenschaft verbunden, sodass die Vorschau beim Anpassen aktualisiert
+wird.
+
+Tweaks folgen der Kaskade des Editors. Responsive Breakpoints und Zustände erben
+den im Basisdesign festgelegten Wert. Wird ein Tweak bei aktivem Breakpoint oder
+Zustand geändert, entsteht eine Überschreibung für diesen Kontext; das Zurücksetzen
+entfernt sie und stellt den geerbten Wert wieder her. Gespeicherte Werte bleiben
+beim Design. Verwenden Sie **Fügen Sie Optimierungssteuerelemente hinzu** oder
+bitten Sie den Agenten, eine weitere visuelle Eigenschaft bereitzustellen, wenn
+das benötigte Steuerelement fehlt.
+
 Installiere `/visual-edit`, wenn ein Coding Agent eine laufende lokale App in
 Design öffnen soll, statt eigenständiges Prototype-HTML zu generieren:
 

package/docs/content/locales/es-ES/template-design.mdx

@@ -364,6 +364,22 @@ comportamiento del prototipo y editar las capas DOM/código dentro de un archivo
 renderizado. El panel de capas refleja esa división: las pantallas son marcos de
 nivel superior, con capas DOM/código anidadas para la pantalla activa.
 
+### Tweaks
+
+Los tweaks son controles con nombre para cambiar rápidamente las propiedades visuales
+más útiles de un diseño sin editar su código fuente. Un diseño puede ofrecer muestras
+de color, opciones segmentadas, deslizadores e interruptores para propiedades como el
+color de acento, el radio de las esquinas, el espaciado, la densidad o la visibilidad.
+Cada control está conectado a una propiedad CSS personalizada utilizada por el diseño,
+por lo que la vista previa se actualiza al ajustarlo.
+
+Los tweaks siguen la cascada del editor. Los puntos de quiebre y estados heredan el
+valor definido en el diseño base. Cambiar un tweak mientras un punto de quiebre o
+estado está activo crea una modificación para ese contexto; restablecer el control
+elimina la modificación y recupera el valor heredado. Los valores guardados permanecen
+con el diseño. Usa **Agregar controles de ajuste** o pide al agente que exponga otra
+propiedad visual cuando falte el control que necesitas.
+
 Instala `/visual-edit` cuando un agente de código deba abrir una app local en
 ejecución dentro de Design en lugar de generar HTML de prototipo independiente:
 

package/docs/content/locales/fr-FR/template-design.mdx

@@ -364,6 +364,23 @@ prototype et modifier les couches DOM/code dans un fichier rendu. Le panneau des
 couches reflète cette séparation : les écrans sont des cadres de niveau
 supérieur, avec les couches DOM/code imbriquées pour l'écran actif.
 
+### Tweaks
+
+Les tweaks sont des contrôles nommés qui permettent de modifier rapidement les
+propriétés visuelles les plus utiles d'un design sans éditer sa source. Un design
+peut proposer des nuanciers, des choix segmentés, des curseurs et des interrupteurs
+pour la couleur d'accent, le rayon des angles, l'espacement, la densité ou la
+visibilité. Chaque contrôle est relié à une propriété CSS personnalisée utilisée
+par le design rendu, de sorte que l'aperçu se met à jour pendant le réglage.
+
+Les tweaks suivent la cascade de l'éditeur. Les points d'arrêt responsive et les
+états héritent de la valeur définie sur le design de base. Modifier un tweak pendant
+qu'un point d'arrêt ou un état est actif crée une surcharge pour ce contexte ;
+réinitialiser le contrôle supprime la surcharge et rétablit la valeur héritée. Les
+valeurs enregistrées restent avec le design. Utilisez **Ajouter des contrôles de
+réglage** ou demandez à l'agent d'exposer une autre propriété visuelle si le contrôle
+nécessaire manque.
+
 Installez `/visual-edit` lorsqu'un agent de code doit ouvrir une app locale en
 cours d'exécution dans Design au lieu de générer du HTML de prototype autonome :
 

package/docs/content/locales/hi-IN/template-design.mdx

@@ -363,6 +363,22 @@ rendered file के अंदर DOM/code layers edit करने के ल
 model दिखाता है: screens top-level frames हैं, और active screen के नीचे nested
 DOM/code layers होते हैं।
 
+### Tweaks
+
+Tweaks नाम वाले controls हैं जिनसे source edit किए बिना design की सबसे उपयोगी
+visual properties जल्दी बदली जा सकती हैं। Design accent color, corner radius,
+spacing, density या visibility जैसी properties के लिए color swatches, segmented
+choices, sliders और toggles दे सकता है। हर control rendered design में उपयोग होने
+वाली CSS custom property से जुड़ा होता है, इसलिए adjustment के साथ preview update
+होता है।
+
+Tweaks editor के cascade का पालन करते हैं। Base design में set value responsive
+breakpoints और states को inherit होती है। किसी breakpoint या state के active होने
+पर tweak बदलने से उस context के लिए override बनता है; control reset करने पर override
+हट जाता है और inherited value वापस आती है। Saved values design के साथ रहते हैं।
+ज़रूरी control न हो तो **ट्विक नियंत्रण जोड़ें** का उपयोग करें या agent से कोई दूसरी
+visual property expose करने को कहें।
+
 जब coding agent को standalone prototype HTML बनाने के बजाय running local app को
 Design में खोलना हो, तब `/visual-edit` install करें: