@agent-native/core 0.98.6 → 0.98.7

package/dist/mcp/builtin-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"builtin-tools.js","sourceRoot":"","sources":["../../src/mcp/builtin-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AAQ/D;;;;GAIG;AACH,SAAS,IAAI,CACX,WAAmB,EACnB,UAAmB,EACnB,QAAmB;IAEnB,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxC,OAAO;QACL,WAAW;QACX,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,UAAU;YACtB,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAAiB;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAC7D,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,8BAA8B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAU,CAAC;AAClE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AA0BH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,MAA6D;IAE7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,GAAG,KAAK,oBAAoB,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA+B;IACzD,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,IAAI,wBAAwB,EAAE,CAAC;IACrE,OAAO,sBAAsB,CAAC,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,8BAA8B,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,IAAU;IAChC,OAAO,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU;IAC1B,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;QACxB,EAAE,MAAM,CACN,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CACvE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,IAAI,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkB,EAAE,IAAU;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ,IAAI,eAAe;SACtC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACjD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,KAAK,EAAE,QAAQ,IAAI,gBAAgB,MAAM,GAAG;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SAC/C;QACD,OAAO,EACL,oBAAoB,MAAM,6BAA6B;YACvD,WAAW,IAAI,CAAC,EAAE,mCAAmC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAAc;IAIpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,OAAO;QACL,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YACzC,gBAAgB,EAAE,8BAA8B;YAChD,GAAG,CAAC,IAAI,CAAC,eAAe;gBACtB,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAA4C,EAC5C,WAAiB,EACjB,SAAiB;IAEjB,IAAI,SAAS,IAAI,CAAC,IAAI,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,WAAW,CAAC;IAE1B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CACnE,CAAC;QACF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,iDAAiD;YACjD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC3C,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAkB,EAClB,OAAe,EACf,SAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACzC,EACD;QACE,KAAK,EAAE,IAAI;QACX,QAAQ;KACT,CACF,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAkB,EAClB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,SAAkB,CAAC;IACvB,KACE,IAAI,OAAO,GAAG,CAAC,EACf,OAAO,IAAI,8BAA8B,CAAC,MAAM,EAChD,OAAO,EAAE,EACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,MAAM,OAAO,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAY;IAChD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,CACL,oGAAoG,CAAC,IAAI,CACvG,OAAO,CACR,IAAI,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAiB,EACjB,WAAmB;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,SAAS,YAAY,CACnB,MAAiB,EACjB,WAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,IAAI,CACR,qEAAqE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,qDAAqD,CACxD;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACpE,MAAM,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAEpC,kEAAkE;YAClE,iEAAiE;YACjE,sEAAsE;YACtE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,qEAAqE;YACrE,iBAAiB;YACjB,MAAM,UAAU,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC9B,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC;YAUjE,MAAM,IAAI,GAAe,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACV,CAAC,CAAC;oBACE,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,GAAG,EAAE,UAAU;oBACf,IAAI,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAuB;oBAChD,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAoB;iBAC7B;gBACH,CAAC,CAAC;oBACE,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,IAAI,EAAE,CAAC,CAAC,IAA0B;oBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,MAAM,EAAE,WAAoB;iBAC7B,CACN,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAExE,qEAAqE;YACrE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;gBACjC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;YAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7C,gEAAgE;gBAChE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnB,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC;oBACR,EAAE,EAAE,EAAE,CAAC,EAAE;oBACT,GAAG,EAAE,EAAE,CAAC,GAAG;oBACX,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,EAAE,CAAC,WAAW;gBACzB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,IAAI;aACL,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAS,WAAW,CAClB,MAAiB,EACjB,WAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,IAAI,CACR,mEAAmE;YACjE,mCAAmC;YACnC,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,kBAAkB,EACpB;YACE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;YAC3D,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sHAAsH;aACzH;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,oLAAoL;aACvL;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iEAAiE;aACpE;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,8FAA8F;aACjG;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;gBACzB,WAAW,EACT,sEAAsE;aACzE;SACF,EACD,CAAC,KAAK,CAAC,CACR;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,yDAAyD;YACzD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAA6D,CAAC;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAgD,CAAC;YAC5D,CAAC;iBAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,SAAS,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,CAAC;YACpC,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,CAAC;YACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;YACzD,IACE,IAAI,CAAC,KAAK,IAAI,IAAI;gBAClB,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,MAAM,CAAC,EACpD,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;iBAAM,IACL,IAAI,CAAC,KAAK,IAAI,IAAI;gBAClB,CAAC,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,OAAO,CAAC,EACtD,CAAC;gBACD,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YACD,IACE,aAAa,KAAK,IAAI;gBACtB,aAAa,KAAK,KAAK;gBACvB,aAAa,KAAK,MAAM;gBACxB,aAAa,KAAK,OAAO,EACzB,CAAC;gBACD,OAAO,MAAM,EAAE,KAAK,CAAC;YACvB,CAAC;YAED,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAC7B,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS;oBACnD,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxD,OAAO,MAAM,EAAE,MAAM,CAAC;YACxB,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,GAAG,SAAS,CAAC;YAEnE,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI;gBACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC;gBAClC,CAAC,CAAC,cAAc;oBACd,CAAC,CAAC,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC;oBAC5C,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,MAAM,UAAU,GACd,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEnE,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,SAAS;gBACtB,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,EAAE;gBACpD,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC;YACnB,IAAI,aAAiC,CAAC;YACtC,IAAI,eAAmC,CAAC;YACxC,IAAI,cAAkC,CAAC;YAEvC,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxB,MAAM,EAAE,iBAAiB,EAAE,GACzB,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,GAC1D,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;oBAC7C,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBAC3C,MAAM,UAAU,GAAG,wBAAwB,CACzC,sBAAsB,CAAC,GAAG,CAAC,EAC3B,WAAW,EAAE,MAAM,CACpB,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBACf,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;4BAC5C,UAAU;4BACV,KAAK,EAAE,GAAG,EAAE,KAAK;4BACjB,UAAU;4BACV,KAAK,EAAE,MAAM,IAAI,IAAI;yBACtB,CAAC,CAAC;wBACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBACrD,aAAa,GAAG,WAAW,EAAE,MAAM;4BACjC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;4BACnD,CAAC,CAAC,SAAS,CAAC;wBACd,eAAe,GAAG,UAAU,CAAC;wBAC7B,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,GAAG;gBACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG;gBACH,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,KAAK;aACN,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,CAAC,GAAG,MAKT,CAAC;YACF,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,CAAC,CAAC,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK,EAAE,QAAQ,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE;gBAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC;QACJ,CAAC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,QAAQ,CAAC;gBACjB,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,wCAAwC;gBACrD,WAAW,EAAE,kBAAkB;gBAC/B,SAAS,EAAE,UAAU;aACtB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,sBAAsB,CAAC,WAE/B;IACC,OAAO;QACL,IAAI,EAAE;YACJ,GAAG,IAAI,CACL,qJAAqJ,EACrJ;gBACE,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,yDAAyD;iBAC5D;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yCAAyC;iBACvD;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;oBACzB,WAAW,EAAE,4CAA4C;iBAC1D;aACF,CACF;YACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;SACzB;QACf,0EAA0E;QAC1E,uEAAuE;QACvE,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,EAAE,iBAAiB,EAAE,GACzB,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,GAC1D,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAC7C,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC7C,CAAC,CAAC,IAAI,CAAC,GAAG;gBACV,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,wBAAwB,CACzC,SAAS,EACT,WAAW,EAAE,MAAM,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;gBAC5C,UAAU;gBACV,KAAK,EAAE,GAAG,EAAE,KAAK;gBACjB,UAAU;gBACV,KAAK,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aAC5D,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,WAAW,EAAE,MAAM;gBAClC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,QAAQ;gBACR,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,EAAU,EACV,OAAe,EACf,OAAmD;IAInD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,mBAAmB,CACxB,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EACrE,OAAO,EACP,OAAO,CAAC,SAAS,IAAI,8BAA8B,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,yDAAyD;QACzD,SAAS,EAAE,CAAC,GAAG,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAiB,EACjB,YAAoB,EACpB,WAA+B;IAE/B,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,MAAM,EAAE,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC;YAChD,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,EAAE;YAChB,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,UAAU,CACjB,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,mEAAmE;YACjE,kEAAkE;YAClE,oEAAoE;YACpE,+DAA+D;YAC/D,oEAAoE;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,uEAAuE,EACzE;YACE,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,uDAAuD;aACrE;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,wCAAwC;aACtD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,uEAAuE;aAC1E;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,2FAA2F;aAC9F;SACF,EACD,CAAC,SAAS,CAAC,CACZ;QACD,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC9C,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAExC,qEAAqE;YACrE,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACrE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,OAAO,MAAM,eAAe,CAC1B,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,EAAE,EACZ,OAAO,EACP;wBACE,OAAO,EAAE,aAAa;wBACtB,SAAS;qBACV,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,oEAAoE;oBACpE,kDAAkD;oBAClD,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,CAAC,EAAE,aAAa;wBACtD,GAAG,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAClD,GAAG,EAAE,CAAC,EAAc,CACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAC3C,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,OAAO,MAAM,eAAe,CAC1B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,EAAE,EACX,OAAO,EACP;4BACE,OAAO,EAAE,aAAa;4BACtB,SAAS;yBACV,CACF,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,EAAE,YAAY;4BACpD,oBAAoB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC5C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,iDAAiD;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,UAAU,GACd,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;YAC1D,MAAM,IAAI,GAAG,UAAU;gBACrB,CAAC,CAAC,kBAAkB,YAAY,iCAAiC;oBAC/D,iCAAiC,MAAM,aAAa;gBACtD,CAAC,CAAC,SAAS,CAAC;YAEd,wEAAwE;YACxE,sEAAsE;YACtE,0EAA0E;YAC1E,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC5D,IAAI,mBAAmB,EAAE,CAAC;gBACxB,OAAO,mBAAmB,CACxB;oBACE,GAAG,EAAE,MAAM;oBACX,MAAM,EAAE,mBAAmB;oBAC3B,SAAS,EAAE,OAAO;oBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1B,EACD,OAAO,EACP,SAAS,CACV,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO;gBACL,GAAG,EAAE,MAAM;gBACX,SAAS,EAAE,OAAO;gBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,QAAQ;aACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,8EAA8E,EAC9E;YACE,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gEAAgE;aACnE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,0CAA0C;aACxD;SACF,EACD,CAAC,QAAQ,CAAC,CACX;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAC1C,MAAM,EACN,YAAY,EACZ,WAAW,CACZ,CAAC;YACF,OAAO,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,OAAO;QACL,IAAI,EAAE,IAAI,CACR,yEAAyE;YACvE,gCAAgC,CACnC;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACtE,OAAO;gBACL,SAAS,EAAE,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxC,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,sBAAsB;IAC7B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,qEAAqE;YACnE,sEAAsE;YACtE,6CAA6C,EAC/C;YACE,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,mDAAmD;aACjE;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,uEAAuE;aAC1E;SACF,EACD,CAAC,MAAM,EAAE,UAAU,CAAC,CACrB;QACD,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,mCAAmC,CAAC,GAAG,OAAO,CAAC;qBACjE,IAAI,EAAE;qBACN,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAC3C,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACb,+DAA+D;oBAC7D,oDAAoD,CACvD,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE7C,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,iEAAiE;gBACjE,oEAAoE;gBACpE,qEAAqE;gBACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACpB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;oBAC/D,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC;wBACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzB,CAAC;oBAAC,MAAM,CAAC;wBACP,0BAA0B;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,mEAAmE;YACnE,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;YAC3B,mEAAmE;YACnE,iEAAiE;YACjE,qEAAqE;YACrE,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG;gBAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE;gBACpD,CAAC,CAAC,WAAW,CAAC;YAEhB,OAAO;gBACL,IAAI;gBACJ,QAAQ;gBACR,OAAO,EAAE,CAAC,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,IAAI;gBACJ,GAAG,EAAE,OAAO,EAAE,GAAG;gBACjB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,CAAC,GAAG,MAA8C,CAAC;YACzD,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,QAAQ;gBACf,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,KAAK,EAAE;gBAChC,IAAI,EAAE,MAAM;aACb,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC;QAC5C,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC;QAC1C,oBAAoB,EAAE,sBAAsB,CAAC,WAAW,CAAC;QACzD,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC;QACxC,cAAc,EAAE,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;QACrD,oBAAoB,EAAE,sBAAsB,EAAE;QAC9C,cAAc,EAAE,iBAAiB,EAAE;KACpC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Generic cross-app MCP tools — a stable verb set every external agent gets\n * regardless of which template it is talking to.\n *\n * These are merged into the MCP action registry by\n * `createMCPServerForRequest` (see `build-server.ts`). **Precedence: template\n * actions win.** If a template defines an action named `list_apps` /\n * `open_app` / `ask_app` / `create_workspace_app` / `list_templates`, the\n * template's `ActionEntry` overwrites the builtin of the same name. This is\n * the same template-over-framework precedence `autoDiscoverActions` uses.\n *\n * | Tool                  | Side effects | Returns                                  |\n * | --------------------- | ------------ | ---------------------------------------- |\n * | `list_apps`           | none         | `{ apps: [{ id, url, running }] }`       |\n * | `open_app`            | none         | `{ url }` (+ deep-link `link`)           |\n * | `create_embed_session`| ticket mint  | `{ startUrl }` for MCP App iframes       |\n * | `ask_app`             | agent loop   | `{ app, routedVia, response }` or task   |\n * | `ask_app_status`      | none         | poll a durable `ask_app` task            |\n * | `create_workspace_app`| scaffolds    | `{ name, url, port, deepLink }` (+ link) |\n *\n * `open_app` / `create_workspace_app` return an **absolute** URL on the\n * *target* app's origin when it differs from this app (so a workspace link\n * lands in the right app), and a relative path for the same app / standalone.\n * `ask_app` routes to a *different* workspace app over A2A when possible and\n * reports `routedVia: \"a2a\"`; otherwise it answers locally\n * (`routedVia: \"local\"`) and never falsely claims cross-app delegation.\n * | `list_templates`      | none         | `{ templates: [...] }` (allow-list only) |\n *\n * Node-only at call time (workspace resolution + scaffolding use `fs`), but\n * the module has no top-level Node imports so it bundles fine alongside\n * `mountMCP` — the Node bits are dynamically imported inside `run()`.\n */\n\nimport type { Task } from \"../a2a/types.js\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport { getConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { buildDeepLink } from \"../server/deep-link.js\";\nimport { MCP_APP_CHAT_BRIDGE_QUERY_PARAM } from \"../shared/embed-auth.js\";\nimport type { MCPConfig } from \"./build-server.js\";\nimport { embedApp } from \"./embed-app.js\";\nimport { fetchOrgApps, type OrgApp } from \"./org-directory.js\";\n\n/** Flat map of param name → JSON-schema property. */\ntype Params = Record<\n  string,\n  { type: string; description?: string; enum?: string[] }\n>;\n\n/**\n * Build an `ActionTool`. `parameters` is wrapped in the\n * `{ type:\"object\", properties, required }` shape `createMCPServerForRequest`\n * forwards verbatim as the MCP tool `inputSchema`.\n */\nfunction tool(\n  description: string,\n  parameters?: Params,\n  required?: string[],\n): ActionTool {\n  if (!parameters) return { description };\n  return {\n    description,\n    parameters: {\n      type: \"object\",\n      properties: parameters,\n      ...(required && required.length ? { required } : {}),\n    },\n  };\n}\n\n/**\n * The canonical app id this MCP server is mounted for. `MCPConfig.appId` is\n * authoritative; fall back to lowercasing `name` (which is the capitalized\n * app id at every call site) for back-compat with configs that predate the\n * `appId` field.\n */\nfunction currentAppId(config: MCPConfig): string {\n  return (config.appId || config.name || \"app\").toLowerCase();\n}\n\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\nconst ASK_APP_DEFAULT_INLINE_WAIT_MS = 20_000;\nconst ASK_APP_MAX_INLINE_WAIT_MS = 25_000;\nconst ASK_APP_POLL_INTERVAL_MS = 1_500;\nconst ASK_APP_A2A_REQUEST_TIMEOUT_MS = 10_000;\nconst ASK_APP_STATUS_RETRY_DELAYS_MS = [250, 750, 1_500] as const;\nconst ASK_APP_TERMINAL_STATES = new Set<string>([\n  \"completed\",\n  \"failed\",\n  \"canceled\",\n]);\n\ntype AskAppRequestMeta = { origin?: string; basePath?: string };\n\ninterface AskAppRoute {\n  app: string;\n  origin: string;\n  routedVia: \"local\" | \"a2a\";\n  note?: string;\n}\n\ninterface AskAppTaskResult {\n  app: string;\n  routedVia: \"local\" | \"a2a\";\n  taskId: string;\n  status: string;\n  response?: string;\n  error?: string;\n  note?: string;\n  poll?: {\n    tool: \"ask_app_status\";\n    arguments: { app: string; taskId: string };\n  };\n  message?: string;\n}\n\nfunction safeAppPath(raw: unknown): string | null {\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\n  const value = raw.trim();\n  if (CONTROL_CHARS.test(value)) return null;\n  if (!value.startsWith(\"/\")) return null;\n  if (value.startsWith(\"//\") || value.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(value)) return null;\n  return value;\n}\n\nfunction appendParamsToPath(\n  path: string,\n  params: Record<string, string | number | boolean> | undefined,\n): string {\n  if (!params || Object.keys(params).length === 0) return path;\n  const url = new URL(path, \"http://agent-native.invalid\");\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, String(value));\n  }\n  return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction viewToAppPath(view: string): string | null {\n  const value = view.trim();\n  if (!value) return null;\n  return safeAppPath(value.startsWith(\"/\") ? value : `/${value}`);\n}\n\nfunction withConfiguredBasePath(path: string): string {\n  const base = getConfiguredAppBasePath();\n  if (!base || path === base || path.startsWith(`${base}/`)) return path;\n  return `${base}${path}`;\n}\n\nfunction withMcpChatBridgeParam(path: string): string {\n  try {\n    const url = new URL(path, \"http://agent-native.invalid\");\n    url.searchParams.set(MCP_APP_CHAT_BRIDGE_QUERY_PARAM, \"1\");\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return path;\n  }\n}\n\nfunction agentNativeA2AEndpoint(urlOrOrigin: string): string {\n  const value = urlOrOrigin.replace(/\\/+$/, \"\");\n  try {\n    const parsed = new URL(value);\n    const pathname = parsed.pathname.replace(/\\/+$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\") || pathname.endsWith(\"/a2a\")) {\n      return value;\n    }\n  } catch {\n    // Fall through and append the conventional Agent Native endpoint.\n  }\n  return `${value}/_agent-native/a2a`;\n}\n\nfunction selfA2AEndpointUrl(requestMeta?: AskAppRequestMeta): string | null {\n  const origin = requestMeta?.origin?.replace(/\\/+$/, \"\");\n  if (!origin) return null;\n  const basePath = requestMeta?.basePath || getConfiguredAppBasePath();\n  return agentNativeA2AEndpoint(`${origin}${basePath}`);\n}\n\nfunction boundedAskAppWaitMs(raw: unknown): number {\n  if (raw == null || raw === \"\") return ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed)) return ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  return Math.max(0, Math.min(ASK_APP_MAX_INLINE_WAIT_MS, Math.trunc(parsed)));\n}\n\nfunction isExplicitAsyncAsk(raw: unknown): boolean {\n  return raw === true || raw === \"true\" || raw === 1 || raw === \"1\";\n}\n\nfunction taskState(task: Task): string {\n  return String(task.status?.state ?? \"unknown\");\n}\n\nfunction isTerminalTask(task: Task): boolean {\n  return ASK_APP_TERMINAL_STATES.has(taskState(task));\n}\n\nfunction taskText(task: Task): string {\n  return (\n    task.status.message?.parts\n      ?.filter(\n        (part): part is { type: \"text\"; text: string } => part.type === \"text\",\n      )\n      .map((part) => part.text)\n      .join(\"\\n\")\n      .trim() ?? \"\"\n  );\n}\n\nfunction askAppTaskResult(route: AskAppRoute, task: Task): AskAppTaskResult {\n  const status = taskState(task);\n  const response = taskText(task);\n  const base = {\n    app: route.app,\n    routedVia: route.routedVia,\n    taskId: task.id,\n    status,\n    ...(route.note ? { note: route.note } : {}),\n  };\n\n  if (status === \"completed\") {\n    return {\n      ...base,\n      response: response || \"(no response)\",\n    };\n  }\n\n  if (status === \"failed\" || status === \"canceled\") {\n    return {\n      ...base,\n      ...(response ? { response } : {}),\n      error: response || `ask_app task ${status}.`,\n    };\n  }\n\n  return {\n    ...base,\n    poll: {\n      tool: \"ask_app_status\",\n      arguments: { app: route.app, taskId: task.id },\n    },\n    message:\n      `ask_app is still ${status}. Call ask_app_status with ` +\n      `taskId \"${task.id}\" to retrieve the final response.`,\n  };\n}\n\nasync function createA2AClientForAskApp(origin: string): Promise<{\n  client: import(\"../a2a/client.js\").A2AClient;\n  metadata: Record<string, unknown>;\n}> {\n  const { A2AClient } = await import(\"../a2a/client.js\");\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  const auth = await resolveA2ACallerAuth();\n  const metadata: Record<string, unknown> = {};\n  if (auth.userEmail) metadata.userEmail = auth.userEmail;\n  if (auth.orgDomain) metadata.orgDomain = auth.orgDomain;\n  return {\n    client: new A2AClient(origin, auth.apiKey, {\n      requestTimeoutMs: ASK_APP_A2A_REQUEST_TIMEOUT_MS,\n      ...(auth.apiKeyFallbacks\n        ? { fallbackApiKeys: auth.apiKeyFallbacks }\n        : {}),\n    }),\n    metadata,\n  };\n}\n\nasync function waitForA2ATask(\n  client: import(\"../a2a/client.js\").A2AClient,\n  initialTask: Task,\n  maxWaitMs: number,\n): Promise<Task> {\n  if (maxWaitMs <= 0 || isTerminalTask(initialTask)) return initialTask;\n  const deadline = Date.now() + maxWaitMs;\n  let current = initialTask;\n\n  while (!isTerminalTask(current)) {\n    const remaining = deadline - Date.now();\n    if (remaining <= 0) return current;\n    await new Promise((resolve) =>\n      setTimeout(resolve, Math.min(ASK_APP_POLL_INTERVAL_MS, remaining)),\n    );\n    try {\n      current = await client.getTask(initialTask.id);\n    } catch {\n      // Transient status fetch failures should not turn a successfully\n      // submitted durable task into a failed MCP call.\n      if (Date.now() >= deadline) return current;\n      continue;\n    }\n  }\n\n  return current;\n}\n\nasync function submitAskAppA2ATask(\n  route: AskAppRoute,\n  message: string,\n  maxWaitMs: number,\n): Promise<AskAppTaskResult> {\n  const { client, metadata } = await createA2AClientForAskApp(route.origin);\n  const task = await client.send(\n    {\n      role: \"user\",\n      parts: [{ type: \"text\", text: message }],\n    },\n    {\n      async: true,\n      metadata,\n    },\n  );\n  const finalOrRunning = await waitForA2ATask(client, task, maxWaitMs);\n  return askAppTaskResult(route, finalOrRunning);\n}\n\nasync function fetchAskAppA2ATask(\n  route: AskAppRoute,\n  taskId: string,\n): Promise<AskAppTaskResult> {\n  const { client } = await createA2AClientForAskApp(route.origin);\n  let lastError: unknown;\n  for (\n    let attempt = 0;\n    attempt <= ASK_APP_STATUS_RETRY_DELAYS_MS.length;\n    attempt++\n  ) {\n    try {\n      const task = await client.getTask(taskId);\n      return askAppTaskResult(route, task);\n    } catch (err) {\n      lastError = err;\n      const delayMs = ASK_APP_STATUS_RETRY_DELAYS_MS[attempt];\n      if (delayMs == null || !isTransientAskAppStatusError(err)) {\n        throw err;\n      }\n      await new Promise((resolve) => setTimeout(resolve, delayMs));\n    }\n  }\n  throw lastError;\n}\n\nfunction isTransientAskAppStatusError(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err ?? \"\");\n  return (\n    /\\bfetch failed\\b|failed to fetch|networkerror|socket hang up|econnreset|etimedout|timeout|aborted/i.test(\n      message,\n    ) || /A2A request failed \\((?:429|500|502|503|504)\\)/i.test(message)\n  );\n}\n\n/**\n * Resolve the absolute origin of a *target* workspace app (e.g.\n * `http://127.0.0.1:8101`) so cross-app deep links / A2A calls point at the\n * right app instead of the current request's origin. Reuses the same\n * workspace resolution `list_apps` / the stdio proxy use.\n *\n * Returns `null` when:\n *   - the target is the current app (caller should keep relative behavior),\n *   - there is no workspace info (standalone / single app), or\n *   - the target app is unknown.\n */\nasync function resolveTargetAppOrigin(\n  config: MCPConfig,\n  targetAppId: string,\n): Promise<{ origin: string; id: string } | null> {\n  const target = targetAppId.trim().toLowerCase();\n  if (!target || target === currentAppId(config)) return null;\n  try {\n    const { resolveWorkspace } = await import(\"./workspace-resolve.js\");\n    const ws = await resolveWorkspace();\n    if (!ws.isWorkspace) return null;\n    const match = ws.apps.find((a) => a.id.toLowerCase() === target);\n    if (!match) return null;\n    return { origin: match.url, id: match.id };\n  } catch {\n    return null;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// list_apps\n// ---------------------------------------------------------------------------\n\nfunction listAppsTool(\n  config: MCPConfig,\n  requestMeta?: { origin?: string },\n): ActionEntry {\n  return {\n    tool: tool(\n      \"List the workspace apps and their URLs. Use this to discover which \" +\n        \"apps exist before opening or asking one. In a single-app project \" +\n        \"this returns just that app. When an org directory is configured \" +\n        \"this also includes the org's deployed sibling apps.\",\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async () => {\n      const { resolveWorkspace } = await import(\"./workspace-resolve.js\");\n      const ws = await resolveWorkspace();\n\n      // The MCP request is served BY the current app, so it is provably\n      // reachable at the inbound request origin — that beats a guessed\n      // `PORT || 5173` probe (which reports the wrong URL + `running:false`\n      // whenever the dev server picked a non-default port, e.g. `agent-\n      // native dev` on :8080). For the entry that IS this app (the sole\n      // entry when single-app, or the id matching `config.appId` in a\n      // workspace) prefer the live origin; other workspace apps keep their\n      // probed values.\n      const liveOrigin = requestMeta?.origin?.replace(/\\/+$/, \"\") || \"\";\n      let livePort = 0;\n      if (liveOrigin) {\n        try {\n          const u = new URL(liveOrigin);\n          livePort = Number(u.port) || (u.protocol === \"https:\" ? 443 : 80);\n        } catch {\n          livePort = 0;\n        }\n      }\n      const selfId = (config.appId ?? \"\").toLowerCase();\n      const isSelf = (id: string) =>\n        !!liveOrigin &&\n        (!ws.isWorkspace || (!!selfId && id.toLowerCase() === selfId));\n\n      interface AppEntry {\n        id: string;\n        url: string;\n        port: number | undefined;\n        running: boolean;\n        source: \"workspace\" | \"org-directory\";\n      }\n\n      const apps: AppEntry[] = ws.apps.map((a) =>\n        isSelf(a.id)\n          ? {\n              id: a.id,\n              url: liveOrigin,\n              port: (livePort || a.port) as number | undefined,\n              running: true,\n              source: \"workspace\" as const,\n            }\n          : {\n              id: a.id,\n              url: a.url,\n              port: a.port as number | undefined,\n              running: a.running,\n              source: \"workspace\" as const,\n            },\n      );\n      const seenIds = new Set(apps.map((a) => a.id.toLowerCase()));\n      const seenOrigins = new Set(apps.map((a) => a.url.replace(/\\/+$/, \"\")));\n\n      // Merge the org directory's deployed sibling apps. Inactive (no env)\n      // or any failure ⇒ fetchOrgApps() returns [] and this is a no-op, so\n      // the existing local/workspace behavior is preserved exactly.\n      const orgApps = await fetchOrgApps({\n        selfId: currentAppId(config),\n      }).catch(() => [] as OrgApp[]);\n      for (const oa of orgApps) {\n        const idKey = oa.id.toLowerCase();\n        const originKey = oa.url.replace(/\\/+$/, \"\");\n        // Dedupe by id OR origin — a workspace app already listed wins.\n        if (seenIds.has(idKey) || seenOrigins.has(originKey)) continue;\n        seenIds.add(idKey);\n        seenOrigins.add(originKey);\n        apps.push({\n          id: oa.id,\n          url: oa.url,\n          port: undefined,\n          running: true,\n          source: \"org-directory\",\n        });\n      }\n\n      return {\n        workspace: ws.isWorkspace,\n        gatewayUrl: ws.gatewayUrl,\n        apps,\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// open_app\n// ---------------------------------------------------------------------------\n\nfunction openAppTool(\n  config: MCPConfig,\n  requestMeta?: { origin?: string },\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Build a deep link that opens an app at a specific view/record or \" +\n        \"focused route/component. No side \" +\n        \"effects — returns a URL the user can click to land in the running UI. \" +\n        \"Set embed:true when a UI-capable MCP host should render the live app \" +\n        \"or focused route/component inline. Omit view and path to land on the \" +\n        \"app's home page.\",\n      {\n        app: { type: \"string\", description: \"App id, e.g. 'mail'\" },\n        view: {\n          type: \"string\",\n          description:\n            \"Target view, e.g. 'inbox' (maps to navigate command). Optional — omit (along with path) to open the app's home page.\",\n        },\n        path: {\n          type: \"string\",\n          description:\n            \"Optional app route to open directly, e.g. '/extensions/abc', '/adhoc/q2', or '/chart?panel=...'. Must be same-origin relative. Omit (along with view) to open the app's home page.\",\n        },\n        params: {\n          type: \"object\",\n          description:\n            \"Optional record-focus / filter params, e.g. { threadId: 'abc' }\",\n        },\n        embed: {\n          type: \"boolean\",\n          description:\n            \"Render the full app or focused route/component inline in MCP Apps when the host supports it.\",\n        },\n        chrome: {\n          type: \"string\",\n          enum: [\"full\", \"minimal\"],\n          description:\n            \"Embed chrome preference for compatible app routes. Defaults to full.\",\n        },\n      },\n      [\"app\"],\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const app = String(args.app ?? \"\").trim();\n      const view = String(args.view ?? \"\").trim();\n      // `safeAppPath` rejects anything that isn't a leading-slash same-origin\n      // path. When the caller passes nothing, fall back to the app's root so a\n      // bare `open_app({app:\"dispatch\"})` lands on the home page instead of\n      // throwing. The model self-corrects on the retry today, but the extra\n      // round-trip wastes a turn and looks broken to the user.\n      const path = safeAppPath(args.path) || (view ? null : \"/\");\n      if (!app) {\n        throw new Error(\"open_app requires 'app'.\");\n      }\n      let params: Record<string, string | number | boolean> | undefined;\n      const raw = args.params;\n      if (raw && typeof raw === \"object\") {\n        params = raw as Record<string, string | number | boolean>;\n      } else if (typeof raw === \"string\" && raw.trim()) {\n        try {\n          params = JSON.parse(raw);\n        } catch {\n          params = undefined;\n        }\n      }\n      const embeddedParam = params?.embed;\n      const chromeParam = params?.chrome;\n      let embed = args.embed === true || args.embed === \"true\";\n      if (\n        args.embed == null &&\n        (embeddedParam === true || embeddedParam === \"true\")\n      ) {\n        embed = true;\n      } else if (\n        args.embed == null &&\n        (embeddedParam === false || embeddedParam === \"false\")\n      ) {\n        embed = false;\n      }\n      if (\n        embeddedParam === true ||\n        embeddedParam === false ||\n        embeddedParam === \"true\" ||\n        embeddedParam === \"false\"\n      ) {\n        delete params?.embed;\n      }\n\n      const chrome =\n        typeof args.chrome === \"string\"\n          ? args.chrome\n          : chromeParam === \"full\" || chromeParam === \"minimal\"\n            ? chromeParam\n            : undefined;\n      if (chromeParam === \"full\" || chromeParam === \"minimal\") {\n        delete params?.chrome;\n      }\n      if (params && Object.keys(params).length === 0) params = undefined;\n\n      const directViewPath = embed && view ? viewToAppPath(view) : null;\n      const relUrl = path\n        ? appendParamsToPath(path, params)\n        : directViewPath\n          ? appendParamsToPath(directViewPath, params)\n          : buildDeepLink({ app, view, params });\n      const sameAppUrl =\n        path || directViewPath ? withConfiguredBasePath(relUrl) : relUrl;\n\n      // Cross-app target in a workspace: resolve the TARGET app's origin and\n      // return an absolute URL. Otherwise the MCP layer would prefix the\n      // relative path with the CURRENT request origin, landing the user in\n      // the wrong app (e.g. open_app({app:\"calendar\"}) served from Mail).\n      // Same-app / standalone keeps the relative path (current behavior).\n      const targetApp = await resolveTargetAppOrigin(config, app);\n      const appUrl = targetApp\n        ? `${targetApp.origin.replace(/\\/+$/, \"\")}${relUrl}`\n        : sameAppUrl;\n      const url = appUrl;\n      let embedStartUrl: string | undefined;\n      let embedTargetPath: string | undefined;\n      let embedExpiresAt: number | undefined;\n\n      if (embed && !targetApp) {\n        const { getRequestContext } =\n          await import(\"../server/request-context.js\");\n        const ctx = getRequestContext();\n        const ownerEmail = ctx?.userEmail?.trim();\n        if (ownerEmail) {\n          const { normalizeEmbedTargetPath, createEmbedSessionTicket } =\n            await import(\"../server/embed-session.js\");\n          const { buildEmbedStartPath } =\n            await import(\"../server/embed-route.js\");\n          const targetPath = normalizeEmbedTargetPath(\n            withMcpChatBridgeParam(url),\n            requestMeta?.origin,\n          );\n          if (targetPath) {\n            const ticket = await createEmbedSessionTicket({\n              ownerEmail,\n              orgId: ctx?.orgId,\n              targetPath,\n              scope: chrome ?? null,\n            });\n            const startPath = buildEmbedStartPath(ticket.ticket);\n            embedStartUrl = requestMeta?.origin\n              ? new URL(startPath, requestMeta.origin).toString()\n              : startPath;\n            embedTargetPath = targetPath;\n            embedExpiresAt = ticket.expiresAt;\n          }\n        }\n      }\n\n      return {\n        app,\n        ...(view ? { view } : {}),\n        ...(path ? { path } : {}),\n        url,\n        ...(embedStartUrl ? { embedStartUrl } : {}),\n        ...(embedTargetPath ? { embedTargetPath } : {}),\n        ...(embedExpiresAt ? { embedExpiresAt } : {}),\n        embed,\n      };\n    },\n    link: ({ result }) => {\n      if (!result || typeof result !== \"object\") return null;\n      const r = result as {\n        url?: string;\n        app?: string;\n        view?: string;\n        embed?: boolean;\n      };\n      if (r.embed) return null;\n      if (!r.url) return null;\n      return {\n        url: r.url,\n        label: `Open ${r.app ?? \"app\"}`,\n        view: r.view,\n      };\n    },\n    mcpApp: {\n      resource: embedApp({\n        title: \"Open app\",\n        description: \"Render the requested app route inline.\",\n        iframeTitle: \"Agent Native app\",\n        openLabel: \"Open app\",\n      }),\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// create_embed_session\n// ---------------------------------------------------------------------------\n\nfunction createEmbedSessionTool(requestMeta?: {\n  origin?: string;\n}): ActionEntry {\n  return {\n    tool: {\n      ...tool(\n        \"MCP Apps helper: create a one-time browser embed session for a same-origin app URL. Usually called by an MCP App iframe, not directly by the model.\",\n        {\n          url: {\n            type: \"string\",\n            description:\n              \"Same-origin absolute URL or app-relative path to embed.\",\n          },\n          path: {\n            type: \"string\",\n            description: \"Same-origin app-relative path to embed.\",\n          },\n          chrome: {\n            type: \"string\",\n            enum: [\"full\", \"minimal\"],\n            description: \"Embed chrome preference. Defaults to full.\",\n          },\n        },\n      ),\n      _meta: { ui: { visibility: [\"app\"] } },\n    } as ActionTool,\n    // App-only bootstrap helper: the ticket becomes a normal browser session,\n    // so keep it write-scoped until embed sessions can enforce MCP scopes.\n    readOnly: false,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const { getRequestContext } =\n        await import(\"../server/request-context.js\");\n      const ctx = getRequestContext();\n      const ownerEmail = ctx?.userEmail?.trim();\n      if (!ownerEmail) {\n        throw new Error(\n          \"create_embed_session requires an authenticated MCP caller.\",\n        );\n      }\n\n      const { normalizeEmbedTargetPath, createEmbedSessionTicket } =\n        await import(\"../server/embed-session.js\");\n      const { buildEmbedStartPath } = await import(\"../server/embed-route.js\");\n      const rawTarget =\n        typeof args.url === \"string\" && args.url.trim()\n          ? args.url\n          : typeof args.path === \"string\"\n            ? args.path\n            : \"\";\n      const targetPath = normalizeEmbedTargetPath(\n        rawTarget,\n        requestMeta?.origin,\n      );\n      if (!targetPath) {\n        throw new Error(\n          \"create_embed_session can only embed same-origin app-relative URLs.\",\n        );\n      }\n\n      const ticket = await createEmbedSessionTicket({\n        ownerEmail,\n        orgId: ctx?.orgId,\n        targetPath,\n        scope: typeof args.chrome === \"string\" ? args.chrome : null,\n      });\n      const startPath = buildEmbedStartPath(ticket.ticket);\n      const startUrl = requestMeta?.origin\n        ? new URL(startPath, requestMeta.origin).toString()\n        : startPath;\n      return {\n        startUrl,\n        targetPath,\n        expiresAt: ticket.expiresAt,\n      };\n    },\n  };\n}\n\n/**\n * Route an `ask_app` message to a *different* app's agent over A2A. Shared by\n * the workspace-resolved path and the org-directory-resolved path so the A2A\n * call logic is not duplicated. `origin` is the target app's A2A base\n * (workspace dev origin or the directory's `a2aUrl`); `id` is reported back.\n *\n * Throws on failure so the caller can be honest — it never falls back to this\n * app's agent and pretends it was the target.\n */\nasync function routeAskOverA2A(\n  origin: string,\n  id: string,\n  message: string,\n  options?: { durable?: boolean; maxWaitMs?: number },\n): Promise<\n  { app: string; routedVia: \"a2a\"; response: string } | AskAppTaskResult\n> {\n  if (options?.durable) {\n    return submitAskAppA2ATask(\n      { app: id, origin: agentNativeA2AEndpoint(origin), routedVia: \"a2a\" },\n      message,\n      options.maxWaitMs ?? ASK_APP_DEFAULT_INLINE_WAIT_MS,\n    );\n  }\n  const { callAgent } = await import(\"../a2a/client.js\");\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  // The MCP handler runs inside `runWithRequestContext`, so this is the\n  // verified caller identity and org scope. Reuse the same auth resolver as\n  // org-directory discovery so the directory lookup and actual A2A call are\n  // scoped the same way.\n  const auth = await resolveA2ACallerAuth();\n  const response = await callAgent(origin, message, {\n    apiKey: auth.apiKey,\n    userEmail: auth.userEmail,\n    orgDomain: auth.orgDomain,\n    orgSecret: auth.orgSecret,\n    // Bound the wait — cross-app A2A polls async by default.\n    timeoutMs: 5 * 60_000,\n  });\n  return { app: id, routedVia: \"a2a\", response };\n}\n\nasync function resolveAskAppStatusRoute(\n  config: MCPConfig,\n  requestedApp: string,\n  requestMeta?: AskAppRequestMeta,\n): Promise<AskAppRoute> {\n  const selfId = currentAppId(config);\n  const normalized = requestedApp.trim().toLowerCase();\n  const selfEndpointUrl = selfA2AEndpointUrl(requestMeta);\n\n  if (!normalized || normalized === selfId) {\n    if (!selfEndpointUrl) {\n      throw new Error(\n        \"ask_app_status requires a running app origin for local tasks.\",\n      );\n    }\n    return { app: selfId, origin: selfEndpointUrl, routedVia: \"local\" };\n  }\n\n  const targetApp = await resolveTargetAppOrigin(config, requestedApp);\n  if (targetApp) {\n    return {\n      app: targetApp.id,\n      origin: agentNativeA2AEndpoint(targetApp.origin),\n      routedVia: \"a2a\",\n    };\n  }\n\n  const orgApps = await fetchOrgApps({ selfId }).catch(() => [] as OrgApp[]);\n  const dirMatch = orgApps.find((a) => a.id === normalized);\n  if (dirMatch) {\n    return {\n      app: dirMatch.id,\n      origin: agentNativeA2AEndpoint(dirMatch.a2aUrl),\n      routedVia: \"a2a\",\n    };\n  }\n\n  throw new Error(`No reachable ask_app task route for app \"${requestedApp}\".`);\n}\n\n// ---------------------------------------------------------------------------\n// ask_app\n// ---------------------------------------------------------------------------\n\nfunction askAppTool(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Send a natural-language message to an app's AI agent and get its \" +\n        \"response. Use for complex, multi-step tasks needing the agent's \" +\n        \"reasoning and full app context. In a single-app project the 'app' \" +\n        \"param is optional (defaults to this app). When 'app' names a \" +\n        \"different workspace app it is routed there over A2A; the result's \" +\n        \"'routedVia' field reports whether it ran cross-app or locally. \" +\n        \"On hosted MCP, long tasks may return a durable taskId instead of a \" +\n        \"final response; call ask_app_status with that taskId until completed.\",\n      {\n        app: {\n          type: \"string\",\n          description: \"App id to route to (optional in a single-app project)\",\n        },\n        message: {\n          type: \"string\",\n          description: \"The message to send to the app's agent\",\n        },\n        async: {\n          type: \"boolean\",\n          description:\n            \"When true, start a durable task and return immediately with a taskId.\",\n        },\n        maxWaitMs: {\n          type: \"number\",\n          description:\n            \"Maximum time to wait inline before returning a taskId. Hosted MCP clamps this to 25000ms.\",\n        },\n      },\n      [\"message\"],\n    ),\n    run: async (args: Record<string, any>) => {\n      const message = String(args.message ?? \"\").trim();\n      if (!message) throw new Error(\"ask_app requires a 'message'.\");\n      const requestedApp = String(args.app ?? \"\").trim();\n      const selfId = currentAppId(config);\n      const useDurableA2A = Boolean(requestMeta?.origin);\n      const maxWaitMs = isExplicitAsyncAsk(args.async)\n        ? 0\n        : boundedAskAppWaitMs(args.maxWaitMs);\n\n      // Cross-app: the caller named a *different* workspace app. Route the\n      // message to THAT app's agent over A2A (its `/_agent-native/a2a`\n      // endpoint runs the real agent loop with JWT identity) rather than\n      // silently answering from this app's agent and claiming delegation.\n      const targetApp = await resolveTargetAppOrigin(config, requestedApp);\n      if (targetApp) {\n        try {\n          return await routeAskOverA2A(\n            targetApp.origin,\n            targetApp.id,\n            message,\n            {\n              durable: useDurableA2A,\n              maxWaitMs,\n            },\n          );\n        } catch (err: any) {\n          // Be honest: routing was attempted and failed — do NOT fall back to\n          // this app's agent and pretend it was the target.\n          throw new Error(\n            `Failed to route ask_app to \"${targetApp.id}\" via A2A: ` +\n              `${err?.message ?? err}`,\n          );\n        }\n      }\n\n      // Not a known local/workspace app — try the org directory. When a\n      // directory is configured and the requested app is one of the org's\n      // deployed sibling apps, route to it over A2A (same path as above,\n      // against its `a2aUrl`). Inactive directory / any failure ⇒ orgApps is\n      // [] and this is skipped, preserving the exact local-only behavior.\n      if (requestedApp && requestedApp.toLowerCase() !== selfId) {\n        const orgApps = await fetchOrgApps({ selfId }).catch(\n          () => [] as OrgApp[],\n        );\n        const dirMatch = orgApps.find(\n          (a) => a.id === requestedApp.toLowerCase(),\n        );\n        if (dirMatch) {\n          try {\n            return await routeAskOverA2A(\n              dirMatch.a2aUrl,\n              dirMatch.id,\n              message,\n              {\n                durable: useDurableA2A,\n                maxWaitMs,\n              },\n            );\n          } catch (err: any) {\n            throw new Error(\n              `Failed to route ask_app to \"${dirMatch.id}\" via A2A ` +\n                `(org directory): ${err?.message ?? err}`,\n            );\n          }\n        }\n      }\n\n      // Same app (or no workspace / unknown target): answer locally with this\n      // app's own ask-agent handler — the same entry point the HTTP MCP mount\n      // + A2A use, so there is no second agent runner.\n      if (!config.askAgent) {\n        throw new Error(\n          \"This app does not expose an agent (no ask-agent handler).\",\n        );\n      }\n\n      // If the caller named an app we couldn't route to (unknown id, or no\n      // workspace), say so honestly instead of claiming we reached it.\n      const unresolved =\n        !!requestedApp && requestedApp.toLowerCase() !== selfId;\n      const note = unresolved\n        ? `Requested app \"${requestedApp}\" is not a reachable workspace ` +\n          `app; answered with this app (\"${selfId}\") instead.`\n        : undefined;\n\n      // Hosted MCP cannot safely keep a JSON request/response open for a full\n      // agent loop: serverless gateways can return an inactivity 504 before\n      // the result body exists. When we know the running app origin, submit the\n      // local ask through the app's durable A2A task path and only wait a\n      // short bounded window for fast completions.\n      const localA2AEndpointUrl = selfA2AEndpointUrl(requestMeta);\n      if (localA2AEndpointUrl) {\n        return submitAskAppA2ATask(\n          {\n            app: selfId,\n            origin: localA2AEndpointUrl,\n            routedVia: \"local\",\n            ...(note ? { note } : {}),\n          },\n          message,\n          maxWaitMs,\n        );\n      }\n\n      const response = await config.askAgent(message);\n      return {\n        app: selfId,\n        routedVia: \"local\",\n        ...(note ? { note } : {}),\n        response,\n      };\n    },\n  };\n}\n\nfunction askAppStatusTool(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Poll a durable ask_app task and return its current status or final response.\",\n      {\n        app: {\n          type: \"string\",\n          description:\n            \"App id returned by ask_app. Optional for same-app local tasks.\",\n        },\n        taskId: {\n          type: \"string\",\n          description: \"The durable task id returned by ask_app.\",\n        },\n      },\n      [\"taskId\"],\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const taskId = String(args.taskId ?? \"\").trim();\n      if (!taskId) throw new Error(\"ask_app_status requires 'taskId'.\");\n      const requestedApp = String(args.app ?? \"\").trim();\n      const route = await resolveAskAppStatusRoute(\n        config,\n        requestedApp,\n        requestMeta,\n      );\n      return fetchAskAppA2ATask(route, taskId);\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// list_templates\n// ---------------------------------------------------------------------------\n\nfunction listTemplatesTool(): ActionEntry {\n  return {\n    tool: tool(\n      \"List the first-party templates that can be scaffolded into a workspace \" +\n        \"(allow-listed templates only).\",\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async () => {\n      const { visibleTemplates } = await import(\"../cli/templates-meta.js\");\n      return {\n        templates: visibleTemplates().map((t) => ({\n          name: t.name,\n          label: t.label,\n          hint: t.hint,\n        })),\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// create_workspace_app\n// ---------------------------------------------------------------------------\n\nfunction createWorkspaceAppTool(): ActionEntry {\n  return {\n    tool: tool(\n      \"Scaffold a new app into the current workspace from an allow-listed \" +\n        \"template, then return a deep link to open it. Idempotent: if an app \" +\n        \"with that name already exists it is reused.\",\n      {\n        name: {\n          type: \"string\",\n          description: \"New app id (directory under apps/), e.g. 'mymail'\",\n        },\n        template: {\n          type: \"string\",\n          description:\n            \"Template to scaffold from — must be allow-listed (see list_templates)\",\n        },\n      },\n      [\"name\", \"template\"],\n    ),\n    run: async (args: Record<string, any>) => {\n      const name = String(args.name ?? \"\").trim();\n      const template = String(args.template ?? \"\").trim();\n      if (!name || !template) {\n        throw new Error(\n          \"create_workspace_app requires both 'name' and 'template'.\",\n        );\n      }\n\n      // Enforce the strict public template allow-list. The authoritative,\n      // dependency-free source inside @agent-native/core is cli/templates-meta\n      // (kept in sync with packages/shared-app-config/templates.ts; CI guard).\n      const { visibleTemplates } = await import(\"../cli/templates-meta.js\");\n      const allowed = new Set(visibleTemplates().map((t) => t.name));\n      if (!allowed.has(template)) {\n        throw new Error(\n          `Template \"${template}\" is not allow-listed. Allowed: ${[...allowed]\n            .sort()\n            .join(\", \")}`,\n        );\n      }\n\n      const { findWorkspaceRoot, resolveWorkspace } =\n        await import(\"./workspace-resolve.js\");\n      const fs = await import(\"node:fs\");\n      const path = await import(\"node:path\");\n\n      const root = findWorkspaceRoot(process.cwd());\n      if (!root) {\n        throw new Error(\n          \"Not inside a workspace. create_workspace_app only works in a \" +\n            \"multi-app workspace (run from the workspace root).\",\n        );\n      }\n\n      const appDir = path.join(root, \"apps\", name);\n      const alreadyExisted = fs.existsSync(appDir);\n\n      if (!alreadyExisted) {\n        // Reuse the CLI scaffolder directly (no second `agent-native`\n        // subprocess). `addAppToWorkspace(name, { template })` takes the\n        // non-interactive single-template path when name + one template are\n        // given. Run it from the workspace root so detectWorkspace resolves.\n        const prevCwd = process.cwd();\n        try {\n          process.chdir(root);\n          const { addAppToWorkspace } = await import(\"../cli/create.js\");\n          await addAppToWorkspace(name, { template, noInstall: true });\n        } finally {\n          try {\n            process.chdir(prevCwd);\n          } catch {\n            // best-effort cwd restore\n          }\n        }\n      }\n\n      // The workspace gateway auto-detects new apps/* dirs (fs.watch +\n      // 2s sync) and lazily boots the dev server on first request, so we\n      // don't spawn vite ourselves — opening the deep link warms it. Resolve\n      // the port the gateway will use so we can report it.\n      const ws = await resolveWorkspace(root);\n      const appInfo = ws.apps.find((a) => a.id === name);\n      const port = appInfo?.port;\n      // The scaffolded app is always a *different* app from the host MCP\n      // server, so anchor the deep link to the new app's own origin. A\n      // relative path would otherwise be prefixed with the current request\n      // origin and land on the wrong app. Fall back to the relative path\n      // only if the gateway hasn't reported the new app's URL yet.\n      const relDeepLink = buildDeepLink({ app: name, view: \"home\" });\n      const deepLink = appInfo?.url\n        ? `${appInfo.url.replace(/\\/+$/, \"\")}${relDeepLink}`\n        : relDeepLink;\n\n      return {\n        name,\n        template,\n        created: !alreadyExisted,\n        reused: alreadyExisted,\n        port,\n        url: appInfo?.url,\n        gatewayUrl: ws.gatewayUrl,\n        deepLink,\n      };\n    },\n    link: ({ result }) => {\n      if (!result || typeof result !== \"object\") return null;\n      const r = result as { deepLink?: string; name?: string };\n      if (!r.deepLink) return null;\n      return {\n        url: r.deepLink,\n        label: `Open ${r.name ?? \"app\"}`,\n        view: \"home\",\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Registry\n// ---------------------------------------------------------------------------\n\n/**\n * Build the generic cross-app builtin tool registry. Called by\n * `createMCPServerForRequest`; the result is merged UNDER the config's\n * actions so template actions of the same name win.\n */\nexport function getBuiltinCrossAppTools(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): Record<string, ActionEntry> {\n  return {\n    list_apps: listAppsTool(config, requestMeta),\n    open_app: openAppTool(config, requestMeta),\n    create_embed_session: createEmbedSessionTool(requestMeta),\n    ask_app: askAppTool(config, requestMeta),\n    ask_app_status: askAppStatusTool(config, requestMeta),\n    create_workspace_app: createWorkspaceAppTool(),\n    list_templates: listTemplatesTool(),\n  };\n}\n"]}
+{"version":3,"file":"builtin-tools.js","sourceRoot":"","sources":["../../src/mcp/builtin-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAe,MAAM,oBAAoB,CAAC;AAQ/D;;;;GAIG;AACH,SAAS,IAAI,CACX,WAAmB,EACnB,UAAmB,EACnB,QAAmB;IAEnB,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IACxC,OAAO;QACL,WAAW;QACX,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,UAAU;YACtB,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAAiB;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAC7D,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAC9C,MAAM,8BAA8B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAU,CAAC;AAClE,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,WAAW;IACX,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AA0BH,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,MAA6D;IAE7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;IACpE,CAAC;IACD,OAAO,GAAG,KAAK,oBAAoB,CAAC;AACtC,CAAC;AAED,SAAS,kBAAkB,CAAC,WAA+B;IACzD,MAAM,MAAM,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,IAAI,wBAAwB,EAAE,CAAC;IACrE,OAAO,sBAAsB,CAAC,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,8BAA8B,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,8BAA8B,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY;IACtC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,IAAU;IAChC,OAAO,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAU;IAC1B,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;QACxB,EAAE,MAAM,CACN,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CACvE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,IAAI,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkB,EAAE,IAAU;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG;QACX,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ,IAAI,eAAe;SACtC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACjD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,KAAK,EAAE,QAAQ,IAAI,gBAAgB,MAAM,GAAG;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SAC/C;QACD,OAAO,EACL,oBAAoB,MAAM,6BAA6B;YACvD,WAAW,IAAI,CAAC,EAAE,mCAAmC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAAc;IAIpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,IAAI,IAAI,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,OAAO;QACL,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YACzC,gBAAgB,EAAE,8BAA8B;YAChD,GAAG,CAAC,IAAI,CAAC,eAAe;gBACtB,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAA4C,EAC5C,WAAiB,EACjB,SAAiB;IAEjB,IAAI,SAAS,IAAI,CAAC,IAAI,cAAc,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,WAAW,CAAC;IAE1B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC,CACnE,CAAC;QACF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,iDAAiD;YACjD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC3C,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAAkB,EAClB,OAAe,EACf,SAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACzC,EACD;QACE,KAAK,EAAE,IAAI;QACX,QAAQ;KACT,CACF,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACrE,OAAO,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAkB,EAClB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,SAAkB,CAAC;IACvB,KACE,IAAI,OAAO,GAAG,CAAC,EACf,OAAO,IAAI,8BAA8B,CAAC,MAAM,EAChD,OAAO,EAAE,EACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,MAAM,OAAO,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAY;IAChD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,CACL,oGAAoG,CAAC,IAAI,CACvG,OAAO,CACR,IAAI,iDAAiD,CAAC,IAAI,CAAC,OAAO,CAAC,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,sBAAsB,CACnC,MAAiB,EACjB,WAAmB;IAEnB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACpE,MAAM,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,SAAS,YAAY,CACnB,MAAiB,EACjB,WAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,IAAI,CACR,qEAAqE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,qDAAqD,CACxD;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACpE,MAAM,EAAE,GAAG,MAAM,gBAAgB,EAAE,CAAC;YAEpC,kEAAkE;YAClE,iEAAiE;YACjE,sEAAsE;YACtE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,qEAAqE;YACrE,iBAAiB;YACjB,MAAM,UAAU,GAAG,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC9B,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,CAAC,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC;YAUjE,MAAM,IAAI,GAAe,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACV,CAAC,CAAC;oBACE,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,GAAG,EAAE,UAAU;oBACf,IAAI,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAuB;oBAChD,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,WAAoB;iBAC7B;gBACH,CAAC,CAAC;oBACE,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,IAAI,EAAE,CAAC,CAAC,IAA0B;oBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,MAAM,EAAE,WAAoB;iBAC7B,CACN,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAExE,qEAAqE;YACrE,qEAAqE;YACrE,8DAA8D;YAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;gBACjC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;aAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;YAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBAClC,MAAM,SAAS,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7C,gEAAgE;gBAChE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,SAAS;gBAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnB,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC;oBACR,EAAE,EAAE,EAAE,CAAC,EAAE;oBACT,GAAG,EAAE,EAAE,CAAC,GAAG;oBACX,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,EAAE,CAAC,WAAW;gBACzB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,IAAI;aACL,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAS,WAAW,CAClB,MAAiB,EACjB,WAAiC;IAEjC,OAAO;QACL,IAAI,EAAE,IAAI,CACR,mEAAmE;YACjE,mCAAmC;YACnC,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,kBAAkB,EACpB;YACE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;YAC3D,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,sHAAsH;aACzH;YACD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,oLAAoL;aACvL;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,iEAAiE;aACpE;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,8FAA8F;aACjG;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;gBACzB,WAAW,EACT,sEAAsE;aACzE;SACF,EACD,CAAC,KAAK,CAAC,CACR;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,yDAAyD;YACzD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAA6D,CAAC;YAClE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACxB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAgD,CAAC;YAC5D,CAAC;iBAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,SAAS,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,EAAE,KAAK,CAAC;YACpC,MAAM,WAAW,GAAG,MAAM,EAAE,MAAM,CAAC;YACnC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;YACzD,IACE,IAAI,CAAC,KAAK,IAAI,IAAI;gBAClB,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,MAAM,CAAC,EACpD,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;iBAAM,IACL,IAAI,CAAC,KAAK,IAAI,IAAI;gBAClB,CAAC,aAAa,KAAK,KAAK,IAAI,aAAa,KAAK,OAAO,CAAC,EACtD,CAAC;gBACD,KAAK,GAAG,KAAK,CAAC;YAChB,CAAC;YACD,IACE,aAAa,KAAK,IAAI;gBACtB,aAAa,KAAK,KAAK;gBACvB,aAAa,KAAK,MAAM;gBACxB,aAAa,KAAK,OAAO,EACzB,CAAC;gBACD,OAAO,MAAM,EAAE,KAAK,CAAC;YACvB,CAAC;YAED,MAAM,MAAM,GACV,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAC7B,CAAC,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS;oBACnD,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,SAAS,CAAC;YAClB,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBACxD,OAAO,MAAM,EAAE,MAAM,CAAC;YACxB,CAAC;YACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,GAAG,SAAS,CAAC;YAEnE,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI;gBACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC;gBAClC,CAAC,CAAC,cAAc;oBACd,CAAC,CAAC,kBAAkB,CAAC,cAAc,EAAE,MAAM,CAAC;oBAC5C,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,MAAM,UAAU,GACd,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAEnE,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,SAAS;gBACtB,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,EAAE;gBACpD,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,CAAC;YACnB,IAAI,aAAiC,CAAC;YACtC,IAAI,eAAmC,CAAC;YACxC,IAAI,cAAkC,CAAC;YAEvC,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxB,MAAM,EAAE,iBAAiB,EAAE,GACzB,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;gBAC/C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;gBAChC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC1C,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,GAC1D,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;oBAC7C,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBAC3C,MAAM,UAAU,GAAG,wBAAwB,CACzC,sBAAsB,CAAC,GAAG,CAAC,EAC3B,WAAW,EAAE,MAAM,CACpB,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBACf,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;4BAC5C,UAAU;4BACV,KAAK,EAAE,GAAG,EAAE,KAAK;4BACjB,UAAU;4BACV,KAAK,EAAE,MAAM,IAAI,IAAI;yBACtB,CAAC,CAAC;wBACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;wBACrD,aAAa,GAAG,WAAW,EAAE,MAAM;4BACjC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;4BACnD,CAAC,CAAC,SAAS,CAAC;wBACd,eAAe,GAAG,UAAU,CAAC;wBAC7B,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO;gBACL,GAAG;gBACH,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,GAAG;gBACH,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,KAAK;aACN,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,CAAC,GAAG,MAKT,CAAC;YACF,IAAI,CAAC,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,CAAC,CAAC,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK,EAAE,QAAQ,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE;gBAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC;QACJ,CAAC;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,QAAQ,CAAC;gBACjB,KAAK,EAAE,UAAU;gBACjB,WAAW,EAAE,wCAAwC;gBACrD,WAAW,EAAE,kBAAkB;gBAC/B,SAAS,EAAE,UAAU;aACtB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,sBAAsB,CAAC,WAE/B;IACC,OAAO;QACL,IAAI,EAAE;YACJ,GAAG,IAAI,CACL,qJAAqJ,EACrJ;gBACE,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,yDAAyD;iBAC5D;gBACD,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yCAAyC;iBACvD;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;oBACzB,WAAW,EAAE,4CAA4C;iBAC1D;aACF,CACF;YACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;SACzB;QACf,0EAA0E;QAC1E,uEAAuE;QACvE,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,EAAE,iBAAiB,EAAE,GACzB,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,GAC1D,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;YAC7C,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC7C,CAAC,CAAC,IAAI,CAAC,GAAG;gBACV,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,wBAAwB,CACzC,SAAS,EACT,WAAW,EAAE,MAAM,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;gBAC5C,UAAU;gBACV,KAAK,EAAE,GAAG,EAAE,KAAK;gBACjB,UAAU;gBACV,KAAK,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aAC5D,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,WAAW,EAAE,MAAM;gBAClC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;gBACnD,CAAC,CAAC,SAAS,CAAC;YACd,OAAO;gBACL,QAAQ;gBACR,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,EAAU,EACV,OAAe,EACf,OAAmD;IAInD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,OAAO,mBAAmB,CACxB,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EACrE,OAAO,EACP,OAAO,CAAC,SAAS,IAAI,8BAA8B,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACvE,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,uBAAuB;IACvB,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,yDAAyD;QACzD,SAAS,EAAE,CAAC,GAAG,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAiB,EACjB,YAAoB,EACpB,WAA+B;IAE/B,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,MAAM,EAAE,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC;YAChD,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,EAAE;YAChB,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC/C,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,UAAU,CACjB,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,mEAAmE;YACjE,+DAA+D;YAC/D,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,+BAA+B;YAC/B,+DAA+D;YAC/D,oEAAoE;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,uEAAuE,EACzE;YACE,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,uDAAuD;aACrE;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,wCAAwC;aACtD;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,WAAW,EACT,uEAAuE;aAC1E;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,2FAA2F;aAC9F;SACF,EACD,CAAC,SAAS,CAAC,CACZ;QACD,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC9C,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAExC,qEAAqE;YACrE,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACrE,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,OAAO,MAAM,eAAe,CAC1B,SAAS,CAAC,MAAM,EAChB,SAAS,CAAC,EAAE,EACZ,OAAO,EACP;wBACE,OAAO,EAAE,aAAa;wBACtB,SAAS;qBACV,CACF,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,oEAAoE;oBACpE,kDAAkD;oBAClD,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,CAAC,EAAE,aAAa;wBACtD,GAAG,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC3B,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAClD,GAAG,EAAE,CAAC,EAAc,CACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAC3C,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,OAAO,MAAM,eAAe,CAC1B,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,EAAE,EACX,OAAO,EACP;4BACE,OAAO,EAAE,aAAa;4BACtB,SAAS;yBACV,CACF,CAAC;oBACJ,CAAC;oBAAC,OAAO,GAAQ,EAAE,CAAC;wBAClB,MAAM,IAAI,KAAK,CACb,+BAA+B,QAAQ,CAAC,EAAE,YAAY;4BACpD,oBAAoB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAC5C,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,wEAAwE;YACxE,iDAAiD;YACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,UAAU,GACd,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;YAC1D,MAAM,IAAI,GAAG,UAAU;gBACrB,CAAC,CAAC,kBAAkB,YAAY,iCAAiC;oBAC/D,iCAAiC,MAAM,aAAa;gBACtD,CAAC,CAAC,SAAS,CAAC;YAEd,wEAAwE;YACxE,sEAAsE;YACtE,0EAA0E;YAC1E,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC5D,IAAI,mBAAmB,EAAE,CAAC;gBACxB,OAAO,mBAAmB,CACxB;oBACE,GAAG,EAAE,MAAM;oBACX,MAAM,EAAE,mBAAmB;oBAC3B,SAAS,EAAE,OAAO;oBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1B,EACD,OAAO,EACP,SAAS,CACV,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO;gBACL,GAAG,EAAE,MAAM;gBACX,SAAS,EAAE,OAAO;gBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,QAAQ;aACT,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,8EAA8E,EAC9E;YACE,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,gEAAgE;aACnE;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,0CAA0C;aACxD;SACF,EACD,CAAC,QAAQ,CAAC,CACX;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAClE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAC1C,MAAM,EACN,YAAY,EACZ,WAAW,CACZ,CAAC;YACF,OAAO,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,OAAO;QACL,IAAI,EAAE,IAAI,CACR,yEAAyE;YACvE,gCAAgC,CACnC;QACD,QAAQ,EAAE,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK,IAAI,EAAE;YACd,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACtE,OAAO;gBACL,SAAS,EAAE,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxC,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,sBAAsB;IAC7B,OAAO;QACL,IAAI,EAAE,IAAI,CACR,qEAAqE;YACnE,sEAAsE;YACtE,6CAA6C,EAC/C;YACE,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,mDAAmD;aACjE;YACD,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,uEAAuE;aAC1E;SACF,EACD,CAAC,MAAM,EAAE,UAAU,CAAC,CACrB;QACD,GAAG,EAAE,KAAK,EAAE,IAAyB,EAAE,EAAE;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,mCAAmC,CAAC,GAAG,OAAO,CAAC;qBACjE,IAAI,EAAE;qBACN,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAC3C,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CACb,+DAA+D;oBAC7D,oDAAoD,CACvD,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAE7C,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,8DAA8D;gBAC9D,iEAAiE;gBACjE,oEAAoE;gBACpE,qEAAqE;gBACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACpB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;oBAC/D,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/D,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC;wBACH,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzB,CAAC;oBAAC,MAAM,CAAC;wBACP,0BAA0B;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iEAAiE;YACjE,mEAAmE;YACnE,uEAAuE;YACvE,qDAAqD;YACrD,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;YAC3B,mEAAmE;YACnE,iEAAiE;YACjE,qEAAqE;YACrE,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,WAAW,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,OAAO,EAAE,GAAG;gBAC3B,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE;gBACpD,CAAC,CAAC,WAAW,CAAC;YAEhB,OAAO;gBACL,IAAI;gBACJ,QAAQ;gBACR,OAAO,EAAE,CAAC,cAAc;gBACxB,MAAM,EAAE,cAAc;gBACtB,IAAI;gBACJ,GAAG,EAAE,OAAO,EAAE,GAAG;gBACjB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACvD,MAAM,CAAC,GAAG,MAA8C,CAAC;YACzD,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC7B,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,QAAQ;gBACf,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,KAAK,EAAE;gBAChC,IAAI,EAAE,MAAM;aACb,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiB,EACjB,WAA+B;IAE/B,OAAO;QACL,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC;QAC5C,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC;QAC1C,oBAAoB,EAAE,sBAAsB,CAAC,WAAW,CAAC;QACzD,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC;QACxC,cAAc,EAAE,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;QACrD,oBAAoB,EAAE,sBAAsB,EAAE;QAC9C,cAAc,EAAE,iBAAiB,EAAE;KACpC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Generic cross-app MCP tools — a stable verb set every external agent gets\n * regardless of which template it is talking to.\n *\n * These are merged into the MCP action registry by\n * `createMCPServerForRequest` (see `build-server.ts`). **Precedence: template\n * actions win.** If a template defines an action named `list_apps` /\n * `open_app` / `ask_app` / `create_workspace_app` / `list_templates`, the\n * template's `ActionEntry` overwrites the builtin of the same name. This is\n * the same template-over-framework precedence `autoDiscoverActions` uses.\n *\n * | Tool                  | Side effects | Returns                                  |\n * | --------------------- | ------------ | ---------------------------------------- |\n * | `list_apps`           | none         | `{ apps: [{ id, url, running }] }`       |\n * | `open_app`            | none         | `{ url }` (+ deep-link `link`)           |\n * | `create_embed_session`| ticket mint  | `{ startUrl }` for MCP App iframes       |\n * | `ask_app`             | agent loop   | `{ app, routedVia, response }` or task   |\n * | `ask_app_status`      | none         | poll a durable `ask_app` task            |\n * | `create_workspace_app`| scaffolds    | `{ name, url, port, deepLink }` (+ link) |\n *\n * `open_app` / `create_workspace_app` return an **absolute** URL on the\n * *target* app's origin when it differs from this app (so a workspace link\n * lands in the right app), and a relative path for the same app / standalone.\n * `ask_app` routes to a *different* workspace app over A2A when possible and\n * reports `routedVia: \"a2a\"`; otherwise it answers locally\n * (`routedVia: \"local\"`) and never falsely claims cross-app delegation.\n * | `list_templates`      | none         | `{ templates: [...] }` (allow-list only) |\n *\n * Node-only at call time (workspace resolution + scaffolding use `fs`), but\n * the module has no top-level Node imports so it bundles fine alongside\n * `mountMCP` — the Node bits are dynamically imported inside `run()`.\n */\n\nimport type { Task } from \"../a2a/types.js\";\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport { getConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { buildDeepLink } from \"../server/deep-link.js\";\nimport { MCP_APP_CHAT_BRIDGE_QUERY_PARAM } from \"../shared/embed-auth.js\";\nimport type { MCPConfig } from \"./build-server.js\";\nimport { embedApp } from \"./embed-app.js\";\nimport { fetchOrgApps, type OrgApp } from \"./org-directory.js\";\n\n/** Flat map of param name → JSON-schema property. */\ntype Params = Record<\n  string,\n  { type: string; description?: string; enum?: string[] }\n>;\n\n/**\n * Build an `ActionTool`. `parameters` is wrapped in the\n * `{ type:\"object\", properties, required }` shape `createMCPServerForRequest`\n * forwards verbatim as the MCP tool `inputSchema`.\n */\nfunction tool(\n  description: string,\n  parameters?: Params,\n  required?: string[],\n): ActionTool {\n  if (!parameters) return { description };\n  return {\n    description,\n    parameters: {\n      type: \"object\",\n      properties: parameters,\n      ...(required && required.length ? { required } : {}),\n    },\n  };\n}\n\n/**\n * The canonical app id this MCP server is mounted for. `MCPConfig.appId` is\n * authoritative; fall back to lowercasing `name` (which is the capitalized\n * app id at every call site) for back-compat with configs that predate the\n * `appId` field.\n */\nfunction currentAppId(config: MCPConfig): string {\n  return (config.appId || config.name || \"app\").toLowerCase();\n}\n\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\nconst ASK_APP_DEFAULT_INLINE_WAIT_MS = 20_000;\nconst ASK_APP_MAX_INLINE_WAIT_MS = 25_000;\nconst ASK_APP_POLL_INTERVAL_MS = 1_500;\nconst ASK_APP_A2A_REQUEST_TIMEOUT_MS = 10_000;\nconst ASK_APP_STATUS_RETRY_DELAYS_MS = [250, 750, 1_500] as const;\nconst ASK_APP_TERMINAL_STATES = new Set<string>([\n  \"completed\",\n  \"failed\",\n  \"canceled\",\n]);\n\ntype AskAppRequestMeta = { origin?: string; basePath?: string };\n\ninterface AskAppRoute {\n  app: string;\n  origin: string;\n  routedVia: \"local\" | \"a2a\";\n  note?: string;\n}\n\ninterface AskAppTaskResult {\n  app: string;\n  routedVia: \"local\" | \"a2a\";\n  taskId: string;\n  status: string;\n  response?: string;\n  error?: string;\n  note?: string;\n  poll?: {\n    tool: \"ask_app_status\";\n    arguments: { app: string; taskId: string };\n  };\n  message?: string;\n}\n\nfunction safeAppPath(raw: unknown): string | null {\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\n  const value = raw.trim();\n  if (CONTROL_CHARS.test(value)) return null;\n  if (!value.startsWith(\"/\")) return null;\n  if (value.startsWith(\"//\") || value.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(value)) return null;\n  return value;\n}\n\nfunction appendParamsToPath(\n  path: string,\n  params: Record<string, string | number | boolean> | undefined,\n): string {\n  if (!params || Object.keys(params).length === 0) return path;\n  const url = new URL(path, \"http://agent-native.invalid\");\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, String(value));\n  }\n  return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction viewToAppPath(view: string): string | null {\n  const value = view.trim();\n  if (!value) return null;\n  return safeAppPath(value.startsWith(\"/\") ? value : `/${value}`);\n}\n\nfunction withConfiguredBasePath(path: string): string {\n  const base = getConfiguredAppBasePath();\n  if (!base || path === base || path.startsWith(`${base}/`)) return path;\n  return `${base}${path}`;\n}\n\nfunction withMcpChatBridgeParam(path: string): string {\n  try {\n    const url = new URL(path, \"http://agent-native.invalid\");\n    url.searchParams.set(MCP_APP_CHAT_BRIDGE_QUERY_PARAM, \"1\");\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return path;\n  }\n}\n\nfunction agentNativeA2AEndpoint(urlOrOrigin: string): string {\n  const value = urlOrOrigin.replace(/\\/+$/, \"\");\n  try {\n    const parsed = new URL(value);\n    const pathname = parsed.pathname.replace(/\\/+$/, \"\");\n    if (pathname.endsWith(\"/_agent-native/a2a\") || pathname.endsWith(\"/a2a\")) {\n      return value;\n    }\n  } catch {\n    // Fall through and append the conventional Agent Native endpoint.\n  }\n  return `${value}/_agent-native/a2a`;\n}\n\nfunction selfA2AEndpointUrl(requestMeta?: AskAppRequestMeta): string | null {\n  const origin = requestMeta?.origin?.replace(/\\/+$/, \"\");\n  if (!origin) return null;\n  const basePath = requestMeta?.basePath || getConfiguredAppBasePath();\n  return agentNativeA2AEndpoint(`${origin}${basePath}`);\n}\n\nfunction boundedAskAppWaitMs(raw: unknown): number {\n  if (raw == null || raw === \"\") return ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed)) return ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  return Math.max(0, Math.min(ASK_APP_MAX_INLINE_WAIT_MS, Math.trunc(parsed)));\n}\n\nfunction isExplicitAsyncAsk(raw: unknown): boolean {\n  return raw === true || raw === \"true\" || raw === 1 || raw === \"1\";\n}\n\nfunction taskState(task: Task): string {\n  return String(task.status?.state ?? \"unknown\");\n}\n\nfunction isTerminalTask(task: Task): boolean {\n  return ASK_APP_TERMINAL_STATES.has(taskState(task));\n}\n\nfunction taskText(task: Task): string {\n  return (\n    task.status.message?.parts\n      ?.filter(\n        (part): part is { type: \"text\"; text: string } => part.type === \"text\",\n      )\n      .map((part) => part.text)\n      .join(\"\\n\")\n      .trim() ?? \"\"\n  );\n}\n\nfunction askAppTaskResult(route: AskAppRoute, task: Task): AskAppTaskResult {\n  const status = taskState(task);\n  const response = taskText(task);\n  const base = {\n    app: route.app,\n    routedVia: route.routedVia,\n    taskId: task.id,\n    status,\n    ...(route.note ? { note: route.note } : {}),\n  };\n\n  if (status === \"completed\") {\n    return {\n      ...base,\n      response: response || \"(no response)\",\n    };\n  }\n\n  if (status === \"failed\" || status === \"canceled\") {\n    return {\n      ...base,\n      ...(response ? { response } : {}),\n      error: response || `ask_app task ${status}.`,\n    };\n  }\n\n  return {\n    ...base,\n    poll: {\n      tool: \"ask_app_status\",\n      arguments: { app: route.app, taskId: task.id },\n    },\n    message:\n      `ask_app is still ${status}. Call ask_app_status with ` +\n      `taskId \"${task.id}\" to retrieve the final response.`,\n  };\n}\n\nasync function createA2AClientForAskApp(origin: string): Promise<{\n  client: import(\"../a2a/client.js\").A2AClient;\n  metadata: Record<string, unknown>;\n}> {\n  const { A2AClient } = await import(\"../a2a/client.js\");\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  const auth = await resolveA2ACallerAuth();\n  const metadata: Record<string, unknown> = {};\n  if (auth.userEmail) metadata.userEmail = auth.userEmail;\n  if (auth.orgDomain) metadata.orgDomain = auth.orgDomain;\n  return {\n    client: new A2AClient(origin, auth.apiKey, {\n      requestTimeoutMs: ASK_APP_A2A_REQUEST_TIMEOUT_MS,\n      ...(auth.apiKeyFallbacks\n        ? { fallbackApiKeys: auth.apiKeyFallbacks }\n        : {}),\n    }),\n    metadata,\n  };\n}\n\nasync function waitForA2ATask(\n  client: import(\"../a2a/client.js\").A2AClient,\n  initialTask: Task,\n  maxWaitMs: number,\n): Promise<Task> {\n  if (maxWaitMs <= 0 || isTerminalTask(initialTask)) return initialTask;\n  const deadline = Date.now() + maxWaitMs;\n  let current = initialTask;\n\n  while (!isTerminalTask(current)) {\n    const remaining = deadline - Date.now();\n    if (remaining <= 0) return current;\n    await new Promise((resolve) =>\n      setTimeout(resolve, Math.min(ASK_APP_POLL_INTERVAL_MS, remaining)),\n    );\n    try {\n      current = await client.getTask(initialTask.id);\n    } catch {\n      // Transient status fetch failures should not turn a successfully\n      // submitted durable task into a failed MCP call.\n      if (Date.now() >= deadline) return current;\n      continue;\n    }\n  }\n\n  return current;\n}\n\nasync function submitAskAppA2ATask(\n  route: AskAppRoute,\n  message: string,\n  maxWaitMs: number,\n): Promise<AskAppTaskResult> {\n  const { client, metadata } = await createA2AClientForAskApp(route.origin);\n  const task = await client.send(\n    {\n      role: \"user\",\n      parts: [{ type: \"text\", text: message }],\n    },\n    {\n      async: true,\n      metadata,\n    },\n  );\n  const finalOrRunning = await waitForA2ATask(client, task, maxWaitMs);\n  return askAppTaskResult(route, finalOrRunning);\n}\n\nasync function fetchAskAppA2ATask(\n  route: AskAppRoute,\n  taskId: string,\n): Promise<AskAppTaskResult> {\n  const { client } = await createA2AClientForAskApp(route.origin);\n  let lastError: unknown;\n  for (\n    let attempt = 0;\n    attempt <= ASK_APP_STATUS_RETRY_DELAYS_MS.length;\n    attempt++\n  ) {\n    try {\n      const task = await client.getTask(taskId);\n      return askAppTaskResult(route, task);\n    } catch (err) {\n      lastError = err;\n      const delayMs = ASK_APP_STATUS_RETRY_DELAYS_MS[attempt];\n      if (delayMs == null || !isTransientAskAppStatusError(err)) {\n        throw err;\n      }\n      await new Promise((resolve) => setTimeout(resolve, delayMs));\n    }\n  }\n  throw lastError;\n}\n\nfunction isTransientAskAppStatusError(err: unknown): boolean {\n  const message = err instanceof Error ? err.message : String(err ?? \"\");\n  return (\n    /\\bfetch failed\\b|failed to fetch|networkerror|socket hang up|econnreset|etimedout|timeout|aborted/i.test(\n      message,\n    ) || /A2A request failed \\((?:429|500|502|503|504)\\)/i.test(message)\n  );\n}\n\n/**\n * Resolve the absolute origin of a *target* workspace app (e.g.\n * `http://127.0.0.1:8101`) so cross-app deep links / A2A calls point at the\n * right app instead of the current request's origin. Reuses the same\n * workspace resolution `list_apps` / the stdio proxy use.\n *\n * Returns `null` when:\n *   - the target is the current app (caller should keep relative behavior),\n *   - there is no workspace info (standalone / single app), or\n *   - the target app is unknown.\n */\nasync function resolveTargetAppOrigin(\n  config: MCPConfig,\n  targetAppId: string,\n): Promise<{ origin: string; id: string } | null> {\n  const target = targetAppId.trim().toLowerCase();\n  if (!target || target === currentAppId(config)) return null;\n  try {\n    const { resolveWorkspace } = await import(\"./workspace-resolve.js\");\n    const ws = await resolveWorkspace();\n    if (!ws.isWorkspace) return null;\n    const match = ws.apps.find((a) => a.id.toLowerCase() === target);\n    if (!match) return null;\n    return { origin: match.url, id: match.id };\n  } catch {\n    return null;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// list_apps\n// ---------------------------------------------------------------------------\n\nfunction listAppsTool(\n  config: MCPConfig,\n  requestMeta?: { origin?: string },\n): ActionEntry {\n  return {\n    tool: tool(\n      \"List the workspace apps and their URLs. Use this to discover which \" +\n        \"apps exist before opening or asking one. In a single-app project \" +\n        \"this returns just that app. When an org directory is configured \" +\n        \"this also includes the org's deployed sibling apps.\",\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async () => {\n      const { resolveWorkspace } = await import(\"./workspace-resolve.js\");\n      const ws = await resolveWorkspace();\n\n      // The MCP request is served BY the current app, so it is provably\n      // reachable at the inbound request origin — that beats a guessed\n      // `PORT || 5173` probe (which reports the wrong URL + `running:false`\n      // whenever the dev server picked a non-default port, e.g. `agent-\n      // native dev` on :8080). For the entry that IS this app (the sole\n      // entry when single-app, or the id matching `config.appId` in a\n      // workspace) prefer the live origin; other workspace apps keep their\n      // probed values.\n      const liveOrigin = requestMeta?.origin?.replace(/\\/+$/, \"\") || \"\";\n      let livePort = 0;\n      if (liveOrigin) {\n        try {\n          const u = new URL(liveOrigin);\n          livePort = Number(u.port) || (u.protocol === \"https:\" ? 443 : 80);\n        } catch {\n          livePort = 0;\n        }\n      }\n      const selfId = (config.appId ?? \"\").toLowerCase();\n      const isSelf = (id: string) =>\n        !!liveOrigin &&\n        (!ws.isWorkspace || (!!selfId && id.toLowerCase() === selfId));\n\n      interface AppEntry {\n        id: string;\n        url: string;\n        port: number | undefined;\n        running: boolean;\n        source: \"workspace\" | \"org-directory\";\n      }\n\n      const apps: AppEntry[] = ws.apps.map((a) =>\n        isSelf(a.id)\n          ? {\n              id: a.id,\n              url: liveOrigin,\n              port: (livePort || a.port) as number | undefined,\n              running: true,\n              source: \"workspace\" as const,\n            }\n          : {\n              id: a.id,\n              url: a.url,\n              port: a.port as number | undefined,\n              running: a.running,\n              source: \"workspace\" as const,\n            },\n      );\n      const seenIds = new Set(apps.map((a) => a.id.toLowerCase()));\n      const seenOrigins = new Set(apps.map((a) => a.url.replace(/\\/+$/, \"\")));\n\n      // Merge the org directory's deployed sibling apps. Inactive (no env)\n      // or any failure ⇒ fetchOrgApps() returns [] and this is a no-op, so\n      // the existing local/workspace behavior is preserved exactly.\n      const orgApps = await fetchOrgApps({\n        selfId: currentAppId(config),\n      }).catch(() => [] as OrgApp[]);\n      for (const oa of orgApps) {\n        const idKey = oa.id.toLowerCase();\n        const originKey = oa.url.replace(/\\/+$/, \"\");\n        // Dedupe by id OR origin — a workspace app already listed wins.\n        if (seenIds.has(idKey) || seenOrigins.has(originKey)) continue;\n        seenIds.add(idKey);\n        seenOrigins.add(originKey);\n        apps.push({\n          id: oa.id,\n          url: oa.url,\n          port: undefined,\n          running: true,\n          source: \"org-directory\",\n        });\n      }\n\n      return {\n        workspace: ws.isWorkspace,\n        gatewayUrl: ws.gatewayUrl,\n        apps,\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// open_app\n// ---------------------------------------------------------------------------\n\nfunction openAppTool(\n  config: MCPConfig,\n  requestMeta?: { origin?: string },\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Build a deep link that opens an app at a specific view/record or \" +\n        \"focused route/component. No side \" +\n        \"effects — returns a URL the user can click to land in the running UI. \" +\n        \"Set embed:true when a UI-capable MCP host should render the live app \" +\n        \"or focused route/component inline. Omit view and path to land on the \" +\n        \"app's home page.\",\n      {\n        app: { type: \"string\", description: \"App id, e.g. 'mail'\" },\n        view: {\n          type: \"string\",\n          description:\n            \"Target view, e.g. 'inbox' (maps to navigate command). Optional — omit (along with path) to open the app's home page.\",\n        },\n        path: {\n          type: \"string\",\n          description:\n            \"Optional app route to open directly, e.g. '/extensions/abc', '/adhoc/q2', or '/chart?panel=...'. Must be same-origin relative. Omit (along with view) to open the app's home page.\",\n        },\n        params: {\n          type: \"object\",\n          description:\n            \"Optional record-focus / filter params, e.g. { threadId: 'abc' }\",\n        },\n        embed: {\n          type: \"boolean\",\n          description:\n            \"Render the full app or focused route/component inline in MCP Apps when the host supports it.\",\n        },\n        chrome: {\n          type: \"string\",\n          enum: [\"full\", \"minimal\"],\n          description:\n            \"Embed chrome preference for compatible app routes. Defaults to full.\",\n        },\n      },\n      [\"app\"],\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const app = String(args.app ?? \"\").trim();\n      const view = String(args.view ?? \"\").trim();\n      // `safeAppPath` rejects anything that isn't a leading-slash same-origin\n      // path. When the caller passes nothing, fall back to the app's root so a\n      // bare `open_app({app:\"dispatch\"})` lands on the home page instead of\n      // throwing. The model self-corrects on the retry today, but the extra\n      // round-trip wastes a turn and looks broken to the user.\n      const path = safeAppPath(args.path) || (view ? null : \"/\");\n      if (!app) {\n        throw new Error(\"open_app requires 'app'.\");\n      }\n      let params: Record<string, string | number | boolean> | undefined;\n      const raw = args.params;\n      if (raw && typeof raw === \"object\") {\n        params = raw as Record<string, string | number | boolean>;\n      } else if (typeof raw === \"string\" && raw.trim()) {\n        try {\n          params = JSON.parse(raw);\n        } catch {\n          params = undefined;\n        }\n      }\n      const embeddedParam = params?.embed;\n      const chromeParam = params?.chrome;\n      let embed = args.embed === true || args.embed === \"true\";\n      if (\n        args.embed == null &&\n        (embeddedParam === true || embeddedParam === \"true\")\n      ) {\n        embed = true;\n      } else if (\n        args.embed == null &&\n        (embeddedParam === false || embeddedParam === \"false\")\n      ) {\n        embed = false;\n      }\n      if (\n        embeddedParam === true ||\n        embeddedParam === false ||\n        embeddedParam === \"true\" ||\n        embeddedParam === \"false\"\n      ) {\n        delete params?.embed;\n      }\n\n      const chrome =\n        typeof args.chrome === \"string\"\n          ? args.chrome\n          : chromeParam === \"full\" || chromeParam === \"minimal\"\n            ? chromeParam\n            : undefined;\n      if (chromeParam === \"full\" || chromeParam === \"minimal\") {\n        delete params?.chrome;\n      }\n      if (params && Object.keys(params).length === 0) params = undefined;\n\n      const directViewPath = embed && view ? viewToAppPath(view) : null;\n      const relUrl = path\n        ? appendParamsToPath(path, params)\n        : directViewPath\n          ? appendParamsToPath(directViewPath, params)\n          : buildDeepLink({ app, view, params });\n      const sameAppUrl =\n        path || directViewPath ? withConfiguredBasePath(relUrl) : relUrl;\n\n      // Cross-app target in a workspace: resolve the TARGET app's origin and\n      // return an absolute URL. Otherwise the MCP layer would prefix the\n      // relative path with the CURRENT request origin, landing the user in\n      // the wrong app (e.g. open_app({app:\"calendar\"}) served from Mail).\n      // Same-app / standalone keeps the relative path (current behavior).\n      const targetApp = await resolveTargetAppOrigin(config, app);\n      const appUrl = targetApp\n        ? `${targetApp.origin.replace(/\\/+$/, \"\")}${relUrl}`\n        : sameAppUrl;\n      const url = appUrl;\n      let embedStartUrl: string | undefined;\n      let embedTargetPath: string | undefined;\n      let embedExpiresAt: number | undefined;\n\n      if (embed && !targetApp) {\n        const { getRequestContext } =\n          await import(\"../server/request-context.js\");\n        const ctx = getRequestContext();\n        const ownerEmail = ctx?.userEmail?.trim();\n        if (ownerEmail) {\n          const { normalizeEmbedTargetPath, createEmbedSessionTicket } =\n            await import(\"../server/embed-session.js\");\n          const { buildEmbedStartPath } =\n            await import(\"../server/embed-route.js\");\n          const targetPath = normalizeEmbedTargetPath(\n            withMcpChatBridgeParam(url),\n            requestMeta?.origin,\n          );\n          if (targetPath) {\n            const ticket = await createEmbedSessionTicket({\n              ownerEmail,\n              orgId: ctx?.orgId,\n              targetPath,\n              scope: chrome ?? null,\n            });\n            const startPath = buildEmbedStartPath(ticket.ticket);\n            embedStartUrl = requestMeta?.origin\n              ? new URL(startPath, requestMeta.origin).toString()\n              : startPath;\n            embedTargetPath = targetPath;\n            embedExpiresAt = ticket.expiresAt;\n          }\n        }\n      }\n\n      return {\n        app,\n        ...(view ? { view } : {}),\n        ...(path ? { path } : {}),\n        url,\n        ...(embedStartUrl ? { embedStartUrl } : {}),\n        ...(embedTargetPath ? { embedTargetPath } : {}),\n        ...(embedExpiresAt ? { embedExpiresAt } : {}),\n        embed,\n      };\n    },\n    link: ({ result }) => {\n      if (!result || typeof result !== \"object\") return null;\n      const r = result as {\n        url?: string;\n        app?: string;\n        view?: string;\n        embed?: boolean;\n      };\n      if (r.embed) return null;\n      if (!r.url) return null;\n      return {\n        url: r.url,\n        label: `Open ${r.app ?? \"app\"}`,\n        view: r.view,\n      };\n    },\n    mcpApp: {\n      resource: embedApp({\n        title: \"Open app\",\n        description: \"Render the requested app route inline.\",\n        iframeTitle: \"Agent Native app\",\n        openLabel: \"Open app\",\n      }),\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// create_embed_session\n// ---------------------------------------------------------------------------\n\nfunction createEmbedSessionTool(requestMeta?: {\n  origin?: string;\n}): ActionEntry {\n  return {\n    tool: {\n      ...tool(\n        \"MCP Apps helper: create a one-time browser embed session for a same-origin app URL. Usually called by an MCP App iframe, not directly by the model.\",\n        {\n          url: {\n            type: \"string\",\n            description:\n              \"Same-origin absolute URL or app-relative path to embed.\",\n          },\n          path: {\n            type: \"string\",\n            description: \"Same-origin app-relative path to embed.\",\n          },\n          chrome: {\n            type: \"string\",\n            enum: [\"full\", \"minimal\"],\n            description: \"Embed chrome preference. Defaults to full.\",\n          },\n        },\n      ),\n      _meta: { ui: { visibility: [\"app\"] } },\n    } as ActionTool,\n    // App-only bootstrap helper: the ticket becomes a normal browser session,\n    // so keep it write-scoped until embed sessions can enforce MCP scopes.\n    readOnly: false,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const { getRequestContext } =\n        await import(\"../server/request-context.js\");\n      const ctx = getRequestContext();\n      const ownerEmail = ctx?.userEmail?.trim();\n      if (!ownerEmail) {\n        throw new Error(\n          \"create_embed_session requires an authenticated MCP caller.\",\n        );\n      }\n\n      const { normalizeEmbedTargetPath, createEmbedSessionTicket } =\n        await import(\"../server/embed-session.js\");\n      const { buildEmbedStartPath } = await import(\"../server/embed-route.js\");\n      const rawTarget =\n        typeof args.url === \"string\" && args.url.trim()\n          ? args.url\n          : typeof args.path === \"string\"\n            ? args.path\n            : \"\";\n      const targetPath = normalizeEmbedTargetPath(\n        rawTarget,\n        requestMeta?.origin,\n      );\n      if (!targetPath) {\n        throw new Error(\n          \"create_embed_session can only embed same-origin app-relative URLs.\",\n        );\n      }\n\n      const ticket = await createEmbedSessionTicket({\n        ownerEmail,\n        orgId: ctx?.orgId,\n        targetPath,\n        scope: typeof args.chrome === \"string\" ? args.chrome : null,\n      });\n      const startPath = buildEmbedStartPath(ticket.ticket);\n      const startUrl = requestMeta?.origin\n        ? new URL(startPath, requestMeta.origin).toString()\n        : startPath;\n      return {\n        startUrl,\n        targetPath,\n        expiresAt: ticket.expiresAt,\n      };\n    },\n  };\n}\n\n/**\n * Route an `ask_app` message to a *different* app's agent over A2A. Shared by\n * the workspace-resolved path and the org-directory-resolved path so the A2A\n * call logic is not duplicated. `origin` is the target app's A2A base\n * (workspace dev origin or the directory's `a2aUrl`); `id` is reported back.\n *\n * Throws on failure so the caller can be honest — it never falls back to this\n * app's agent and pretends it was the target.\n */\nasync function routeAskOverA2A(\n  origin: string,\n  id: string,\n  message: string,\n  options?: { durable?: boolean; maxWaitMs?: number },\n): Promise<\n  { app: string; routedVia: \"a2a\"; response: string } | AskAppTaskResult\n> {\n  if (options?.durable) {\n    return submitAskAppA2ATask(\n      { app: id, origin: agentNativeA2AEndpoint(origin), routedVia: \"a2a\" },\n      message,\n      options.maxWaitMs ?? ASK_APP_DEFAULT_INLINE_WAIT_MS,\n    );\n  }\n  const { callAgent } = await import(\"../a2a/client.js\");\n  const { resolveA2ACallerAuth } = await import(\"../a2a/caller-auth.js\");\n  // The MCP handler runs inside `runWithRequestContext`, so this is the\n  // verified caller identity and org scope. Reuse the same auth resolver as\n  // org-directory discovery so the directory lookup and actual A2A call are\n  // scoped the same way.\n  const auth = await resolveA2ACallerAuth();\n  const response = await callAgent(origin, message, {\n    apiKey: auth.apiKey,\n    userEmail: auth.userEmail,\n    orgDomain: auth.orgDomain,\n    orgSecret: auth.orgSecret,\n    // Bound the wait — cross-app A2A polls async by default.\n    timeoutMs: 5 * 60_000,\n  });\n  return { app: id, routedVia: \"a2a\", response };\n}\n\nasync function resolveAskAppStatusRoute(\n  config: MCPConfig,\n  requestedApp: string,\n  requestMeta?: AskAppRequestMeta,\n): Promise<AskAppRoute> {\n  const selfId = currentAppId(config);\n  const normalized = requestedApp.trim().toLowerCase();\n  const selfEndpointUrl = selfA2AEndpointUrl(requestMeta);\n\n  if (!normalized || normalized === selfId) {\n    if (!selfEndpointUrl) {\n      throw new Error(\n        \"ask_app_status requires a running app origin for local tasks.\",\n      );\n    }\n    return { app: selfId, origin: selfEndpointUrl, routedVia: \"local\" };\n  }\n\n  const targetApp = await resolveTargetAppOrigin(config, requestedApp);\n  if (targetApp) {\n    return {\n      app: targetApp.id,\n      origin: agentNativeA2AEndpoint(targetApp.origin),\n      routedVia: \"a2a\",\n    };\n  }\n\n  const orgApps = await fetchOrgApps({ selfId }).catch(() => [] as OrgApp[]);\n  const dirMatch = orgApps.find((a) => a.id === normalized);\n  if (dirMatch) {\n    return {\n      app: dirMatch.id,\n      origin: agentNativeA2AEndpoint(dirMatch.a2aUrl),\n      routedVia: \"a2a\",\n    };\n  }\n\n  throw new Error(`No reachable ask_app task route for app \"${requestedApp}\".`);\n}\n\n// ---------------------------------------------------------------------------\n// ask_app\n// ---------------------------------------------------------------------------\n\nfunction askAppTool(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Send a natural-language message to an app's AI agent and get its \" +\n        \"response. Use this first for natural-language investigation, \" +\n        \"diagnosis, multi-step work, and changes; it runs with the app's \" +\n        \"full skills, instructions, tools, and context. Use direct action \" +\n        \"tools only for a known, bounded read or simple UI handoff. In a \" +\n        \"single-app project the 'app' \" +\n        \"param is optional (defaults to this app). When 'app' names a \" +\n        \"different workspace app it is routed there over A2A; the result's \" +\n        \"'routedVia' field reports whether it ran cross-app or locally. \" +\n        \"On hosted MCP, long tasks may return a durable taskId instead of a \" +\n        \"final response; call ask_app_status with that taskId until completed.\",\n      {\n        app: {\n          type: \"string\",\n          description: \"App id to route to (optional in a single-app project)\",\n        },\n        message: {\n          type: \"string\",\n          description: \"The message to send to the app's agent\",\n        },\n        async: {\n          type: \"boolean\",\n          description:\n            \"When true, start a durable task and return immediately with a taskId.\",\n        },\n        maxWaitMs: {\n          type: \"number\",\n          description:\n            \"Maximum time to wait inline before returning a taskId. Hosted MCP clamps this to 25000ms.\",\n        },\n      },\n      [\"message\"],\n    ),\n    run: async (args: Record<string, any>) => {\n      const message = String(args.message ?? \"\").trim();\n      if (!message) throw new Error(\"ask_app requires a 'message'.\");\n      const requestedApp = String(args.app ?? \"\").trim();\n      const selfId = currentAppId(config);\n      const useDurableA2A = Boolean(requestMeta?.origin);\n      const maxWaitMs = isExplicitAsyncAsk(args.async)\n        ? 0\n        : boundedAskAppWaitMs(args.maxWaitMs);\n\n      // Cross-app: the caller named a *different* workspace app. Route the\n      // message to THAT app's agent over A2A (its `/_agent-native/a2a`\n      // endpoint runs the real agent loop with JWT identity) rather than\n      // silently answering from this app's agent and claiming delegation.\n      const targetApp = await resolveTargetAppOrigin(config, requestedApp);\n      if (targetApp) {\n        try {\n          return await routeAskOverA2A(\n            targetApp.origin,\n            targetApp.id,\n            message,\n            {\n              durable: useDurableA2A,\n              maxWaitMs,\n            },\n          );\n        } catch (err: any) {\n          // Be honest: routing was attempted and failed — do NOT fall back to\n          // this app's agent and pretend it was the target.\n          throw new Error(\n            `Failed to route ask_app to \"${targetApp.id}\" via A2A: ` +\n              `${err?.message ?? err}`,\n          );\n        }\n      }\n\n      // Not a known local/workspace app — try the org directory. When a\n      // directory is configured and the requested app is one of the org's\n      // deployed sibling apps, route to it over A2A (same path as above,\n      // against its `a2aUrl`). Inactive directory / any failure ⇒ orgApps is\n      // [] and this is skipped, preserving the exact local-only behavior.\n      if (requestedApp && requestedApp.toLowerCase() !== selfId) {\n        const orgApps = await fetchOrgApps({ selfId }).catch(\n          () => [] as OrgApp[],\n        );\n        const dirMatch = orgApps.find(\n          (a) => a.id === requestedApp.toLowerCase(),\n        );\n        if (dirMatch) {\n          try {\n            return await routeAskOverA2A(\n              dirMatch.a2aUrl,\n              dirMatch.id,\n              message,\n              {\n                durable: useDurableA2A,\n                maxWaitMs,\n              },\n            );\n          } catch (err: any) {\n            throw new Error(\n              `Failed to route ask_app to \"${dirMatch.id}\" via A2A ` +\n                `(org directory): ${err?.message ?? err}`,\n            );\n          }\n        }\n      }\n\n      // Same app (or no workspace / unknown target): answer locally with this\n      // app's own ask-agent handler — the same entry point the HTTP MCP mount\n      // + A2A use, so there is no second agent runner.\n      if (!config.askAgent) {\n        throw new Error(\n          \"This app does not expose an agent (no ask-agent handler).\",\n        );\n      }\n\n      // If the caller named an app we couldn't route to (unknown id, or no\n      // workspace), say so honestly instead of claiming we reached it.\n      const unresolved =\n        !!requestedApp && requestedApp.toLowerCase() !== selfId;\n      const note = unresolved\n        ? `Requested app \"${requestedApp}\" is not a reachable workspace ` +\n          `app; answered with this app (\"${selfId}\") instead.`\n        : undefined;\n\n      // Hosted MCP cannot safely keep a JSON request/response open for a full\n      // agent loop: serverless gateways can return an inactivity 504 before\n      // the result body exists. When we know the running app origin, submit the\n      // local ask through the app's durable A2A task path and only wait a\n      // short bounded window for fast completions.\n      const localA2AEndpointUrl = selfA2AEndpointUrl(requestMeta);\n      if (localA2AEndpointUrl) {\n        return submitAskAppA2ATask(\n          {\n            app: selfId,\n            origin: localA2AEndpointUrl,\n            routedVia: \"local\",\n            ...(note ? { note } : {}),\n          },\n          message,\n          maxWaitMs,\n        );\n      }\n\n      const response = await config.askAgent(message);\n      return {\n        app: selfId,\n        routedVia: \"local\",\n        ...(note ? { note } : {}),\n        response,\n      };\n    },\n  };\n}\n\nfunction askAppStatusTool(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): ActionEntry {\n  return {\n    tool: tool(\n      \"Poll a durable ask_app task and return its current status or final response.\",\n      {\n        app: {\n          type: \"string\",\n          description:\n            \"App id returned by ask_app. Optional for same-app local tasks.\",\n        },\n        taskId: {\n          type: \"string\",\n          description: \"The durable task id returned by ask_app.\",\n        },\n      },\n      [\"taskId\"],\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async (args: Record<string, any>) => {\n      const taskId = String(args.taskId ?? \"\").trim();\n      if (!taskId) throw new Error(\"ask_app_status requires 'taskId'.\");\n      const requestedApp = String(args.app ?? \"\").trim();\n      const route = await resolveAskAppStatusRoute(\n        config,\n        requestedApp,\n        requestMeta,\n      );\n      return fetchAskAppA2ATask(route, taskId);\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// list_templates\n// ---------------------------------------------------------------------------\n\nfunction listTemplatesTool(): ActionEntry {\n  return {\n    tool: tool(\n      \"List the first-party templates that can be scaffolded into a workspace \" +\n        \"(allow-listed templates only).\",\n    ),\n    readOnly: true,\n    parallelSafe: true,\n    run: async () => {\n      const { visibleTemplates } = await import(\"../cli/templates-meta.js\");\n      return {\n        templates: visibleTemplates().map((t) => ({\n          name: t.name,\n          label: t.label,\n          hint: t.hint,\n        })),\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// create_workspace_app\n// ---------------------------------------------------------------------------\n\nfunction createWorkspaceAppTool(): ActionEntry {\n  return {\n    tool: tool(\n      \"Scaffold a new app into the current workspace from an allow-listed \" +\n        \"template, then return a deep link to open it. Idempotent: if an app \" +\n        \"with that name already exists it is reused.\",\n      {\n        name: {\n          type: \"string\",\n          description: \"New app id (directory under apps/), e.g. 'mymail'\",\n        },\n        template: {\n          type: \"string\",\n          description:\n            \"Template to scaffold from — must be allow-listed (see list_templates)\",\n        },\n      },\n      [\"name\", \"template\"],\n    ),\n    run: async (args: Record<string, any>) => {\n      const name = String(args.name ?? \"\").trim();\n      const template = String(args.template ?? \"\").trim();\n      if (!name || !template) {\n        throw new Error(\n          \"create_workspace_app requires both 'name' and 'template'.\",\n        );\n      }\n\n      // Enforce the strict public template allow-list. The authoritative,\n      // dependency-free source inside @agent-native/core is cli/templates-meta\n      // (kept in sync with packages/shared-app-config/templates.ts; CI guard).\n      const { visibleTemplates } = await import(\"../cli/templates-meta.js\");\n      const allowed = new Set(visibleTemplates().map((t) => t.name));\n      if (!allowed.has(template)) {\n        throw new Error(\n          `Template \"${template}\" is not allow-listed. Allowed: ${[...allowed]\n            .sort()\n            .join(\", \")}`,\n        );\n      }\n\n      const { findWorkspaceRoot, resolveWorkspace } =\n        await import(\"./workspace-resolve.js\");\n      const fs = await import(\"node:fs\");\n      const path = await import(\"node:path\");\n\n      const root = findWorkspaceRoot(process.cwd());\n      if (!root) {\n        throw new Error(\n          \"Not inside a workspace. create_workspace_app only works in a \" +\n            \"multi-app workspace (run from the workspace root).\",\n        );\n      }\n\n      const appDir = path.join(root, \"apps\", name);\n      const alreadyExisted = fs.existsSync(appDir);\n\n      if (!alreadyExisted) {\n        // Reuse the CLI scaffolder directly (no second `agent-native`\n        // subprocess). `addAppToWorkspace(name, { template })` takes the\n        // non-interactive single-template path when name + one template are\n        // given. Run it from the workspace root so detectWorkspace resolves.\n        const prevCwd = process.cwd();\n        try {\n          process.chdir(root);\n          const { addAppToWorkspace } = await import(\"../cli/create.js\");\n          await addAppToWorkspace(name, { template, noInstall: true });\n        } finally {\n          try {\n            process.chdir(prevCwd);\n          } catch {\n            // best-effort cwd restore\n          }\n        }\n      }\n\n      // The workspace gateway auto-detects new apps/* dirs (fs.watch +\n      // 2s sync) and lazily boots the dev server on first request, so we\n      // don't spawn vite ourselves — opening the deep link warms it. Resolve\n      // the port the gateway will use so we can report it.\n      const ws = await resolveWorkspace(root);\n      const appInfo = ws.apps.find((a) => a.id === name);\n      const port = appInfo?.port;\n      // The scaffolded app is always a *different* app from the host MCP\n      // server, so anchor the deep link to the new app's own origin. A\n      // relative path would otherwise be prefixed with the current request\n      // origin and land on the wrong app. Fall back to the relative path\n      // only if the gateway hasn't reported the new app's URL yet.\n      const relDeepLink = buildDeepLink({ app: name, view: \"home\" });\n      const deepLink = appInfo?.url\n        ? `${appInfo.url.replace(/\\/+$/, \"\")}${relDeepLink}`\n        : relDeepLink;\n\n      return {\n        name,\n        template,\n        created: !alreadyExisted,\n        reused: alreadyExisted,\n        port,\n        url: appInfo?.url,\n        gatewayUrl: ws.gatewayUrl,\n        deepLink,\n      };\n    },\n    link: ({ result }) => {\n      if (!result || typeof result !== \"object\") return null;\n      const r = result as { deepLink?: string; name?: string };\n      if (!r.deepLink) return null;\n      return {\n        url: r.deepLink,\n        label: `Open ${r.name ?? \"app\"}`,\n        view: \"home\",\n      };\n    },\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Registry\n// ---------------------------------------------------------------------------\n\n/**\n * Build the generic cross-app builtin tool registry. Called by\n * `createMCPServerForRequest`; the result is merged UNDER the config's\n * actions so template actions of the same name win.\n */\nexport function getBuiltinCrossAppTools(\n  config: MCPConfig,\n  requestMeta?: AskAppRequestMeta,\n): Record<string, ActionEntry> {\n  return {\n    list_apps: listAppsTool(config, requestMeta),\n    open_app: openAppTool(config, requestMeta),\n    create_embed_session: createEmbedSessionTool(requestMeta),\n    ask_app: askAppTool(config, requestMeta),\n    ask_app_status: askAppStatusTool(config, requestMeta),\n    create_workspace_app: createWorkspaceAppTool(),\n    list_templates: listTemplatesTool(),\n  };\n}\n"]}

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -49,11 +49,11 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -74,10 +74,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
+    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
-    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,11 +27,11 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map

package/docs/content/external-agents.mdx

@@ -417,17 +417,21 @@ rejected.
 
 The default Slack integration follows the same rule. A verified Slack DM is
 matched to an existing Agent Native organization member and persisted as a
-workspace/user identity link before the agent runs. The resulting user/org
-context loads that user's resources, instructions, and skills. Shared Slack
-channels use a service principal instead of borrowing one participant's
-private permissions; guests and external Slack members cannot use personal
-Agent Native access by default. If a Slack identity cannot be verified or its
-link changes, the message is rejected rather than downgraded to a broad
-service identity. Managed Slack OAuth requests the `users:read.email` bot
-scope, and the generated Slack app manifest requests it too. Existing Slack
-installs must be reconnected/reinstalled to grant a newly added scope; legacy
-bot-token installs must add the scope in Slack manually. Without it, personal
-DM execution fails closed.
+workspace/user identity link before the agent runs, and the resulting user/org
+context loads that user's resources, instructions, and skills. Hydrated
+workspace members whose email is missing or not yet an organization member run
+as an anonymous org-scoped service principal instead — the same
+org-wide-visibility tier shared channels get — with an agent-visible note and
+a one-time Slack heads-up explaining how to gain personal access. Hydration
+failures, guests and external (Slack Connect) members, and workspaces not
+connected to an organization receive a polite decline reply instead of a
+silent drop. Shared Slack channels use a service principal instead of
+borrowing one participant's private permissions. Managed Slack OAuth requests
+the `users:read.email` bot scope, and the generated Slack app manifest
+requests it too. Existing Slack installs must be reconnected/reinstalled to
+grant a newly added scope; legacy bot-token installs must add the scope in
+Slack manually. Without it, DMs run in the anonymous org-scoped tier rather
+than with personal access.
 
 ### Full tier (explicit opt-in only) {#full-tier}
 

package/docs/content/locales/ar-SA/external-agents.mdx

@@ -402,7 +402,9 @@ export default createAgentChatPlugin({
 
 لا يتم تضمين `db-schema` و`db-query` الأساسيين تلقائيًا في القراءات الخارجية. يظلان متاحين لوكيل التطبيق داخل التطبيق عبر مسار SQL المقيّد المعتاد، لكن الوصول العام إلى المخطط وSQL واسع جدًا لاستنتاجه من بيانات القراءة فقط. إذا احتاج التطبيق إلى استعلام خارجي مباشر، فعليه إضافة action مملوك للتطبيق بحدود وصول واضحة أو قائمة سماح صريحة للجداول والأعمدة مع حدود للصفوف والبايت والمهلة والتدقيق. يبقى `db-exec` و`db-patch` خارج السطح التلقائي.
 
-تستخدم رسائل Slack الخاصة هوية المستخدم فقط بعد التحقق من البريد الإلكتروني وربطه بعضوية موجودة في مؤسسة Agent Native. أما القنوات المشتركة فتستخدم هوية خدمة ولا تستعير أذونات أحد المشاركين الخاصة. يطلب OAuth المُدار والنموذج المُنشأ لتطبيق Slack النطاق `users:read.email`؛ يجب إعادة ربط التثبيتات الحالية بعد إضافة النطاق، بينما يجب تحديث الرموز القديمة يدويًا في Slack.
+هذا استبعاد صارم يعتمد على الاسم، وليس مجرد إغفال في البيانات الوصفية: أدوات قاعدة البيانات وseed وجلسة المتصفح والامتدادات وسياق الأشعة السينية العامة لا يُكشف عنها تلقائيًا أبدًا، حتى لو وسم تغيير مستقبلي إحداها عن طريق الخطأ بمجموعة أعلام القراءة المصادق عليها الكاملة — فهي تتطلب دائمًا إدخالًا صريحًا في `connectorCatalog`.
+
+تطابق رسائل Slack الخاصة التي تم التحقق منها عضوًا موجودًا في مؤسسة Agent Native، وتحفظ رابط هوية مساحة العمل/المستخدم قبل تشغيل الوكيل؛ ثم يحمّل سياق المستخدم/المؤسسة الناتج موارد ذلك المستخدم وتعليماته ومهاراته. أما أعضاء مساحة العمل الذين نجحت عملية جلب بياناتهم لكن بريدهم الإلكتروني مفقود أو لم ينضموا بعد إلى المؤسسة، فيعملون بهوية خدمة مجهولة ضمن نطاق المؤسسة — وهي طبقة الرؤية نفسها على مستوى المؤسسة التي تستخدمها القنوات المشتركة — مع ملاحظة يراها الوكيل وتنبيه لمرة واحدة في Slack يشرح كيفية الحصول على وصول شخصي. تتلقى حالات فشل جلب البيانات والضيوف والأعضاء الخارجيون (Slack Connect) ومساحات العمل غير المرتبطة بمؤسسة ردًا مهذبًا بالرفض بدل إسقاط الرسالة بصمت. تستخدم قنوات Slack المشتركة هوية خدمة ولا تستعير الأذونات الخاصة لأي مشارك. يطلب OAuth المُدار والنموذج المُنشأ لتطبيق Slack نطاق البوت `users:read.email`. يجب إعادة ربط/تثبيت عمليات التثبيت الحالية لمنح نطاق أُضيف حديثًا، بينما يجب أن تضيف عمليات التثبيت القديمة التي تستخدم رمز بوت النطاق يدويًا في Slack. من دونه، تعمل الرسائل الخاصة ضمن الطبقة المجهولة ذات نطاق المؤسسة بدل الوصول الشخصي.
 
 ### الطبقة الكاملة (الاشتراك الصريح فقط) {#full-tier}
 

package/docs/content/locales/de-DE/external-agents.mdx

@@ -404,7 +404,9 @@ Die Richtlinie ist authentifiziert, nicht anonym. Die MCP-OAuth-/Connect-Identit
 
 Core-`db-schema` und `db-query` werden nicht automatisch als externe Lesezugriffe veröffentlicht. Sie bleiben für den internen App-Agenten über den normalen, abgegrenzten SQL-Pfad verfügbar, aber ein breiter Schema-/SQL-Zugriff ist zu mächtig, um ihn allein aus Read-only-Metadaten abzuleiten. Benötigt eine App direkte externe Abfragen, muss sie eine eigene GET-Action mit Zugriffsprüfungen und festen Grenzen oder eine explizite Tabellen-/Spalten-Allowlist mit Zeilen-, Byte-, Zeit- und Audit-Limits bereitstellen. `db-exec` und `db-patch` bleiben außerhalb der automatischen Oberfläche.
 
-Slack-DMs verwenden die Benutzeridentität erst nach verifizierter E-Mail und einer bestehenden Mitgliedschaft in der Agent-Native-Organisation. Gemeinsame Kanäle verwenden dagegen einen Service-Principal und übernehmen keine privaten Berechtigungen eines Teilnehmers. Managed OAuth und das generierte Slack-Manifest fordern `users:read.email`; bestehende Installationen müssen nach einer Scope-Änderung neu verbunden werden, alte Bot-Tokens müssen in Slack manuell aktualisiert werden.
+Dies ist ein harter, namensbasierter Ausschluss und keine bloße Auslassung in den Metadaten: generische Datenbank-, Seed-, Browser-Sitzungs-, Erweiterungs- und Kontext-Röntgen-Tools werden niemals automatisch freigegeben, selbst wenn eine zukünftige Änderung eines davon versehentlich mit dem vollständigen Satz an Flags für authentifizierte Lesezugriffe versieht — sie benötigen immer einen expliziten `connectorCatalog`-Eintrag.
+
+Eine verifizierte Slack-DM wird vor dem Start des Agenten einem bestehenden Mitglied der Agent-Native-Organisation zugeordnet und als Identitätsverknüpfung zwischen Workspace und Benutzer gespeichert. Der daraus entstehende Benutzer-/Organisationskontext lädt die Ressourcen, Anweisungen und Skills dieses Benutzers. Erfolgreich geladene Workspace-Mitglieder, deren E-Mail-Adresse fehlt oder die noch kein Organisationsmitglied sind, werden stattdessen als anonymer, auf die Organisation begrenzter Service-Principal ausgeführt — mit derselben organisationsweiten Sichtbarkeit wie gemeinsame Kanäle. Der Agent erhält dazu einen sichtbaren Hinweis, und Slack erklärt einmalig, wie persönlicher Zugriff erlangt werden kann. Bei fehlgeschlagener Profilladung, Gästen und externen Mitgliedern (Slack Connect) sowie Workspaces ohne Organisationsverknüpfung wird höflich abgelehnt, statt die Nachricht stillschweigend zu verwerfen. Gemeinsame Slack-Kanäle verwenden einen Service-Principal und übernehmen keine privaten Berechtigungen eines Teilnehmers. Managed OAuth und das generierte Slack-App-Manifest fordern den Bot-Scope `users:read.email`. Bestehende Installationen müssen erneut verbunden/installiert werden, um einen neu hinzugefügten Scope zu gewähren; ältere Bot-Token-Installationen müssen ihn in Slack manuell hinzufügen. Ohne diesen Scope werden DMs in der anonymen, organisationsbegrenzten Stufe statt mit persönlichem Zugriff ausgeführt.
 
 ### Vollständige Stufe (nur explizites Opt-in) {#full-tier}
 

package/docs/content/locales/es-ES/external-agents.mdx

@@ -404,7 +404,9 @@ La política es autenticada, no anónima. La identidad de MCP OAuth/connect se c
 
 `db-schema` y `db-query` de Core no se exponen automáticamente como lecturas externas. Siguen disponibles para el agente interno de la aplicación mediante el flujo SQL con ámbito habitual, pero el acceso amplio al esquema/SQL es demasiado potente para inferirlo solo de metadatos de lectura. Si una aplicación necesita consultas externas directas, debe exponer una action GET propia con controles y límites de acceso, o una lista explícita de tablas/columnas con límites de filas, bytes, tiempo y auditoría. `db-exec` y `db-patch` quedan fuera de la superficie automática.
 
-Los mensajes directos de Slack usan la identidad del usuario solo después de verificar su correo y confirmar que pertenece a la organización de Agent Native. Los canales compartidos usan un principal de servicio y no heredan los permisos privados de un participante. OAuth administrado y el manifiesto generado de Slack solicitan `users:read.email`; las instalaciones existentes deben reconectarse tras añadir el ámbito y los tokens de bot antiguos deben actualizarse manualmente en Slack.
+Se trata de una exclusión estricta basada en el nombre, no solo de una omisión de metadatos: las herramientas genéricas de base de datos, seed, sesión del navegador, extensiones y rayos X de contexto nunca se exponen automáticamente, aunque un cambio futuro anote alguna de ellas por error con el conjunto completo de indicadores de lectura autenticada — siempre requieren una entrada explícita en `connectorCatalog`.
+
+Antes de ejecutar el agente, un mensaje directo verificado de Slack se asocia a un miembro existente de la organización de Agent Native y se guarda el vínculo de identidad entre el espacio de trabajo y el usuario. El contexto resultante del usuario y la organización carga los recursos, las instrucciones y las habilidades de ese usuario. Los miembros del espacio de trabajo cuyo perfil se ha obtenido correctamente, pero que no tienen correo electrónico o aún no pertenecen a la organización, se ejecutan como un principal de servicio anónimo limitado a la organización: el mismo nivel de visibilidad para toda la organización que usan los canales compartidos. El agente recibe una nota visible y Slack muestra una sola vez cómo obtener acceso personal. Si falla la obtención del perfil, si se trata de invitados o miembros externos (Slack Connect), o si el espacio de trabajo no está conectado a una organización, se envía una respuesta cortés de rechazo en vez de descartar el mensaje en silencio. Los canales compartidos de Slack usan un principal de servicio y no heredan los permisos privados de ningún participante. OAuth administrado y el manifiesto generado de la aplicación de Slack solicitan el ámbito de bot `users:read.email`. Las instalaciones existentes deben volver a conectarse o instalarse para conceder un ámbito recién añadido; las instalaciones antiguas con token de bot deben añadirlo manualmente en Slack. Sin él, los mensajes directos se ejecutan en el nivel anónimo limitado a la organización, no con acceso personal.
 
 ### Nivel completo (solo suscripción explícita) {#full-tier}
 

package/docs/content/locales/fr-FR/external-agents.mdx

@@ -404,7 +404,9 @@ La politique est authentifiée, et non anonyme. L'identité MCP OAuth/connect es
 
 Les outils Core `db-schema` et `db-query` ne sont pas automatiquement exposés comme lectures externes. Ils restent disponibles pour l'agent interne de l'application via le chemin SQL habituellement délimité, mais un accès large au schéma/SQL est trop puissant pour être déduit de simples métadonnées de lecture. Si une application a besoin de requêtes externes directes, elle doit exposer une action GET propre avec des contrôles d'accès et des limites, ou une liste explicite de tables/colonnes avec des limites de lignes, d'octets, de durée et d'audit. `db-exec` et `db-patch` restent hors de la surface automatique.
 
-Les messages directs Slack utilisent l'identité de l'utilisateur uniquement après vérification de son adresse e-mail et confirmation de son appartenance à l'organisation Agent Native. Les canaux partagés utilisent un principal de service et n'empruntent pas les autorisations privées d'un participant. OAuth géré et le manifeste Slack généré demandent `users:read.email` ; les installations existantes doivent être reconnectées après l'ajout de cette portée et les anciens jetons bot doivent être mis à jour manuellement dans Slack.
+Il s'agit d'une exclusion stricte basée sur le nom, et non d'une simple omission de métadonnées : les outils génériques de base de données, de seed, de session de navigateur, d'extensions et de radiographie contextuelle ne sont jamais exposés automatiquement, même si une modification future annote accidentellement l'un d'eux avec l'ensemble complet des indicateurs de lecture authentifiée — ils nécessitent toujours une entrée explicite dans `connectorCatalog`.
+
+Avant l'exécution de l'agent, un message direct Slack vérifié est associé à un membre existant de l'organisation Agent Native et le lien d'identité entre l'espace de travail et l'utilisateur est enregistré. Le contexte utilisateur/organisation qui en résulte charge les ressources, les instructions et les compétences de cet utilisateur. Les membres de l'espace de travail dont le profil a bien été chargé, mais dont l'adresse e-mail est absente ou qui ne sont pas encore membres de l'organisation, sont exécutés comme principal de service anonyme limité à l'organisation : le même niveau de visibilité à l'échelle de l'organisation que celui des canaux partagés. L'agent reçoit une note visible et Slack explique une fois comment obtenir un accès personnel. En cas d'échec du chargement du profil, pour les invités et membres externes (Slack Connect), ou pour les espaces de travail non connectés à une organisation, une réponse de refus polie est envoyée au lieu d'ignorer silencieusement le message. Les canaux Slack partagés utilisent un principal de service et n'empruntent pas les autorisations privées d'un participant. OAuth géré et le manifeste d'application Slack généré demandent la portée de bot `users:read.email`. Les installations existantes doivent être reconnectées ou réinstallées pour accorder une portée nouvellement ajoutée ; les anciennes installations par jeton de bot doivent l'ajouter manuellement dans Slack. Sans cette portée, les messages directs s'exécutent dans le niveau anonyme limité à l'organisation plutôt qu'avec un accès personnel.
 
 ### Niveau complet (adhésion explicite uniquement) {#full-tier}
 

package/docs/content/locales/hi-IN/external-agents.mdx

@@ -402,7 +402,9 @@ export default createAgentChatPlugin({
 
 Core के `db-schema` और `db-query` को स्वचालित बाहरी रीड के रूप में प्रकाशित नहीं किया जाता। वे सामान्य स्कोप किए गए SQL पथ के माध्यम से ऐप एजेंट के लिए उपलब्ध रहते हैं, लेकिन व्यापक स्कीमा/SQL पहुँच केवल read-only मेटाडेटा से अनुमान लगाने के लिए बहुत शक्तिशाली है। सीधे बाहरी क्वेरी की आवश्यकता होने पर ऐप को अपने access checks और सीमाओं वाला GET action, या rows, bytes, timeout और audit limits वाली स्पष्ट table/column allow-list देनी चाहिए। `db-exec` और `db-patch` स्वचालित सतह से बाहर रहते हैं।
 
-Slack DM में उपयोगकर्ता की पहचान तभी इस्तेमाल होती है जब ईमेल सत्यापित हो और वह Agent Native संगठन का सदस्य हो। साझा चैनल service principal का उपयोग करते हैं और किसी प्रतिभागी की निजी permissions नहीं लेते। Managed OAuth और generated Slack manifest दोनों `users:read.email` मांगते हैं; मौजूदा installations को scope जोड़ने के बाद reconnect करना होगा और पुराने bot tokens को Slack में manually update करना होगा।
+यह नाम-आधारित सख्त बहिष्करण है, केवल मेटाडेटा की चूक नहीं: सामान्य डेटाबेस/seed/ब्राउज़र-सत्र/एक्सटेंशन/संदर्भ-एक्सरे टूल कभी भी स्वचालित रूप से उजागर नहीं होते, भले ही भविष्य का कोई बदलाव गलती से इनमें से किसी एक को पूर्ण authenticated-read फ़्लैग सेट के साथ चिह्नित कर दे — उन्हें हमेशा एक स्पष्ट `connectorCatalog` प्रविष्टि की आवश्यकता होती है।
+
+एजेंट चलने से पहले सत्यापित Slack DM को Agent Native संगठन के किसी मौजूदा सदस्य से मिलाया जाता है और workspace/user पहचान लिंक सहेजा जाता है। इससे बने user/org संदर्भ में उस उपयोगकर्ता के संसाधन, निर्देश और skills लोड होते हैं। जिन workspace सदस्यों का प्रोफ़ाइल सफलतापूर्वक मिला है लेकिन ईमेल उपलब्ध नहीं है या वे अभी संगठन के सदस्य नहीं हैं, वे इसके बजाय संगठन-स्कोप वाले अनाम service principal के रूप में चलते हैं — साझा चैनलों वाली संगठन-व्यापी दृश्यता के उसी स्तर पर — साथ में एजेंट को दिखाई देने वाला नोट और व्यक्तिगत पहुँच पाने का तरीका बताने वाली एक बार की Slack सूचना। प्रोफ़ाइल लोड न होने, मेहमान या बाहरी (Slack Connect) सदस्य होने, या workspace के किसी संगठन से न जुड़े होने पर संदेश को चुपचाप छोड़ने के बजाय विनम्र अस्वीकृति भेजी जाती है। साझा Slack चैनल service principal का उपयोग करते हैं और किसी प्रतिभागी की निजी permissions नहीं लेते। Managed OAuth और generated Slack app manifest दोनों bot scope `users:read.email` मांगते हैं। नया scope देने के लिए मौजूदा installations को reconnect/reinstall करना होगा; पुराने bot-token installations को इसे Slack में manually जोड़ना होगा। इसके बिना DM व्यक्तिगत पहुँच के बजाय संगठन-स्कोप वाले अनाम स्तर में चलते हैं।
 
 ### पूर्ण स्तरीय (केवल स्पष्ट ऑप्ट-इन) {#full-tier}
 

package/docs/content/locales/ja-JP/external-agents.mdx

@@ -402,7 +402,9 @@ export default createAgentChatPlugin({
 
 Core の `db-schema` と `db-query` は外部の自動読み取りとして公開されません。通常のスコープ付き SQL パスを通じてアプリ内エージェントからは利用できますが、広範なスキーマ/SQL アクセスは read-only メタデータだけから推測するには強力すぎます。外部クエリを直接許可する場合は、アクセスチェックと上限を持つアプリ所有の GET action、または行数・バイト数・タイムアウト・監査の制限を備えた明示的なテーブル/カラム許可リストを追加してください。`db-exec` と `db-patch` は自動公開の対象外です。
 
-Slack の DM は、メールアドレスを検証し Agent Native 組織のメンバーであることを確認した後にだけユーザー ID を使用します。共有チャンネルはサービスプリンシパルを使い、参加者の個人的な権限を借用しません。管理対象 OAuth と生成される Slack マニフェストは `users:read.email` を要求します。既存のインストールはスコープ追加後に再接続し、古い bot トークンは Slack で手動更新してください。
+これは名前ベースの厳格な除外であり、単なるメタデータの記載漏れではありません。汎用のデータベース、seed、ブラウザ セッション、拡張、コンテキスト Xray のツールは、将来の変更で誤って完全な認証済み読み取りフラグセットが付与された場合でも、自動的に公開されることは決してありません — これらには常に明示的な `connectorCatalog` エントリが必要です。
+
+検証済みの Slack DM は、エージェントを実行する前に既存の Agent Native 組織メンバーと照合され、ワークスペース/ユーザーの ID リンクとして保存されます。生成されたユーザー/組織コンテキストには、そのユーザーのリソース、指示、スキルが読み込まれます。プロフィールの取得には成功したものの、メールアドレスがない、またはまだ組織メンバーではないワークスペース メンバーは、代わりに組織スコープの匿名サービスプリンシパルとして実行されます。これは共有チャンネルと同じ組織全体の可視性レベルであり、エージェントに表示される注記と、個人アクセスの取得方法を説明する 1 回限りの Slack 通知が付きます。プロフィール取得の失敗、ゲストや外部 (Slack Connect) メンバー、組織に接続されていないワークスペースには、メッセージを黙って破棄せず、丁寧な拒否応答を返します。Slack の共有チャンネルはサービスプリンシパルを使い、参加者の個人的な権限を借用しません。管理対象 OAuth と生成される Slack アプリ マニフェストは、bot スコープ `users:read.email` を要求します。新たに追加されたスコープを付与するには、既存のインストールを再接続/再インストールする必要があります。従来の bot トークンによるインストールでは、Slack でスコープを手動追加してください。このスコープがない場合、DM は個人アクセスではなく組織スコープの匿名レベルで実行されます。
 
 ### フルティア (明示的なオプトインのみ) {#full-tier}
 

package/docs/content/locales/ko-KR/external-agents.mdx

@@ -402,7 +402,9 @@ export default createAgentChatPlugin({
 
 Core `db-schema`와 `db-query`는 자동 외부 읽기로 공개되지 않습니다. 일반적인 범위 지정 SQL 경로를 통해 앱 내부 에이전트에서는 사용할 수 있지만, 광범위한 스키마/SQL 접근은 읽기 전용 메타데이터만으로 추론하기에는 너무 강력합니다. 외부 쿼리가 필요하면 접근 검사와 제한을 갖춘 앱 소유 GET action 또는 행·바이트·시간 제한과 감사를 포함한 명시적 테이블/열 허용 목록을 제공하세요. `db-exec`와 `db-patch`는 자동 표면에 포함되지 않습니다.
 
-Slack DM은 이메일을 검증하고 Agent Native 조직의 구성원임을 확인한 뒤에만 사용자 ID로 실행됩니다. 공유 채널은 서비스 주체를 사용하며 참여자의 개인 권한을 빌리지 않습니다. 관리형 OAuth와 생성된 Slack 매니페스트는 모두 `users:read.email`을 요청합니다. 기존 설치는 범위를 추가한 후 다시 연결해야 하며, 이전 봇 토큰은 Slack에서 수동으로 업데이트해야 합니다.
+이는 이름 기반의 강력한 제외이며 단순한 메타데이터 누락이 아닙니다. 일반 데이터베이스, seed, 브라우저 세션, 확장, context-xray 도구는 향후 변경으로 인해 실수로 전체 인증된 읽기 플래그 집합이 지정되더라도 절대 자동으로 노출되지 않습니다 — 이러한 도구는 항상 명시적인 `connectorCatalog` 항목이 필요합니다.
+
+검증된 Slack DM은 에이전트가 실행되기 전에 기존 Agent Native 조직 구성원과 연결되고 workspace/user ID 링크로 저장됩니다. 그 결과 생성된 사용자/조직 컨텍스트에는 해당 사용자의 리소스, 지침 및 skills가 로드됩니다. 프로필을 정상적으로 가져왔지만 이메일이 없거나 아직 조직 구성원이 아닌 workspace 구성원은 조직 범위의 익명 service principal로 실행됩니다. 이는 공유 채널과 동일한 조직 전체 공개 수준이며, 에이전트에 표시되는 메모와 개인 액세스를 얻는 방법을 설명하는 일회성 Slack 안내가 함께 제공됩니다. 프로필 가져오기 실패, 게스트 및 외부(Slack Connect) 구성원, 조직에 연결되지 않은 workspace에는 메시지를 조용히 버리는 대신 정중한 거절 응답을 보냅니다. Slack 공유 채널은 service principal을 사용하며 참여자의 개인 권한을 빌리지 않습니다. 관리형 OAuth와 생성된 Slack 앱 매니페스트는 모두 bot scope `users:read.email`을 요청합니다. 새로 추가된 scope를 부여하려면 기존 설치를 다시 연결/설치해야 하며, 이전 bot-token 설치는 Slack에서 scope를 수동으로 추가해야 합니다. 이 scope가 없으면 DM은 개인 액세스 대신 조직 범위의 익명 수준에서 실행됩니다.
 
 ### 전체 등급(명시적 선택만 해당) {#full-tier}