@agent-native/dispatch 0.14.2 → 0.14.4

package/dist/server/lib/dispatch-store.js

@@ -1,10 +1,11 @@
 import crypto from "node:crypto";
-import { and, desc, eq, isNull, or } from "@agent-native/core/db/schema";
+import { and, desc, eq, isNull, or, sql } from "@agent-native/core/db/schema";
 import { getRequestUserEmail, getRequestOrgId, } from "@agent-native/core/server";
 import { getOrgSetting, putOrgSetting } from "@agent-native/core/settings";
 import { getDb, schema } from "../../db/index.js";
 export const SHARED_DISPATCH_OWNER = "dispatch@shared";
 const APPROVAL_POLICY_KEY = "dispatch-approval-policy";
+const APPROVAL_APPLY_LEASE_MS = 5 * 60 * 1000;
 // ─── /link rate limiting ──────────────────────────────────────────────────
 //
 // Failed `/link <token>` attempts are rate-limited per `(platform, externalUserId)`
@@ -116,8 +117,7 @@ export async function getApprovalPolicy() {
             : [],
     };
 }
-async function applyApprovalPolicy(input, actor = currentOwnerEmail()) {
-    const orgId = currentOrgId();
+async function applyApprovalPolicy(input, actor = currentOwnerEmail(), orgId = currentOrgId()) {
     if (!orgId) {
         throw new Error("Dispatch approval settings require an active organization");
     }
@@ -135,7 +135,10 @@ async function applyApprovalPolicy(input, actor = currentOwnerEmail()) {
         metadata: input,
         actor,
     });
-    return getApprovalPolicy();
+    return {
+        enabled: input.enabled,
+        approverEmails: input.approverEmails,
+    };
 }
 export async function setApprovalPolicy(input) {
     const current = await getApprovalPolicy();
@@ -395,7 +398,7 @@ async function applyApprovedRequest(request) {
         return applyDestinationDelete(payload.id, request.reviewedBy || currentOwnerEmail(), requestCtx);
     }
     if (request.changeType === "approval-policy.update") {
-        return applyApprovalPolicy(payload, request.reviewedBy || currentOwnerEmail());
+        return applyApprovalPolicy(payload, request.reviewedBy || currentOwnerEmail(), requestCtx.orgId);
     }
     if (request.changeType === "dream-proposal.apply") {
         const { applyApprovedDreamProposal } = await import("./dreams-store.js");
@@ -421,23 +424,53 @@ export async function approveRequest(requestId) {
     const request = await getApprovalRequest(requestId, ctx);
     if (!request)
         throw new Error("Approval request not found");
-    if (request.status !== "pending") {
-        throw new Error("Only pending approvals can be approved");
-    }
     const timestamp = now();
-    await db
+    const staleApplyingBefore = timestamp - APPROVAL_APPLY_LEASE_MS;
+    // Fence the transition on the current status so a concurrent approve can't
+    // both win. A crashed worker can leave its lease in "applying", so reclaim
+    // only a lease that has been idle for the full lease interval.
+    const claimed = await db
+        .update(schema.dispatchApprovalRequests)
+        .set({
+        status: "applying",
+        updatedAt: timestamp,
+    })
+        .where(and(eq(schema.dispatchApprovalRequests.id, requestId), ctxScope(schema.dispatchApprovalRequests, ctx), or(eq(schema.dispatchApprovalRequests.status, "pending"), and(eq(schema.dispatchApprovalRequests.status, "applying"), sql `${schema.dispatchApprovalRequests.updatedAt} < ${staleApplyingBefore}`))))
+        .returning();
+    if (claimed.length === 0) {
+        const current = (await getApprovalRequest(requestId, ctx)) ?? request;
+        if (current.status === "applying") {
+            throw new Error("Approval is already being applied");
+        }
+        return current;
+    }
+    const applying = claimed[0];
+    try {
+        await applyApprovedRequest(applying);
+    }
+    catch (error) {
+        // Applying a request can have succeeded partially before throwing. Do not
+        // return it to pending: that would allow an immediate retry to duplicate a
+        // non-idempotent effect. Keep the lease until it becomes stale, which
+        // serializes any recovery attempt behind the same fencing rule.
+        await db
+            .update(schema.dispatchApprovalRequests)
+            .set({ updatedAt: now() })
+            .where(and(eq(schema.dispatchApprovalRequests.id, requestId), ctxScope(schema.dispatchApprovalRequests, ctx), eq(schema.dispatchApprovalRequests.status, "applying")));
+        throw error;
+    }
+    const [updated] = await db
         .update(schema.dispatchApprovalRequests)
         .set({
         status: "approved",
         reviewedBy: currentOwnerEmail(),
         reviewedAt: timestamp,
-        updatedAt: timestamp,
+        updatedAt: now(),
     })
-        .where(eq(schema.dispatchApprovalRequests.id, requestId));
-    const updated = await getApprovalRequest(requestId, ctx);
+        .where(and(eq(schema.dispatchApprovalRequests.id, requestId), ctxScope(schema.dispatchApprovalRequests, ctx), eq(schema.dispatchApprovalRequests.status, "applying")))
+        .returning();
     if (!updated)
         throw new Error("Approval request disappeared");
-    await applyApprovedRequest(updated);
     await recordAudit({
         action: "approval.approved",
         targetType: updated.targetType,
@@ -449,14 +482,12 @@ export async function approveRequest(requestId) {
 }
 export async function rejectRequest(requestId, reason) {
     const db = getDb();
-    const request = await getApprovalRequest(requestId);
+    const ctx = requireDispatchCtx();
+    const request = await getApprovalRequest(requestId, ctx);
     if (!request)
         throw new Error("Approval request not found");
-    if (request.status !== "pending") {
-        throw new Error("Only pending approvals can be rejected");
-    }
     const timestamp = now();
-    await db
+    const claimed = await db
         .update(schema.dispatchApprovalRequests)
         .set({
         status: "rejected",
@@ -464,15 +495,20 @@ export async function rejectRequest(requestId, reason) {
         reviewedAt: timestamp,
         updatedAt: timestamp,
     })
-        .where(eq(schema.dispatchApprovalRequests.id, requestId));
+        .where(and(eq(schema.dispatchApprovalRequests.id, requestId), ctxScope(schema.dispatchApprovalRequests, ctx), eq(schema.dispatchApprovalRequests.status, "pending")))
+        .returning();
+    if (claimed.length === 0) {
+        return (await getApprovalRequest(requestId, ctx)) ?? request;
+    }
+    const updated = claimed[0];
     await recordAudit({
         action: "approval.rejected",
-        targetType: request.targetType,
+        targetType: updated.targetType,
         targetId: requestId,
-        summary: `Rejected ${request.summary}`,
-        metadata: { request, reason: reason || null },
+        summary: `Rejected ${updated.summary}`,
+        metadata: { request: updated, reason: reason || null },
     });
-    return getApprovalRequest(requestId);
+    return updated;
 }
 export async function createLinkToken(platform) {
     const db = getDb();

package/dist/server/lib/dispatch-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-store.js","sourceRoot":"","sources":["../../../src/server/lib/dispatch-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AACvD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAEvD,6EAA6E;AAC7E,EAAE;AACF,oFAAoF;AACpF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,kBAAkB;AAClB,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAO9B,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE5D,SAAS,cAAc,CACrB,QAAgB,EAChB,cAAyC;IAEzC,OAAO,GAAG,QAAQ,KAAK,cAAc,IAAI,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC1C,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,mDAAmD;IACnD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,GAAG,mBAAmB,CACzC,CAAC;IACF,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACjD,KAAK,CAAC,YAAY,GAAG,KAAK,GAAG,kBAAkB,CAAC;QAChD,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEf,YAAY;IAD/B,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAA4B,YAAoB;QAC9C,KAAK,CACH,+CAA+C,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAC7F,CAAC;4BAHwB,YAAY;IAIxC,CAAC;CACF;AAmBD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,eAAe,EAAE,IAAI,IAAI,CAAC;AACnC,CAAC;AAaD,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CACf,KAAQ,EACR,GAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,EAAE;IACT,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,GAAG;IACV,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI;QAC9B,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CACvB,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;YACH,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,KAAK,GAAG,iBAAiB,EAAE;IAE3B,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,EAAE,mBAAmB,EAAE;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,kBAAkB;QAC1B,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,qDAAqD;QACzD,QAAQ,EAAE,KAAK;QACf,KAAK;KACN,CAAC,CAAC;IACH,OAAO,iBAAiB,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA6B;IACnE,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,qBAAqB,CAAC;QAC3B,UAAU,EAAE,wBAAwB;QACpC,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,kCAAkC;QACtC,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KASjC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;QACjD,EAAE,EAAE,EAAE,EAAE;QACR,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE;QACnD,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE;QAC/D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,GAAG,EAAE;IAC9C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EAC9D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAC7C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;SACnD,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACjC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EAC/D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAC9C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACjC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAA+B,EAC/B,KAAK,GAAG,iBAAiB,EAAE,EAC3B,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;aACnC,GAAG,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF,CAAC;IACN,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;YAClD,EAAE,EAAE,aAAa;YACjB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,CAAC;QAChB,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB;QAChE,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,EAAE;QAC1F,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,aAAqB,EACrB,KAAK,GAAG,iBAAiB,EAAE,EAC3B,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACnC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF,CAAC;IACJ,MAAM,WAAW,CAAC;QAChB,KAAK;QACL,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,CAAC,IAAI,EAAE;QACpE,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,OAAe;IAC/D,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE9E,MAAM,KAAK,CAAC,uCAAuC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrD,OAAO,EAAE,6BAA6B;iBACvC;aACF;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACrB,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,GAAG,OAAO,uBAAuB,MAAM,YAAY;iBAC3D;aACF;YACD,WAAW,EAAE,EAAE,SAAS,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;QACtD,EAAE,EAAE,SAAS;QACb,UAAU,EAAE,iBAAiB,EAAE;QAC/B,KAAK,EAAE,YAAY,EAAE;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAChC,WAAW,EACT,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QACtE,UAAU,EACR,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QACpE,WAAW,EAAE,iBAAiB,EAAE;QAChC,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA+B;IACrE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;YAC1B,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,EAAE;YACxF,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,UAAU,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,CAAC,IAAI,EAAE;YACnE,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE;YAC9B,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EACnE,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;QAClD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAClD,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAgC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,sBAAsB,CAC3B,OAAO,EACP,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,sBAAsB,CAC3B,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,wBAAwB,EAAE,CAAC;QACpD,OAAO,mBAAmB,CACxB,OAAO,EACP,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAClD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACzE,OAAO,0BAA0B,CAC/B,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB;IACpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,iBAAiB,EAAE;QAC/B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9D,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAsB;IAC3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,iBAAiB,EAAE;QAC/B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE;KAC9C,CAAC,CAAC;IACH,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,yDAAyD;IACzD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,EAAE,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;QAChD,EAAE,EAAE,QAAQ;QACZ,KAAK;QACL,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,YAAY,EAAE;QACrB,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC9C,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,IAAI;QAC7B,yBAAyB,EAAE,IAAI;QAC/B,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,6BAA6B;QACrC,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,WAAW,QAAQ,mBAAmB,KAAK,EAAE;QACtD,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;KAC9B,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,OAAO,EAAE,SAAS,KAAK,EAAE;QACzB,QAAQ;QACR,SAAS,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,CACjB,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,EAClD,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,CACtB,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,EAC/C,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAC5C,CAAC;IACF,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;aAClC,KAAK,CAAC,OAAO,CAAC;aACd,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACxD,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;aAC/B,KAAK,CAAC,YAAY,CAAC;aACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;KACtD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,cAA8B,EAC9B,OAAO,GAGH,EAAE;IAEN,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACnD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,EAC/D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnD,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEvD,wEAAwE;IACxE,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,YAAY,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACnD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,CAChE,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,EAAE,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,qCAAqC;IACrC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACtD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CACjD,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;SAClD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;QAC/B,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACzD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACrE,QAAQ,CAAC,KAAK;QACZ,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;aACpC,GAAG,CAAC;YACH,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,QAAQ,EAAE,QAAQ,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;YACnD,EAAE,EAAE,EAAE,EAAE;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,QAAQ,EAAE,QAAQ,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;SACjC,GAAG,CAAC;QACH,SAAS,EAAE,SAAS;QACpB,uBAAuB,EAAE,KAAK,CAAC,cAAc;QAC7C,yBAAyB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;QACzD,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAExD,+DAA+D;IAC/D,6CAA6C;IAC7C,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAExD,MAAM,WAAW,CAAC;QAChB,KAAK,EAAE,QAAQ,CAAC,SAAS;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,eAAe;QAC3B,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,OAAO,EAAE,UAAU,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,EAAE;QAC1F,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,UAAU,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,GAC1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,gBAAgB,EAAE;QAClB,oBAAoB,EAAE;QACtB,iBAAiB,EAAE;QACnB,eAAe,CAAC,EAAE,CAAC;QACnB,iBAAiB,EAAE;KACpB,CAAC,CAAC;IAEL,OAAO;QACL,MAAM,EAAE;YACN,YAAY,EAAE,YAAY,CAAC,MAAM;YACjC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;iBACpE,MAAM;YACT,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;YACzC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CACpD,CAAC,MAAM;SACT;QACD,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport { and, desc, eq, isNull, or } from \"@agent-native/core/db/schema\";\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n} from \"@agent-native/core/server\";\nimport { getOrgSetting, putOrgSetting } from \"@agent-native/core/settings\";\n\nimport { getDb, schema } from \"../../db/index.js\";\n\nexport const SHARED_DISPATCH_OWNER = \"dispatch@shared\";\nconst APPROVAL_POLICY_KEY = \"dispatch-approval-policy\";\n\n// ─── /link rate limiting ──────────────────────────────────────────────────\n//\n// Failed `/link <token>` attempts are rate-limited per `(platform, externalUserId)`\n// to deter token brute-force after the H5 entropy bump. The window /\n// threshold are tuned so legitimate retries (typo, expired token) don't\n// trip the limit, while a scripted attacker burns out their per-account\n// budget quickly.\n//\n// State is process-local: works for the single-node dispatch deployment\n// we ship today. TODO: move to a SQL-backed counter table when dispatch\n// is sharded across multiple regions / processes — otherwise an\n// attacker can scale around the limit by hammering more than one node.\nconst LINK_FAIL_WINDOW_MS = 5 * 60 * 1000;\nconst LINK_FAIL_BLOCK_MS = 30 * 60 * 1000;\nconst LINK_FAIL_THRESHOLD = 5;\n\ninterface LinkFailureState {\n  failures: number[]; // unix-ms timestamps of recent failures within the window\n  blockedUntil: number; // unix-ms; 0 if not currently blocked\n}\n\nconst _linkFailureMap = new Map<string, LinkFailureState>();\n\nfunction linkFailureKey(\n  platform: string,\n  externalUserId: string | null | undefined,\n): string {\n  return `${platform}::${externalUserId ?? \"\"}`;\n}\n\nfunction getLinkFailureState(key: string): LinkFailureState {\n  let state = _linkFailureMap.get(key);\n  if (!state) {\n    state = { failures: [], blockedUntil: 0 };\n    _linkFailureMap.set(key, state);\n  }\n  return state;\n}\n\nfunction isLinkAttemptBlocked(\n  platform: string,\n  externalUserId: string | null | undefined,\n): { blocked: true; retryAfterMs: number } | { blocked: false } {\n  if (!externalUserId) return { blocked: false };\n  const key = linkFailureKey(platform, externalUserId);\n  const state = _linkFailureMap.get(key);\n  if (!state) return { blocked: false };\n  const nowMs = Date.now();\n  if (state.blockedUntil > nowMs) {\n    return { blocked: true, retryAfterMs: state.blockedUntil - nowMs };\n  }\n  return { blocked: false };\n}\n\nfunction recordLinkFailure(\n  platform: string,\n  externalUserId: string | null | undefined,\n): void {\n  if (!externalUserId) return;\n  const key = linkFailureKey(platform, externalUserId);\n  const state = getLinkFailureState(key);\n  const nowMs = Date.now();\n  // Drop expired failure timestamps before counting.\n  state.failures = state.failures.filter(\n    (ts) => nowMs - ts < LINK_FAIL_WINDOW_MS,\n  );\n  state.failures.push(nowMs);\n  if (state.failures.length >= LINK_FAIL_THRESHOLD) {\n    state.blockedUntil = nowMs + LINK_FAIL_BLOCK_MS;\n    state.failures = [];\n  }\n}\n\nfunction clearLinkFailures(\n  platform: string,\n  externalUserId: string | null | undefined,\n): void {\n  if (!externalUserId) return;\n  _linkFailureMap.delete(linkFailureKey(platform, externalUserId));\n}\n\n/**\n * 429-style error returned when /link attempts are rate-limited. The\n * adapter layer can branch on `code === \"LINK_RATE_LIMITED\"` to send a\n * platform-appropriate message back to the user.\n */\nexport class LinkRateLimitError extends Error {\n  readonly code = \"LINK_RATE_LIMITED\";\n  constructor(public readonly retryAfterMs: number) {\n    super(\n      `Too many failed link attempts. Try again in ${Math.ceil(retryAfterMs / 60_000)} minute(s).`,\n    );\n  }\n}\n\nexport interface DispatchApprovalPolicy {\n  enabled: boolean;\n  approverEmails: string[];\n}\n\nexport interface DispatchDestinationInput {\n  id?: string;\n  name: string;\n  platform: string;\n  destination: string;\n  threadRef?: string | null;\n  notes?: string | null;\n}\n\ntype DispatchApprovalRequest =\n  typeof schema.dispatchApprovalRequests.$inferSelect;\n\nexport function currentOwnerEmail(): string {\n  const email = getRequestUserEmail();\n  if (!email) throw new Error(\"no authenticated user\");\n  return email;\n}\n\nexport function currentOrgId(): string | null {\n  return getRequestOrgId() || null;\n}\n\n/**\n * Caller-supplied access context for dispatch operations that work by\n * id (destinations, etc.). Looking up a row by id alone is unsafe —\n * UUIDs are not authorization. A row matches the ctx if either the\n * caller owns it or it lives in the caller's active org.\n */\nexport interface DispatchCtx {\n  ownerEmail: string;\n  orgId: string | null;\n}\n\nexport function requireDispatchCtx(): DispatchCtx {\n  return { ownerEmail: currentOwnerEmail(), orgId: currentOrgId() };\n}\n\nfunction ctxScope<T extends { ownerEmail: any; orgId: any }>(\n  table: T,\n  ctx: DispatchCtx,\n) {\n  if (!ctx.orgId) {\n    return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\n  }\n  return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));\n}\n\nfunction id() {\n  return crypto.randomUUID();\n}\n\nfunction now() {\n  return Date.now();\n}\n\nfunction safeJson(value: unknown) {\n  return JSON.stringify(value ?? null);\n}\n\nexport async function getApprovalPolicy(): Promise<DispatchApprovalPolicy> {\n  const orgId = currentOrgId();\n  if (!orgId) return { enabled: false, approverEmails: [] };\n  const raw = await getOrgSetting(orgId, APPROVAL_POLICY_KEY);\n  return {\n    enabled: raw?.enabled === true,\n    approverEmails: Array.isArray(raw?.approverEmails)\n      ? raw.approverEmails.filter(\n          (value): value is string => typeof value === \"string\",\n        )\n      : [],\n  };\n}\n\nasync function applyApprovalPolicy(\n  input: DispatchApprovalPolicy,\n  actor = currentOwnerEmail(),\n) {\n  const orgId = currentOrgId();\n  if (!orgId) {\n    throw new Error(\n      \"Dispatch approval settings require an active organization\",\n    );\n  }\n  await putOrgSetting(orgId, APPROVAL_POLICY_KEY, {\n    enabled: input.enabled,\n    approverEmails: input.approverEmails,\n  });\n  await recordAudit({\n    action: \"settings.updated\",\n    targetType: \"dispatch-settings\",\n    targetId: APPROVAL_POLICY_KEY,\n    summary: input.enabled\n      ? \"Enabled approval flow for durable dispatch changes\"\n      : \"Disabled approval flow for durable dispatch changes\",\n    metadata: input,\n    actor,\n  });\n  return getApprovalPolicy();\n}\n\nexport async function setApprovalPolicy(input: DispatchApprovalPolicy) {\n  const current = await getApprovalPolicy();\n  if (!current.enabled) {\n    return applyApprovalPolicy(input);\n  }\n  return createApprovalRequest({\n    changeType: \"approval-policy.update\",\n    targetType: \"dispatch-settings\",\n    targetId: APPROVAL_POLICY_KEY,\n    summary: input.enabled\n      ? \"Update dispatch approval policy\"\n      : \"Disable dispatch approval policy\",\n    payload: input,\n    beforeValue: current,\n    afterValue: input,\n  });\n}\n\nexport async function recordAudit(input: {\n  action: string;\n  targetType: string;\n  targetId?: string | null;\n  summary: string;\n  metadata?: unknown;\n  actor?: string;\n  ownerEmail?: string;\n  orgId?: string | null;\n}) {\n  const db = getDb();\n  const timestamp = now();\n  await db.insert(schema.dispatchAuditEvents).values({\n    id: id(),\n    ownerEmail: input.ownerEmail || currentOwnerEmail(),\n    orgId: input.orgId !== undefined ? input.orgId : currentOrgId(),\n    actor: input.actor || currentOwnerEmail(),\n    action: input.action,\n    targetType: input.targetType,\n    targetId: input.targetId || null,\n    summary: input.summary,\n    metadata: input.metadata ? safeJson(input.metadata) : null,\n    createdAt: timestamp,\n  });\n}\n\nexport async function listAuditEvents(limit = 50) {\n  const db = getDb();\n  const orgId = currentOrgId();\n  return db\n    .select()\n    .from(schema.dispatchAuditEvents)\n    .where(\n      and(\n        eq(schema.dispatchAuditEvents.ownerEmail, currentOwnerEmail()),\n        orgId\n          ? eq(schema.dispatchAuditEvents.orgId, orgId)\n          : isNull(schema.dispatchAuditEvents.orgId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchAuditEvents.createdAt))\n    .limit(limit);\n}\n\nexport async function listDestinations() {\n  const db = getDb();\n  const orgId = currentOrgId();\n  return db\n    .select()\n    .from(schema.dispatchDestinations)\n    .where(\n      and(\n        eq(schema.dispatchDestinations.ownerEmail, currentOwnerEmail()),\n        orgId\n          ? eq(schema.dispatchDestinations.orgId, orgId)\n          : isNull(schema.dispatchDestinations.orgId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchDestinations.updatedAt));\n}\n\nexport async function getDestinationById(\n  destinationId: string,\n  ctx: DispatchCtx = requireDispatchCtx(),\n) {\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.dispatchDestinations)\n    .where(\n      and(\n        eq(schema.dispatchDestinations.id, destinationId),\n        ctxScope(schema.dispatchDestinations, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nasync function applyDestinationUpsert(\n  input: DispatchDestinationInput,\n  actor = currentOwnerEmail(),\n  ctx: DispatchCtx = requireDispatchCtx(),\n) {\n  const db = getDb();\n  const timestamp = now();\n  const destinationId = input.id || id();\n  const existing = input.id ? await getDestinationById(input.id, ctx) : null;\n\n  if (existing) {\n    await db\n      .update(schema.dispatchDestinations)\n      .set({\n        name: input.name,\n        platform: input.platform,\n        destination: input.destination,\n        threadRef: input.threadRef || null,\n        notes: input.notes || null,\n        updatedAt: timestamp,\n      })\n      .where(\n        and(\n          eq(schema.dispatchDestinations.id, destinationId),\n          ctxScope(schema.dispatchDestinations, ctx),\n        ),\n      );\n  } else {\n    await db.insert(schema.dispatchDestinations).values({\n      id: destinationId,\n      ownerEmail: ctx.ownerEmail,\n      orgId: ctx.orgId,\n      name: input.name,\n      platform: input.platform,\n      destination: input.destination,\n      threadRef: input.threadRef || null,\n      notes: input.notes || null,\n      createdBy: actor,\n      createdAt: timestamp,\n      updatedAt: timestamp,\n    });\n  }\n\n  await recordAudit({\n    actor,\n    action: existing ? \"destination.updated\" : \"destination.created\",\n    targetType: \"destination\",\n    targetId: destinationId,\n    summary: `${existing ? \"Updated\" : \"Created\"} ${input.platform} destination ${input.name}`,\n    metadata: input,\n  });\n\n  return getDestinationById(destinationId, ctx);\n}\n\nasync function applyDestinationDelete(\n  destinationId: string,\n  actor = currentOwnerEmail(),\n  ctx: DispatchCtx = requireDispatchCtx(),\n) {\n  const db = getDb();\n  const existing = await getDestinationById(destinationId, ctx);\n  if (!existing) {\n    throw new Error(\"Destination not found\");\n  }\n  await db\n    .delete(schema.dispatchDestinations)\n    .where(\n      and(\n        eq(schema.dispatchDestinations.id, destinationId),\n        ctxScope(schema.dispatchDestinations, ctx),\n      ),\n    );\n  await recordAudit({\n    actor,\n    action: \"destination.deleted\",\n    targetType: \"destination\",\n    targetId: destinationId,\n    summary: `Deleted ${existing.platform} destination ${existing.name}`,\n    metadata: existing,\n  });\n  return existing;\n}\n\nasync function notifyApprovers(requestId: string, summary: string) {\n  const policy = await getApprovalPolicy();\n  const apiKey = process.env.SENDGRID_API_KEY;\n  const from = process.env.SENDGRID_FROM_EMAIL;\n  const appUrl = process.env.APP_URL;\n  if (!apiKey || !from || !appUrl || policy.approverEmails.length === 0) return;\n\n  await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      personalizations: [\n        {\n          to: policy.approverEmails.map((email) => ({ email })),\n          subject: \"Dispatch approval requested\",\n        },\n      ],\n      from: { email: from },\n      content: [\n        {\n          type: \"text/plain\",\n          value: `${summary}\\n\\nReview it here: ${appUrl}/approvals`,\n        },\n      ],\n      custom_args: { requestId },\n    }),\n  }).catch(() => {});\n}\n\nexport async function createApprovalRequest(input: {\n  changeType: string;\n  targetType: string;\n  targetId?: string | null;\n  summary: string;\n  payload: unknown;\n  beforeValue?: unknown;\n  afterValue?: unknown;\n}) {\n  const db = getDb();\n  const timestamp = now();\n  const requestId = id();\n  await db.insert(schema.dispatchApprovalRequests).values({\n    id: requestId,\n    ownerEmail: currentOwnerEmail(),\n    orgId: currentOrgId(),\n    changeType: input.changeType,\n    targetType: input.targetType,\n    targetId: input.targetId || null,\n    status: \"pending\",\n    summary: input.summary,\n    payload: safeJson(input.payload),\n    beforeValue:\n      input.beforeValue === undefined ? null : safeJson(input.beforeValue),\n    afterValue:\n      input.afterValue === undefined ? null : safeJson(input.afterValue),\n    requestedBy: currentOwnerEmail(),\n    reviewedBy: null,\n    reviewedAt: null,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n  await recordAudit({\n    action: \"approval.requested\",\n    targetType: input.targetType,\n    targetId: input.targetId || requestId,\n    summary: input.summary,\n    metadata: input,\n  });\n  await notifyApprovers(requestId, input.summary);\n  return getApprovalRequest(requestId);\n}\n\nexport async function upsertDestination(input: DispatchDestinationInput) {\n  const policy = await getApprovalPolicy();\n  if (policy.enabled) {\n    const existing = input.id ? await getDestinationById(input.id) : null;\n    return createApprovalRequest({\n      changeType: \"destination.upsert\",\n      targetType: \"destination\",\n      targetId: input.id || null,\n      summary: `${existing ? \"Update\" : \"Create\"} ${input.platform} destination ${input.name}`,\n      payload: input,\n      beforeValue: existing,\n      afterValue: input,\n    });\n  }\n  return applyDestinationUpsert(input);\n}\n\nexport async function deleteDestination(destinationId: string) {\n  const policy = await getApprovalPolicy();\n  const existing = await getDestinationById(destinationId);\n  if (!existing) {\n    throw new Error(\"Destination not found\");\n  }\n  if (policy.enabled) {\n    return createApprovalRequest({\n      changeType: \"destination.delete\",\n      targetType: \"destination\",\n      targetId: destinationId,\n      summary: `Delete ${existing.platform} destination ${existing.name}`,\n      payload: { id: destinationId },\n      beforeValue: existing,\n      afterValue: null,\n    });\n  }\n  return applyDestinationDelete(destinationId);\n}\n\nexport async function listApprovalRequests() {\n  const db = getDb();\n  const orgId = currentOrgId();\n  return db\n    .select()\n    .from(schema.dispatchApprovalRequests)\n    .where(\n      and(\n        eq(schema.dispatchApprovalRequests.ownerEmail, currentOwnerEmail()),\n        orgId\n          ? eq(schema.dispatchApprovalRequests.orgId, orgId)\n          : isNull(schema.dispatchApprovalRequests.orgId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchApprovalRequests.updatedAt));\n}\n\nasync function getApprovalRequest(\n  requestId: string,\n  ctx: DispatchCtx = requireDispatchCtx(),\n) {\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.dispatchApprovalRequests)\n    .where(\n      and(\n        eq(schema.dispatchApprovalRequests.id, requestId),\n        ctxScope(schema.dispatchApprovalRequests, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nasync function applyApprovedRequest(request: DispatchApprovalRequest) {\n  const payload = JSON.parse(request.payload);\n  const requestCtx = {\n    ownerEmail: request.ownerEmail,\n    orgId: request.orgId,\n  };\n  if (request.changeType === \"destination.upsert\") {\n    return applyDestinationUpsert(\n      payload,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"destination.delete\") {\n    return applyDestinationDelete(\n      payload.id,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"approval-policy.update\") {\n    return applyApprovalPolicy(\n      payload,\n      request.reviewedBy || currentOwnerEmail(),\n    );\n  }\n  if (request.changeType === \"dream-proposal.apply\") {\n    const { applyApprovedDreamProposal } = await import(\"./dreams-store.js\");\n    return applyApprovedDreamProposal(\n      payload.proposalId,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"workspace-resource.create\") {\n    const { applyWorkspaceResourceCreate } =\n      await import(\"./workspace-resources-store.js\");\n    return applyWorkspaceResourceCreate(\n      payload.input,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"workspace-resource.update\") {\n    const { applyWorkspaceResourceUpdate } =\n      await import(\"./workspace-resources-store.js\");\n    return applyWorkspaceResourceUpdate(\n      payload.id,\n      payload.input,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"workspace-resource.delete\") {\n    const { applyWorkspaceResourceDelete } =\n      await import(\"./workspace-resources-store.js\");\n    return applyWorkspaceResourceDelete(\n      payload.id,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  throw new Error(`Unsupported approval request type: ${request.changeType}`);\n}\n\nexport async function approveRequest(requestId: string) {\n  const db = getDb();\n  const ctx = requireDispatchCtx();\n  const request = await getApprovalRequest(requestId, ctx);\n  if (!request) throw new Error(\"Approval request not found\");\n  if (request.status !== \"pending\") {\n    throw new Error(\"Only pending approvals can be approved\");\n  }\n  const timestamp = now();\n  await db\n    .update(schema.dispatchApprovalRequests)\n    .set({\n      status: \"approved\",\n      reviewedBy: currentOwnerEmail(),\n      reviewedAt: timestamp,\n      updatedAt: timestamp,\n    })\n    .where(eq(schema.dispatchApprovalRequests.id, requestId));\n  const updated = await getApprovalRequest(requestId, ctx);\n  if (!updated) throw new Error(\"Approval request disappeared\");\n  await applyApprovedRequest(updated);\n  await recordAudit({\n    action: \"approval.approved\",\n    targetType: updated.targetType,\n    targetId: requestId,\n    summary: `Approved ${updated.summary}`,\n    metadata: updated,\n  });\n  return updated;\n}\n\nexport async function rejectRequest(requestId: string, reason?: string | null) {\n  const db = getDb();\n  const request = await getApprovalRequest(requestId);\n  if (!request) throw new Error(\"Approval request not found\");\n  if (request.status !== \"pending\") {\n    throw new Error(\"Only pending approvals can be rejected\");\n  }\n  const timestamp = now();\n  await db\n    .update(schema.dispatchApprovalRequests)\n    .set({\n      status: \"rejected\",\n      reviewedBy: currentOwnerEmail(),\n      reviewedAt: timestamp,\n      updatedAt: timestamp,\n    })\n    .where(eq(schema.dispatchApprovalRequests.id, requestId));\n  await recordAudit({\n    action: \"approval.rejected\",\n    targetType: request.targetType,\n    targetId: requestId,\n    summary: `Rejected ${request.summary}`,\n    metadata: { request, reason: reason || null },\n  });\n  return getApprovalRequest(requestId);\n}\n\nexport async function createLinkToken(platform: string) {\n  const db = getDb();\n  const timestamp = now();\n  // 16 bytes = 128 bits of entropy. Previous size was 4 bytes (32 bits,\n  // ~4.29 billion keyspace) which is brute-forceable in well under an\n  // hour given a 7-day expiry and no rate limiting on /link attempts.\n  // Old 8-hex-char tokens minted before this change continue to verify\n  // until they expire; we don't migrate retroactively. See\n  // /tmp/security-audit/07-webhooks.md (H5).\n  const token = crypto.randomBytes(16).toString(\"hex\");\n  const recordId = id();\n  const owner = currentOwnerEmail();\n  await db.insert(schema.dispatchLinkTokens).values({\n    id: recordId,\n    token,\n    ownerEmail: owner,\n    orgId: currentOrgId(),\n    platform,\n    createdBy: owner,\n    expiresAt: timestamp + 7 * 24 * 60 * 60 * 1000,\n    claimedAt: null,\n    claimedByExternalUserId: null,\n    claimedByExternalUserName: null,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n  await recordAudit({\n    action: \"identity.link-token-created\",\n    targetType: \"link-token\",\n    targetId: recordId,\n    summary: `Created ${platform} link token for ${owner}`,\n    metadata: { token, platform },\n  });\n  return {\n    token,\n    command: `/link ${token}`,\n    platform,\n    expiresAt: timestamp + 7 * 24 * 60 * 60 * 1000,\n  };\n}\n\nexport async function listIdentityState() {\n  const db = getDb();\n  const owner = currentOwnerEmail();\n  const orgId = currentOrgId();\n  const filters = and(\n    eq(schema.dispatchIdentityLinks.ownerEmail, owner),\n    orgId\n      ? eq(schema.dispatchIdentityLinks.orgId, orgId)\n      : isNull(schema.dispatchIdentityLinks.orgId),\n  );\n  const tokenFilters = and(\n    eq(schema.dispatchLinkTokens.ownerEmail, owner),\n    orgId\n      ? eq(schema.dispatchLinkTokens.orgId, orgId)\n      : isNull(schema.dispatchLinkTokens.orgId),\n  );\n  const [links, tokens] = await Promise.all([\n    db\n      .select()\n      .from(schema.dispatchIdentityLinks)\n      .where(filters)\n      .orderBy(desc(schema.dispatchIdentityLinks.updatedAt)),\n    db\n      .select()\n      .from(schema.dispatchLinkTokens)\n      .where(tokenFilters)\n      .orderBy(desc(schema.dispatchLinkTokens.updatedAt)),\n  ]);\n  return { links, tokens };\n}\n\nexport async function resolveLinkedOwner(\n  platform: string,\n  externalUserId?: string | null,\n  options: {\n    orgId?: string | null;\n    allowAnyOrgFallback?: boolean;\n  } = {},\n) {\n  if (!externalUserId) return null;\n  const db = getDb();\n  const orgId = options.orgId !== undefined ? options.orgId : currentOrgId();\n  const rows = await db\n    .select()\n    .from(schema.dispatchIdentityLinks)\n    .where(\n      and(\n        eq(schema.dispatchIdentityLinks.platform, platform),\n        eq(schema.dispatchIdentityLinks.externalUserId, externalUserId),\n        orgId\n          ? eq(schema.dispatchIdentityLinks.orgId, orgId)\n          : isNull(schema.dispatchIdentityLinks.orgId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchIdentityLinks.updatedAt))\n    .limit(1);\n  if (rows[0]?.ownerEmail) return rows[0].ownerEmail;\n\n  if (!options.allowAnyOrgFallback || orgId) return null;\n\n  // Webhook processors run outside a normal request/org context. A linked\n  // Slack/Telegram identity may still be scoped to an org, so fall back to any\n  // org only when every matching link resolves to the same owner.\n  const fallbackRows = await db\n    .select()\n    .from(schema.dispatchIdentityLinks)\n    .where(\n      and(\n        eq(schema.dispatchIdentityLinks.platform, platform),\n        eq(schema.dispatchIdentityLinks.externalUserId, externalUserId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchIdentityLinks.updatedAt))\n    .limit(25);\n  const owners = new Set(fallbackRows.map((row) => row.ownerEmail));\n  return owners.size === 1 ? fallbackRows[0]?.ownerEmail || null : null;\n}\n\nexport async function consumeLinkToken(input: {\n  platform: string;\n  token: string;\n  externalUserId?: string | null;\n  externalUserName?: string | null;\n}) {\n  if (!input.externalUserId) {\n    throw new Error(\"Linking requires a platform user id\");\n  }\n\n  // Rate-limit failed attempts per (platform, externalUserId). Once\n  // tripped, all further attempts are short-circuited until the block\n  // window passes — including the lookup, so an attacker can't probe\n  // for valid tokens during the block.\n  const blockState = isLinkAttemptBlocked(input.platform, input.externalUserId);\n  if (blockState.blocked) {\n    throw new LinkRateLimitError(blockState.retryAfterMs);\n  }\n\n  const db = getDb();\n  const tokenRows = await db\n    .select()\n    .from(schema.dispatchLinkTokens)\n    .where(\n      and(\n        eq(schema.dispatchLinkTokens.platform, input.platform),\n        eq(schema.dispatchLinkTokens.token, input.token),\n      ),\n    )\n    .orderBy(desc(schema.dispatchLinkTokens.createdAt))\n    .limit(2);\n  if (tokenRows.length > 1) {\n    recordLinkFailure(input.platform, input.externalUserId);\n    throw new Error(\"Link token is ambiguous. Create a fresh token and retry.\");\n  }\n  const tokenRow = tokenRows[0];\n  if (!tokenRow) {\n    recordLinkFailure(input.platform, input.externalUserId);\n    throw new Error(\"Link token not found\");\n  }\n  if (tokenRow.claimedAt) {\n    recordLinkFailure(input.platform, input.externalUserId);\n    throw new Error(\"Link token has already been claimed\");\n  }\n  if (tokenRow.expiresAt < now()) {\n    recordLinkFailure(input.platform, input.externalUserId);\n    throw new Error(\"Link token has expired\");\n  }\n\n  const timestamp = now();\n  const [existing] = await db\n    .select()\n    .from(schema.dispatchIdentityLinks)\n    .where(\n      and(\n        eq(schema.dispatchIdentityLinks.platform, input.platform),\n        eq(schema.dispatchIdentityLinks.externalUserId, input.externalUserId),\n        tokenRow.orgId\n          ? eq(schema.dispatchIdentityLinks.orgId, tokenRow.orgId)\n          : isNull(schema.dispatchIdentityLinks.orgId),\n      ),\n    )\n    .limit(1);\n\n  if (existing) {\n    await db\n      .update(schema.dispatchIdentityLinks)\n      .set({\n        ownerEmail: tokenRow.ownerEmail,\n        orgId: tokenRow.orgId,\n        externalUserName: input.externalUserName || null,\n        linkedBy: tokenRow.createdBy,\n        updatedAt: timestamp,\n      })\n      .where(eq(schema.dispatchIdentityLinks.id, existing.id));\n  } else {\n    await db.insert(schema.dispatchIdentityLinks).values({\n      id: id(),\n      ownerEmail: tokenRow.ownerEmail,\n      orgId: tokenRow.orgId,\n      platform: input.platform,\n      externalUserId: input.externalUserId,\n      externalUserName: input.externalUserName || null,\n      linkedBy: tokenRow.createdBy,\n      createdAt: timestamp,\n      updatedAt: timestamp,\n    });\n  }\n\n  await db\n    .update(schema.dispatchLinkTokens)\n    .set({\n      claimedAt: timestamp,\n      claimedByExternalUserId: input.externalUserId,\n      claimedByExternalUserName: input.externalUserName || null,\n      updatedAt: timestamp,\n    })\n    .where(eq(schema.dispatchLinkTokens.id, tokenRow.id));\n\n  // Successful claim — reset the rate-limit budget so subsequent\n  // links from this external user start fresh.\n  clearLinkFailures(input.platform, input.externalUserId);\n\n  await recordAudit({\n    actor: tokenRow.createdBy,\n    ownerEmail: tokenRow.ownerEmail,\n    orgId: tokenRow.orgId,\n    action: \"identity.linked\",\n    targetType: \"identity-link\",\n    targetId: input.externalUserId,\n    summary: `Linked ${input.platform} user ${input.externalUserName || input.externalUserId}`,\n    metadata: input,\n  });\n\n  return tokenRow.ownerEmail;\n}\n\nexport async function listOverview() {\n  const [destinations, approvals, identities, audit, settings] =\n    await Promise.all([\n      listDestinations(),\n      listApprovalRequests(),\n      listIdentityState(),\n      listAuditEvents(12),\n      getApprovalPolicy(),\n    ]);\n\n  return {\n    counts: {\n      destinations: destinations.length,\n      pendingApprovals: approvals.filter((item) => item.status === \"pending\")\n        .length,\n      linkedIdentities: identities.links.length,\n      activeTokens: identities.tokens.filter(\n        (item) => !item.claimedAt && item.expiresAt > now(),\n      ).length,\n    },\n    recentDestinations: destinations.slice(0, 5),\n    recentApprovals: approvals.slice(0, 5),\n    recentAudit: audit.slice(0, 8),\n    settings,\n  };\n}\n"]}
+{"version":3,"file":"dispatch-store.js","sourceRoot":"","sources":["../../../src/server/lib/dispatch-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AACvD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,6EAA6E;AAC7E,EAAE;AACF,oFAAoF;AACpF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,kBAAkB;AAClB,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAO9B,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE5D,SAAS,cAAc,CACrB,QAAgB,EAChB,cAAyC;IAEzC,OAAO,GAAG,QAAQ,KAAK,cAAc,IAAI,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC1C,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,mDAAmD;IACnD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,GAAG,mBAAmB,CACzC,CAAC;IACF,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACjD,KAAK,CAAC,YAAY,GAAG,KAAK,GAAG,kBAAkB,CAAC;QAChD,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEf,YAAY;IAD/B,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAA4B,YAAoB;QAC9C,KAAK,CACH,+CAA+C,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAC7F,CAAC;4BAHwB,YAAY;IAIxC,CAAC;CACF;AAmBD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,eAAe,EAAE,IAAI,IAAI,CAAC;AACnC,CAAC;AAaD,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CACf,KAAQ,EACR,GAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,EAAE;IACT,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,GAAG;IACV,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI;QAC9B,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CACvB,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;YACH,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,KAAK,GAAG,iBAAiB,EAAE,EAC3B,KAAK,GAAG,YAAY,EAAE;IAEtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,EAAE,mBAAmB,EAAE;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,kBAAkB;QAC1B,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,qDAAqD;QACzD,QAAQ,EAAE,KAAK;QACf,KAAK;KACN,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA6B;IACnE,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,qBAAqB,CAAC;QAC3B,UAAU,EAAE,wBAAwB;QACpC,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,kCAAkC;QACtC,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KASjC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;QACjD,EAAE,EAAE,EAAE,EAAE;QACR,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE;QACnD,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE;QAC/D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,GAAG,EAAE;IAC9C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EAC9D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAC7C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;SACnD,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACjC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EAC/D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAC9C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACjC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAA+B,EAC/B,KAAK,GAAG,iBAAiB,EAAE,EAC3B,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;aACnC,GAAG,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF,CAAC;IACN,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;YAClD,EAAE,EAAE,aAAa;YACjB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,CAAC;QAChB,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB;QAChE,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,EAAE;QAC1F,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,aAAqB,EACrB,KAAK,GAAG,iBAAiB,EAAE,EAC3B,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACnC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF,CAAC;IACJ,MAAM,WAAW,CAAC;QAChB,KAAK;QACL,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,CAAC,IAAI,EAAE;QACpE,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,OAAe;IAC/D,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE9E,MAAM,KAAK,CAAC,uCAAuC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrD,OAAO,EAAE,6BAA6B;iBACvC;aACF;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACrB,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,GAAG,OAAO,uBAAuB,MAAM,YAAY;iBAC3D;aACF;YACD,WAAW,EAAE,EAAE,SAAS,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;QACtD,EAAE,EAAE,SAAS;QACb,UAAU,EAAE,iBAAiB,EAAE;QAC/B,KAAK,EAAE,YAAY,EAAE;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAChC,WAAW,EACT,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QACtE,UAAU,EACR,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QACpE,WAAW,EAAE,iBAAiB,EAAE;QAChC,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA+B;IACrE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;YAC1B,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,EAAE;YACxF,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,UAAU,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,CAAC,IAAI,EAAE;YACnE,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE;YAC9B,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EACnE,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;QAClD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAClD,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAgC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,sBAAsB,CAC3B,OAAO,EACP,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,sBAAsB,CAC3B,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,wBAAwB,EAAE,CAAC;QACpD,OAAO,mBAAmB,CACxB,OAAO,EACP,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CAAC,KAAK,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAClD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACzE,OAAO,0BAA0B,CAC/B,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB;IACpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,mBAAmB,GAAG,SAAS,GAAG,uBAAuB,CAAC;IAChE,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CACA,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,EACrD,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,EACtD,GAAG,CAAA,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,MAAM,mBAAmB,EAAE,CAC3E,CACF,CACF,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;aACvC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CACvD,CACF,CAAC;QACJ,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,iBAAiB,EAAE;QAC/B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CACvD,CACF;SACA,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9D,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAsB;IAC3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,iBAAiB,EAAE;QAC/B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CACtD,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE;KACvD,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,yDAAyD;IACzD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,EAAE,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;QAChD,EAAE,EAAE,QAAQ;QACZ,KAAK;QACL,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,YAAY,EAAE;QACrB,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC9C,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,IAAI;QAC7B,yBAAyB,EAAE,IAAI;QAC/B,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,6BAA6B;QACrC,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,WAAW,QAAQ,mBAAmB,KAAK,EAAE;QACtD,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;KAC9B,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,OAAO,EAAE,SAAS,KAAK,EAAE;QACzB,QAAQ;QACR,SAAS,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,CACjB,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,EAClD,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,CACtB,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,EAC/C,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAC5C,CAAC;IACF,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;aAClC,KAAK,CAAC,OAAO,CAAC;aACd,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACxD,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;aAC/B,KAAK,CAAC,YAAY,CAAC;aACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;KACtD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,cAA8B,EAC9B,OAAO,GAGH,EAAE;IAEN,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACnD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,EAC/D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnD,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEvD,wEAAwE;IACxE,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,YAAY,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACnD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,CAChE,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,EAAE,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,qCAAqC;IACrC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACtD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CACjD,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;SAClD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;QAC/B,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACzD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACrE,QAAQ,CAAC,KAAK;QACZ,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;aACpC,GAAG,CAAC;YACH,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,QAAQ,EAAE,QAAQ,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;YACnD,EAAE,EAAE,EAAE,EAAE;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,QAAQ,EAAE,QAAQ,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;SACjC,GAAG,CAAC;QACH,SAAS,EAAE,SAAS;QACpB,uBAAuB,EAAE,KAAK,CAAC,cAAc;QAC7C,yBAAyB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;QACzD,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAExD,+DAA+D;IAC/D,6CAA6C;IAC7C,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAExD,MAAM,WAAW,CAAC;QAChB,KAAK,EAAE,QAAQ,CAAC,SAAS;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,eAAe;QAC3B,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,OAAO,EAAE,UAAU,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,EAAE;QAC1F,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,UAAU,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,GAC1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,gBAAgB,EAAE;QAClB,oBAAoB,EAAE;QACtB,iBAAiB,EAAE;QACnB,eAAe,CAAC,EAAE,CAAC;QACnB,iBAAiB,EAAE;KACpB,CAAC,CAAC;IAEL,OAAO;QACL,MAAM,EAAE;YACN,YAAY,EAAE,YAAY,CAAC,MAAM;YACjC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;iBACpE,MAAM;YACT,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;YACzC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CACpD,CAAC,MAAM;SACT;QACD,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport { and, desc, eq, isNull, or, sql } from \"@agent-native/core/db/schema\";\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n} from \"@agent-native/core/server\";\nimport { getOrgSetting, putOrgSetting } from \"@agent-native/core/settings\";\n\nimport { getDb, schema } from \"../../db/index.js\";\n\nexport const SHARED_DISPATCH_OWNER = \"dispatch@shared\";\nconst APPROVAL_POLICY_KEY = \"dispatch-approval-policy\";\nconst APPROVAL_APPLY_LEASE_MS = 5 * 60 * 1000;\n\n// ─── /link rate limiting ──────────────────────────────────────────────────\n//\n// Failed `/link <token>` attempts are rate-limited per `(platform, externalUserId)`\n// to deter token brute-force after the H5 entropy bump. The window /\n// threshold are tuned so legitimate retries (typo, expired token) don't\n// trip the limit, while a scripted attacker burns out their per-account\n// budget quickly.\n//\n// State is process-local: works for the single-node dispatch deployment\n// we ship today. TODO: move to a SQL-backed counter table when dispatch\n// is sharded across multiple regions / processes — otherwise an\n// attacker can scale around the limit by hammering more than one node.\nconst LINK_FAIL_WINDOW_MS = 5 * 60 * 1000;\nconst LINK_FAIL_BLOCK_MS = 30 * 60 * 1000;\nconst LINK_FAIL_THRESHOLD = 5;\n\ninterface LinkFailureState {\n  failures: number[]; // unix-ms timestamps of recent failures within the window\n  blockedUntil: number; // unix-ms; 0 if not currently blocked\n}\n\nconst _linkFailureMap = new Map<string, LinkFailureState>();\n\nfunction linkFailureKey(\n  platform: string,\n  externalUserId: string | null | undefined,\n): string {\n  return `${platform}::${externalUserId ?? \"\"}`;\n}\n\nfunction getLinkFailureState(key: string): LinkFailureState {\n  let state = _linkFailureMap.get(key);\n  if (!state) {\n    state = { failures: [], blockedUntil: 0 };\n    _linkFailureMap.set(key, state);\n  }\n  return state;\n}\n\nfunction isLinkAttemptBlocked(\n  platform: string,\n  externalUserId: string | null | undefined,\n): { blocked: true; retryAfterMs: number } | { blocked: false } {\n  if (!externalUserId) return { blocked: false };\n  const key = linkFailureKey(platform, externalUserId);\n  const state = _linkFailureMap.get(key);\n  if (!state) return { blocked: false };\n  const nowMs = Date.now();\n  if (state.blockedUntil > nowMs) {\n    return { blocked: true, retryAfterMs: state.blockedUntil - nowMs };\n  }\n  return { blocked: false };\n}\n\nfunction recordLinkFailure(\n  platform: string,\n  externalUserId: string | null | undefined,\n): void {\n  if (!externalUserId) return;\n  const key = linkFailureKey(platform, externalUserId);\n  const state = getLinkFailureState(key);\n  const nowMs = Date.now();\n  // Drop expired failure timestamps before counting.\n  state.failures = state.failures.filter(\n    (ts) => nowMs - ts < LINK_FAIL_WINDOW_MS,\n  );\n  state.failures.push(nowMs);\n  if (state.failures.length >= LINK_FAIL_THRESHOLD) {\n    state.blockedUntil = nowMs + LINK_FAIL_BLOCK_MS;\n    state.failures = [];\n  }\n}\n\nfunction clearLinkFailures(\n  platform: string,\n  externalUserId: string | null | undefined,\n): void {\n  if (!externalUserId) return;\n  _linkFailureMap.delete(linkFailureKey(platform, externalUserId));\n}\n\n/**\n * 429-style error returned when /link attempts are rate-limited. The\n * adapter layer can branch on `code === \"LINK_RATE_LIMITED\"` to send a\n * platform-appropriate message back to the user.\n */\nexport class LinkRateLimitError extends Error {\n  readonly code = \"LINK_RATE_LIMITED\";\n  constructor(public readonly retryAfterMs: number) {\n    super(\n      `Too many failed link attempts. Try again in ${Math.ceil(retryAfterMs / 60_000)} minute(s).`,\n    );\n  }\n}\n\nexport interface DispatchApprovalPolicy {\n  enabled: boolean;\n  approverEmails: string[];\n}\n\nexport interface DispatchDestinationInput {\n  id?: string;\n  name: string;\n  platform: string;\n  destination: string;\n  threadRef?: string | null;\n  notes?: string | null;\n}\n\ntype DispatchApprovalRequest =\n  typeof schema.dispatchApprovalRequests.$inferSelect;\n\nexport function currentOwnerEmail(): string {\n  const email = getRequestUserEmail();\n  if (!email) throw new Error(\"no authenticated user\");\n  return email;\n}\n\nexport function currentOrgId(): string | null {\n  return getRequestOrgId() || null;\n}\n\n/**\n * Caller-supplied access context for dispatch operations that work by\n * id (destinations, etc.). Looking up a row by id alone is unsafe —\n * UUIDs are not authorization. A row matches the ctx if either the\n * caller owns it or it lives in the caller's active org.\n */\nexport interface DispatchCtx {\n  ownerEmail: string;\n  orgId: string | null;\n}\n\nexport function requireDispatchCtx(): DispatchCtx {\n  return { ownerEmail: currentOwnerEmail(), orgId: currentOrgId() };\n}\n\nfunction ctxScope<T extends { ownerEmail: any; orgId: any }>(\n  table: T,\n  ctx: DispatchCtx,\n) {\n  if (!ctx.orgId) {\n    return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\n  }\n  return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));\n}\n\nfunction id() {\n  return crypto.randomUUID();\n}\n\nfunction now() {\n  return Date.now();\n}\n\nfunction safeJson(value: unknown) {\n  return JSON.stringify(value ?? null);\n}\n\nexport async function getApprovalPolicy(): Promise<DispatchApprovalPolicy> {\n  const orgId = currentOrgId();\n  if (!orgId) return { enabled: false, approverEmails: [] };\n  const raw = await getOrgSetting(orgId, APPROVAL_POLICY_KEY);\n  return {\n    enabled: raw?.enabled === true,\n    approverEmails: Array.isArray(raw?.approverEmails)\n      ? raw.approverEmails.filter(\n          (value): value is string => typeof value === \"string\",\n        )\n      : [],\n  };\n}\n\nasync function applyApprovalPolicy(\n  input: DispatchApprovalPolicy,\n  actor = currentOwnerEmail(),\n  orgId = currentOrgId(),\n) {\n  if (!orgId) {\n    throw new Error(\n      \"Dispatch approval settings require an active organization\",\n    );\n  }\n  await putOrgSetting(orgId, APPROVAL_POLICY_KEY, {\n    enabled: input.enabled,\n    approverEmails: input.approverEmails,\n  });\n  await recordAudit({\n    action: \"settings.updated\",\n    targetType: \"dispatch-settings\",\n    targetId: APPROVAL_POLICY_KEY,\n    summary: input.enabled\n      ? \"Enabled approval flow for durable dispatch changes\"\n      : \"Disabled approval flow for durable dispatch changes\",\n    metadata: input,\n    actor,\n  });\n  return {\n    enabled: input.enabled,\n    approverEmails: input.approverEmails,\n  };\n}\n\nexport async function setApprovalPolicy(input: DispatchApprovalPolicy) {\n  const current = await getApprovalPolicy();\n  if (!current.enabled) {\n    return applyApprovalPolicy(input);\n  }\n  return createApprovalRequest({\n    changeType: \"approval-policy.update\",\n    targetType: \"dispatch-settings\",\n    targetId: APPROVAL_POLICY_KEY,\n    summary: input.enabled\n      ? \"Update dispatch approval policy\"\n      : \"Disable dispatch approval policy\",\n    payload: input,\n    beforeValue: current,\n    afterValue: input,\n  });\n}\n\nexport async function recordAudit(input: {\n  action: string;\n  targetType: string;\n  targetId?: string | null;\n  summary: string;\n  metadata?: unknown;\n  actor?: string;\n  ownerEmail?: string;\n  orgId?: string | null;\n}) {\n  const db = getDb();\n  const timestamp = now();\n  await db.insert(schema.dispatchAuditEvents).values({\n    id: id(),\n    ownerEmail: input.ownerEmail || currentOwnerEmail(),\n    orgId: input.orgId !== undefined ? input.orgId : currentOrgId(),\n    actor: input.actor || currentOwnerEmail(),\n    action: input.action,\n    targetType: input.targetType,\n    targetId: input.targetId || null,\n    summary: input.summary,\n    metadata: input.metadata ? safeJson(input.metadata) : null,\n    createdAt: timestamp,\n  });\n}\n\nexport async function listAuditEvents(limit = 50) {\n  const db = getDb();\n  const orgId = currentOrgId();\n  return db\n    .select()\n    .from(schema.dispatchAuditEvents)\n    .where(\n      and(\n        eq(schema.dispatchAuditEvents.ownerEmail, currentOwnerEmail()),\n        orgId\n          ? eq(schema.dispatchAuditEvents.orgId, orgId)\n          : isNull(schema.dispatchAuditEvents.orgId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchAuditEvents.createdAt))\n    .limit(limit);\n}\n\nexport async function listDestinations() {\n  const db = getDb();\n  const orgId = currentOrgId();\n  return db\n    .select()\n    .from(schema.dispatchDestinations)\n    .where(\n      and(\n        eq(schema.dispatchDestinations.ownerEmail, currentOwnerEmail()),\n        orgId\n          ? eq(schema.dispatchDestinations.orgId, orgId)\n          : isNull(schema.dispatchDestinations.orgId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchDestinations.updatedAt));\n}\n\nexport async function getDestinationById(\n  destinationId: string,\n  ctx: DispatchCtx = requireDispatchCtx(),\n) {\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.dispatchDestinations)\n    .where(\n      and(\n        eq(schema.dispatchDestinations.id, destinationId),\n        ctxScope(schema.dispatchDestinations, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nasync function applyDestinationUpsert(\n  input: DispatchDestinationInput,\n  actor = currentOwnerEmail(),\n  ctx: DispatchCtx = requireDispatchCtx(),\n) {\n  const db = getDb();\n  const timestamp = now();\n  const destinationId = input.id || id();\n  const existing = input.id ? await getDestinationById(input.id, ctx) : null;\n\n  if (existing) {\n    await db\n      .update(schema.dispatchDestinations)\n      .set({\n        name: input.name,\n        platform: input.platform,\n        destination: input.destination,\n        threadRef: input.threadRef || null,\n        notes: input.notes || null,\n        updatedAt: timestamp,\n      })\n      .where(\n        and(\n          eq(schema.dispatchDestinations.id, destinationId),\n          ctxScope(schema.dispatchDestinations, ctx),\n        ),\n      );\n  } else {\n    await db.insert(schema.dispatchDestinations).values({\n      id: destinationId,\n      ownerEmail: ctx.ownerEmail,\n      orgId: ctx.orgId,\n      name: input.name,\n      platform: input.platform,\n      destination: input.destination,\n      threadRef: input.threadRef || null,\n      notes: input.notes || null,\n      createdBy: actor,\n      createdAt: timestamp,\n      updatedAt: timestamp,\n    });\n  }\n\n  await recordAudit({\n    actor,\n    action: existing ? \"destination.updated\" : \"destination.created\",\n    targetType: \"destination\",\n    targetId: destinationId,\n    summary: `${existing ? \"Updated\" : \"Created\"} ${input.platform} destination ${input.name}`,\n    metadata: input,\n  });\n\n  return getDestinationById(destinationId, ctx);\n}\n\nasync function applyDestinationDelete(\n  destinationId: string,\n  actor = currentOwnerEmail(),\n  ctx: DispatchCtx = requireDispatchCtx(),\n) {\n  const db = getDb();\n  const existing = await getDestinationById(destinationId, ctx);\n  if (!existing) {\n    throw new Error(\"Destination not found\");\n  }\n  await db\n    .delete(schema.dispatchDestinations)\n    .where(\n      and(\n        eq(schema.dispatchDestinations.id, destinationId),\n        ctxScope(schema.dispatchDestinations, ctx),\n      ),\n    );\n  await recordAudit({\n    actor,\n    action: \"destination.deleted\",\n    targetType: \"destination\",\n    targetId: destinationId,\n    summary: `Deleted ${existing.platform} destination ${existing.name}`,\n    metadata: existing,\n  });\n  return existing;\n}\n\nasync function notifyApprovers(requestId: string, summary: string) {\n  const policy = await getApprovalPolicy();\n  const apiKey = process.env.SENDGRID_API_KEY;\n  const from = process.env.SENDGRID_FROM_EMAIL;\n  const appUrl = process.env.APP_URL;\n  if (!apiKey || !from || !appUrl || policy.approverEmails.length === 0) return;\n\n  await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      personalizations: [\n        {\n          to: policy.approverEmails.map((email) => ({ email })),\n          subject: \"Dispatch approval requested\",\n        },\n      ],\n      from: { email: from },\n      content: [\n        {\n          type: \"text/plain\",\n          value: `${summary}\\n\\nReview it here: ${appUrl}/approvals`,\n        },\n      ],\n      custom_args: { requestId },\n    }),\n  }).catch(() => {});\n}\n\nexport async function createApprovalRequest(input: {\n  changeType: string;\n  targetType: string;\n  targetId?: string | null;\n  summary: string;\n  payload: unknown;\n  beforeValue?: unknown;\n  afterValue?: unknown;\n}) {\n  const db = getDb();\n  const timestamp = now();\n  const requestId = id();\n  await db.insert(schema.dispatchApprovalRequests).values({\n    id: requestId,\n    ownerEmail: currentOwnerEmail(),\n    orgId: currentOrgId(),\n    changeType: input.changeType,\n    targetType: input.targetType,\n    targetId: input.targetId || null,\n    status: \"pending\",\n    summary: input.summary,\n    payload: safeJson(input.payload),\n    beforeValue:\n      input.beforeValue === undefined ? null : safeJson(input.beforeValue),\n    afterValue:\n      input.afterValue === undefined ? null : safeJson(input.afterValue),\n    requestedBy: currentOwnerEmail(),\n    reviewedBy: null,\n    reviewedAt: null,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n  await recordAudit({\n    action: \"approval.requested\",\n    targetType: input.targetType,\n    targetId: input.targetId || requestId,\n    summary: input.summary,\n    metadata: input,\n  });\n  await notifyApprovers(requestId, input.summary);\n  return getApprovalRequest(requestId);\n}\n\nexport async function upsertDestination(input: DispatchDestinationInput) {\n  const policy = await getApprovalPolicy();\n  if (policy.enabled) {\n    const existing = input.id ? await getDestinationById(input.id) : null;\n    return createApprovalRequest({\n      changeType: \"destination.upsert\",\n      targetType: \"destination\",\n      targetId: input.id || null,\n      summary: `${existing ? \"Update\" : \"Create\"} ${input.platform} destination ${input.name}`,\n      payload: input,\n      beforeValue: existing,\n      afterValue: input,\n    });\n  }\n  return applyDestinationUpsert(input);\n}\n\nexport async function deleteDestination(destinationId: string) {\n  const policy = await getApprovalPolicy();\n  const existing = await getDestinationById(destinationId);\n  if (!existing) {\n    throw new Error(\"Destination not found\");\n  }\n  if (policy.enabled) {\n    return createApprovalRequest({\n      changeType: \"destination.delete\",\n      targetType: \"destination\",\n      targetId: destinationId,\n      summary: `Delete ${existing.platform} destination ${existing.name}`,\n      payload: { id: destinationId },\n      beforeValue: existing,\n      afterValue: null,\n    });\n  }\n  return applyDestinationDelete(destinationId);\n}\n\nexport async function listApprovalRequests() {\n  const db = getDb();\n  const orgId = currentOrgId();\n  return db\n    .select()\n    .from(schema.dispatchApprovalRequests)\n    .where(\n      and(\n        eq(schema.dispatchApprovalRequests.ownerEmail, currentOwnerEmail()),\n        orgId\n          ? eq(schema.dispatchApprovalRequests.orgId, orgId)\n          : isNull(schema.dispatchApprovalRequests.orgId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchApprovalRequests.updatedAt));\n}\n\nasync function getApprovalRequest(\n  requestId: string,\n  ctx: DispatchCtx = requireDispatchCtx(),\n) {\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.dispatchApprovalRequests)\n    .where(\n      and(\n        eq(schema.dispatchApprovalRequests.id, requestId),\n        ctxScope(schema.dispatchApprovalRequests, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nasync function applyApprovedRequest(request: DispatchApprovalRequest) {\n  const payload = JSON.parse(request.payload);\n  const requestCtx = {\n    ownerEmail: request.ownerEmail,\n    orgId: request.orgId,\n  };\n  if (request.changeType === \"destination.upsert\") {\n    return applyDestinationUpsert(\n      payload,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"destination.delete\") {\n    return applyDestinationDelete(\n      payload.id,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"approval-policy.update\") {\n    return applyApprovalPolicy(\n      payload,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx.orgId,\n    );\n  }\n  if (request.changeType === \"dream-proposal.apply\") {\n    const { applyApprovedDreamProposal } = await import(\"./dreams-store.js\");\n    return applyApprovedDreamProposal(\n      payload.proposalId,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"workspace-resource.create\") {\n    const { applyWorkspaceResourceCreate } =\n      await import(\"./workspace-resources-store.js\");\n    return applyWorkspaceResourceCreate(\n      payload.input,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"workspace-resource.update\") {\n    const { applyWorkspaceResourceUpdate } =\n      await import(\"./workspace-resources-store.js\");\n    return applyWorkspaceResourceUpdate(\n      payload.id,\n      payload.input,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  if (request.changeType === \"workspace-resource.delete\") {\n    const { applyWorkspaceResourceDelete } =\n      await import(\"./workspace-resources-store.js\");\n    return applyWorkspaceResourceDelete(\n      payload.id,\n      request.reviewedBy || currentOwnerEmail(),\n      requestCtx,\n    );\n  }\n  throw new Error(`Unsupported approval request type: ${request.changeType}`);\n}\n\nexport async function approveRequest(requestId: string) {\n  const db = getDb();\n  const ctx = requireDispatchCtx();\n  const request = await getApprovalRequest(requestId, ctx);\n  if (!request) throw new Error(\"Approval request not found\");\n\n  const timestamp = now();\n  const staleApplyingBefore = timestamp - APPROVAL_APPLY_LEASE_MS;\n  // Fence the transition on the current status so a concurrent approve can't\n  // both win. A crashed worker can leave its lease in \"applying\", so reclaim\n  // only a lease that has been idle for the full lease interval.\n  const claimed = await db\n    .update(schema.dispatchApprovalRequests)\n    .set({\n      status: \"applying\",\n      updatedAt: timestamp,\n    })\n    .where(\n      and(\n        eq(schema.dispatchApprovalRequests.id, requestId),\n        ctxScope(schema.dispatchApprovalRequests, ctx),\n        or(\n          eq(schema.dispatchApprovalRequests.status, \"pending\"),\n          and(\n            eq(schema.dispatchApprovalRequests.status, \"applying\"),\n            sql`${schema.dispatchApprovalRequests.updatedAt} < ${staleApplyingBefore}`,\n          ),\n        ),\n      ),\n    )\n    .returning();\n\n  if (claimed.length === 0) {\n    const current = (await getApprovalRequest(requestId, ctx)) ?? request;\n    if (current.status === \"applying\") {\n      throw new Error(\"Approval is already being applied\");\n    }\n    return current;\n  }\n\n  const applying = claimed[0];\n  try {\n    await applyApprovedRequest(applying);\n  } catch (error) {\n    // Applying a request can have succeeded partially before throwing. Do not\n    // return it to pending: that would allow an immediate retry to duplicate a\n    // non-idempotent effect. Keep the lease until it becomes stale, which\n    // serializes any recovery attempt behind the same fencing rule.\n    await db\n      .update(schema.dispatchApprovalRequests)\n      .set({ updatedAt: now() })\n      .where(\n        and(\n          eq(schema.dispatchApprovalRequests.id, requestId),\n          ctxScope(schema.dispatchApprovalRequests, ctx),\n          eq(schema.dispatchApprovalRequests.status, \"applying\"),\n        ),\n      );\n    throw error;\n  }\n  const [updated] = await db\n    .update(schema.dispatchApprovalRequests)\n    .set({\n      status: \"approved\",\n      reviewedBy: currentOwnerEmail(),\n      reviewedAt: timestamp,\n      updatedAt: now(),\n    })\n    .where(\n      and(\n        eq(schema.dispatchApprovalRequests.id, requestId),\n        ctxScope(schema.dispatchApprovalRequests, ctx),\n        eq(schema.dispatchApprovalRequests.status, \"applying\"),\n      ),\n    )\n    .returning();\n  if (!updated) throw new Error(\"Approval request disappeared\");\n  await recordAudit({\n    action: \"approval.approved\",\n    targetType: updated.targetType,\n    targetId: requestId,\n    summary: `Approved ${updated.summary}`,\n    metadata: updated,\n  });\n  return updated;\n}\n\nexport async function rejectRequest(requestId: string, reason?: string | null) {\n  const db = getDb();\n  const ctx = requireDispatchCtx();\n  const request = await getApprovalRequest(requestId, ctx);\n  if (!request) throw new Error(\"Approval request not found\");\n\n  const timestamp = now();\n  const claimed = await db\n    .update(schema.dispatchApprovalRequests)\n    .set({\n      status: \"rejected\",\n      reviewedBy: currentOwnerEmail(),\n      reviewedAt: timestamp,\n      updatedAt: timestamp,\n    })\n    .where(\n      and(\n        eq(schema.dispatchApprovalRequests.id, requestId),\n        ctxScope(schema.dispatchApprovalRequests, ctx),\n        eq(schema.dispatchApprovalRequests.status, \"pending\"),\n      ),\n    )\n    .returning();\n\n  if (claimed.length === 0) {\n    return (await getApprovalRequest(requestId, ctx)) ?? request;\n  }\n\n  const updated = claimed[0];\n  await recordAudit({\n    action: \"approval.rejected\",\n    targetType: updated.targetType,\n    targetId: requestId,\n    summary: `Rejected ${updated.summary}`,\n    metadata: { request: updated, reason: reason || null },\n  });\n  return updated;\n}\n\nexport async function createLinkToken(platform: string) {\n  const db = getDb();\n  const timestamp = now();\n  // 16 bytes = 128 bits of entropy. Previous size was 4 bytes (32 bits,\n  // ~4.29 billion keyspace) which is brute-forceable in well under an\n  // hour given a 7-day expiry and no rate limiting on /link attempts.\n  // Old 8-hex-char tokens minted before this change continue to verify\n  // until they expire; we don't migrate retroactively. See\n  // /tmp/security-audit/07-webhooks.md (H5).\n  const token = crypto.randomBytes(16).toString(\"hex\");\n  const recordId = id();\n  const owner = currentOwnerEmail();\n  await db.insert(schema.dispatchLinkTokens).values({\n    id: recordId,\n    token,\n    ownerEmail: owner,\n    orgId: currentOrgId(),\n    platform,\n    createdBy: owner,\n    expiresAt: timestamp + 7 * 24 * 60 * 60 * 1000,\n    claimedAt: null,\n    claimedByExternalUserId: null,\n    claimedByExternalUserName: null,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n  await recordAudit({\n    action: \"identity.link-token-created\",\n    targetType: \"link-token\",\n    targetId: recordId,\n    summary: `Created ${platform} link token for ${owner}`,\n    metadata: { token, platform },\n  });\n  return {\n    token,\n    command: `/link ${token}`,\n    platform,\n    expiresAt: timestamp + 7 * 24 * 60 * 60 * 1000,\n  };\n}\n\nexport async function listIdentityState() {\n  const db = getDb();\n  const owner = currentOwnerEmail();\n  const orgId = currentOrgId();\n  const filters = and(\n    eq(schema.dispatchIdentityLinks.ownerEmail, owner),\n    orgId\n      ? eq(schema.dispatchIdentityLinks.orgId, orgId)\n      : isNull(schema.dispatchIdentityLinks.orgId),\n  );\n  const tokenFilters = and(\n    eq(schema.dispatchLinkTokens.ownerEmail, owner),\n    orgId\n      ? eq(schema.dispatchLinkTokens.orgId, orgId)\n      : isNull(schema.dispatchLinkTokens.orgId),\n  );\n  const [links, tokens] = await Promise.all([\n    db\n      .select()\n      .from(schema.dispatchIdentityLinks)\n      .where(filters)\n      .orderBy(desc(schema.dispatchIdentityLinks.updatedAt)),\n    db\n      .select()\n      .from(schema.dispatchLinkTokens)\n      .where(tokenFilters)\n      .orderBy(desc(schema.dispatchLinkTokens.updatedAt)),\n  ]);\n  return { links, tokens };\n}\n\nexport async function resolveLinkedOwner(\n  platform: string,\n  externalUserId?: string | null,\n  options: {\n    orgId?: string | null;\n    allowAnyOrgFallback?: boolean;\n  } = {},\n) {\n  if (!externalUserId) return null;\n  const db = getDb();\n  const orgId = options.orgId !== undefined ? options.orgId : currentOrgId();\n  const rows = await db\n    .select()\n    .from(schema.dispatchIdentityLinks)\n    .where(\n      and(\n        eq(schema.dispatchIdentityLinks.platform, platform),\n        eq(schema.dispatchIdentityLinks.externalUserId, externalUserId),\n        orgId\n          ? eq(schema.dispatchIdentityLinks.orgId, orgId)\n          : isNull(schema.dispatchIdentityLinks.orgId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchIdentityLinks.updatedAt))\n    .limit(1);\n  if (rows[0]?.ownerEmail) return rows[0].ownerEmail;\n\n  if (!options.allowAnyOrgFallback || orgId) return null;\n\n  // Webhook processors run outside a normal request/org context. A linked\n  // Slack/Telegram identity may still be scoped to an org, so fall back to any\n  // org only when every matching link resolves to the same owner.\n  const fallbackRows = await db\n    .select()\n    .from(schema.dispatchIdentityLinks)\n    .where(\n      and(\n        eq(schema.dispatchIdentityLinks.platform, platform),\n        eq(schema.dispatchIdentityLinks.externalUserId, externalUserId),\n      ),\n    )\n    .orderBy(desc(schema.dispatchIdentityLinks.updatedAt))\n    .limit(25);\n  const owners = new Set(fallbackRows.map((row) => row.ownerEmail));\n  return owners.size === 1 ? fallbackRows[0]?.ownerEmail || null : null;\n}\n\nexport async function consumeLinkToken(input: {\n  platform: string;\n  token: string;\n  externalUserId?: string | null;\n  externalUserName?: string | null;\n}) {\n  if (!input.externalUserId) {\n    throw new Error(\"Linking requires a platform user id\");\n  }\n\n  // Rate-limit failed attempts per (platform, externalUserId). Once\n  // tripped, all further attempts are short-circuited until the block\n  // window passes — including the lookup, so an attacker can't probe\n  // for valid tokens during the block.\n  const blockState = isLinkAttemptBlocked(input.platform, input.externalUserId);\n  if (blockState.blocked) {\n    throw new LinkRateLimitError(blockState.retryAfterMs);\n  }\n\n  const db = getDb();\n  const tokenRows = await db\n    .select()\n    .from(schema.dispatchLinkTokens)\n    .where(\n      and(\n        eq(schema.dispatchLinkTokens.platform, input.platform),\n        eq(schema.dispatchLinkTokens.token, input.token),\n      ),\n    )\n    .orderBy(desc(schema.dispatchLinkTokens.createdAt))\n    .limit(2);\n  if (tokenRows.length > 1) {\n    recordLinkFailure(input.platform, input.externalUserId);\n    throw new Error(\"Link token is ambiguous. Create a fresh token and retry.\");\n  }\n  const tokenRow = tokenRows[0];\n  if (!tokenRow) {\n    recordLinkFailure(input.platform, input.externalUserId);\n    throw new Error(\"Link token not found\");\n  }\n  if (tokenRow.claimedAt) {\n    recordLinkFailure(input.platform, input.externalUserId);\n    throw new Error(\"Link token has already been claimed\");\n  }\n  if (tokenRow.expiresAt < now()) {\n    recordLinkFailure(input.platform, input.externalUserId);\n    throw new Error(\"Link token has expired\");\n  }\n\n  const timestamp = now();\n  const [existing] = await db\n    .select()\n    .from(schema.dispatchIdentityLinks)\n    .where(\n      and(\n        eq(schema.dispatchIdentityLinks.platform, input.platform),\n        eq(schema.dispatchIdentityLinks.externalUserId, input.externalUserId),\n        tokenRow.orgId\n          ? eq(schema.dispatchIdentityLinks.orgId, tokenRow.orgId)\n          : isNull(schema.dispatchIdentityLinks.orgId),\n      ),\n    )\n    .limit(1);\n\n  if (existing) {\n    await db\n      .update(schema.dispatchIdentityLinks)\n      .set({\n        ownerEmail: tokenRow.ownerEmail,\n        orgId: tokenRow.orgId,\n        externalUserName: input.externalUserName || null,\n        linkedBy: tokenRow.createdBy,\n        updatedAt: timestamp,\n      })\n      .where(eq(schema.dispatchIdentityLinks.id, existing.id));\n  } else {\n    await db.insert(schema.dispatchIdentityLinks).values({\n      id: id(),\n      ownerEmail: tokenRow.ownerEmail,\n      orgId: tokenRow.orgId,\n      platform: input.platform,\n      externalUserId: input.externalUserId,\n      externalUserName: input.externalUserName || null,\n      linkedBy: tokenRow.createdBy,\n      createdAt: timestamp,\n      updatedAt: timestamp,\n    });\n  }\n\n  await db\n    .update(schema.dispatchLinkTokens)\n    .set({\n      claimedAt: timestamp,\n      claimedByExternalUserId: input.externalUserId,\n      claimedByExternalUserName: input.externalUserName || null,\n      updatedAt: timestamp,\n    })\n    .where(eq(schema.dispatchLinkTokens.id, tokenRow.id));\n\n  // Successful claim — reset the rate-limit budget so subsequent\n  // links from this external user start fresh.\n  clearLinkFailures(input.platform, input.externalUserId);\n\n  await recordAudit({\n    actor: tokenRow.createdBy,\n    ownerEmail: tokenRow.ownerEmail,\n    orgId: tokenRow.orgId,\n    action: \"identity.linked\",\n    targetType: \"identity-link\",\n    targetId: input.externalUserId,\n    summary: `Linked ${input.platform} user ${input.externalUserName || input.externalUserId}`,\n    metadata: input,\n  });\n\n  return tokenRow.ownerEmail;\n}\n\nexport async function listOverview() {\n  const [destinations, approvals, identities, audit, settings] =\n    await Promise.all([\n      listDestinations(),\n      listApprovalRequests(),\n      listIdentityState(),\n      listAuditEvents(12),\n      getApprovalPolicy(),\n    ]);\n\n  return {\n    counts: {\n      destinations: destinations.length,\n      pendingApprovals: approvals.filter((item) => item.status === \"pending\")\n        .length,\n      linkedIdentities: identities.links.length,\n      activeTokens: identities.tokens.filter(\n        (item) => !item.claimedAt && item.expiresAt > now(),\n      ).length,\n    },\n    recentDestinations: destinations.slice(0, 5),\n    recentApprovals: approvals.slice(0, 5),\n    recentAudit: audit.slice(0, 8),\n    settings,\n  };\n}\n"]}

package/dist/server/lib/mcp-access-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-access-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,eAAe,CAAC;AAEpE,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoBD,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAc9B;AAUD,wBAAsB,+BAA+B,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAO7F;AAED,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,IAAI,EAAE,wBAAwB,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAexC;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,4BAA4B,GACrC,OAAO,CAKT"}
+{"version":3,"file":"mcp-access-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,eAAe,CAAC;AAEpE,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8BD,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAe9B;AAgCD,wBAAsB,+BAA+B,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAO7F;AAED,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,IAAI,EAAE,wBAAwB,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAgBxC;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,4BAA4B,GACrC,OAAO,CAKT"}

package/dist/server/lib/mcp-access-store.js

@@ -1,6 +1,15 @@
+import { getDbExec } from "@agent-native/core/db";
 import { getRequestOrgId, getRequestUserEmail, } from "@agent-native/core/server";
 import { getOrgSetting, getUserSetting, putOrgSetting, putUserSetting, } from "@agent-native/core/settings";
 export const MCP_APP_ACCESS_SETTINGS_KEY = "dispatch-mcp-app-access";
+class McpAppAccessError extends Error {
+    statusCode;
+    constructor(message, statusCode) {
+        super(message);
+        this.name = "McpAppAccessError";
+        this.statusCode = statusCode;
+    }
+}
 function uniqueAppIds(values) {
     const input = Array.isArray(values) ? values : [];
     return Array.from(new Set(input
@@ -12,10 +21,10 @@ export function normalizeMcpAppAccessSettings(raw) {
     const record = raw && typeof raw === "object" && !Array.isArray(raw)
         ? raw
         : {};
-    const mode = record.mode === "selected-apps" ? "selected-apps" : "all-apps";
+    const mode = record.mode === "all-apps" ? "all-apps" : "selected-apps";
     return {
         mode,
-        selectedAppIds: uniqueAppIds(record.selectedAppIds),
+        selectedAppIds: raw == null ? ["dispatch"] : uniqueAppIds(record.selectedAppIds),
         updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : undefined,
         updatedBy: typeof record.updatedBy === "string" ? record.updatedBy : undefined,
     };
@@ -29,6 +38,24 @@ function currentAccessScope() {
         return { kind: "org", id: orgId, actor };
     return { kind: "user", id: actor, actor };
 }
+async function assertCanManageMcpAppAccess(scope) {
+    if (scope.kind === "user")
+        return;
+    let role = null;
+    try {
+        const { rows } = await getDbExec().execute({
+            sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+            args: [scope.id, scope.actor.toLowerCase()],
+        });
+        role = rows[0]?.role;
+    }
+    catch {
+        // Fail closed when org membership cannot be verified.
+    }
+    if (role !== "owner" && role !== "admin") {
+        throw new McpAppAccessError("Only organization owners and admins can change Dispatch MCP app access.", 403);
+    }
+}
 export async function getDispatchMcpAppAccessSettings() {
     const scope = currentAccessScope();
     const raw = scope.kind === "org"
@@ -38,6 +65,7 @@ export async function getDispatchMcpAppAccessSettings() {
 }
 export async function setDispatchMcpAppAccessSettings(input) {
     const scope = currentAccessScope();
+    await assertCanManageMcpAppAccess(scope);
     const next = {
         mode: input.mode,
         selectedAppIds: uniqueAppIds(input.selectedAppIds),

package/dist/server/lib/mcp-access-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-access-store.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAiBrE,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,KAAK;SACF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAY;IAEZ,MAAM,MAAM,GACV,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5E,OAAO;QACL,IAAI;QACJ,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QACnD,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACrE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B;IACnD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC;QAC5D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAClE,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAiC;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,KAAK;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,IAA0C,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAsC;IAEtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport {\n  getOrgSetting,\n  getUserSetting,\n  putOrgSetting,\n  putUserSetting,\n} from \"@agent-native/core/settings\";\n\nexport const MCP_APP_ACCESS_SETTINGS_KEY = \"dispatch-mcp-app-access\";\n\nexport type DispatchMcpAppAccessMode = \"all-apps\" | \"selected-apps\";\n\nexport interface DispatchMcpAppAccessSettings {\n  mode: DispatchMcpAppAccessMode;\n  selectedAppIds: string[];\n  updatedAt?: string;\n  updatedBy?: string;\n}\n\ninterface AccessScope {\n  kind: \"org\" | \"user\";\n  id: string;\n  actor: string;\n}\n\nfunction uniqueAppIds(values: unknown): string[] {\n  const input = Array.isArray(values) ? values : [];\n  return Array.from(\n    new Set(\n      input\n        .filter((value): value is string => typeof value === \"string\")\n        .map((value) => value.trim().toLowerCase())\n        .filter(Boolean),\n    ),\n  );\n}\n\nexport function normalizeMcpAppAccessSettings(\n  raw: unknown,\n): DispatchMcpAppAccessSettings {\n  const record =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? (raw as Record<string, unknown>)\n      : {};\n  const mode = record.mode === \"selected-apps\" ? \"selected-apps\" : \"all-apps\";\n  return {\n    mode,\n    selectedAppIds: uniqueAppIds(record.selectedAppIds),\n    updatedAt:\n      typeof record.updatedAt === \"string\" ? record.updatedAt : undefined,\n    updatedBy:\n      typeof record.updatedBy === \"string\" ? record.updatedBy : undefined,\n  };\n}\n\nfunction currentAccessScope(): AccessScope {\n  const actor = getRequestUserEmail();\n  if (!actor) throw new Error(\"no authenticated user\");\n  const orgId = getRequestOrgId();\n  if (orgId) return { kind: \"org\", id: orgId, actor };\n  return { kind: \"user\", id: actor, actor };\n}\n\nexport async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {\n  const scope = currentAccessScope();\n  const raw =\n    scope.kind === \"org\"\n      ? await getOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY)\n      : await getUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY);\n  return normalizeMcpAppAccessSettings(raw);\n}\n\nexport async function setDispatchMcpAppAccessSettings(input: {\n  mode: DispatchMcpAppAccessMode;\n  selectedAppIds?: string[];\n}): Promise<DispatchMcpAppAccessSettings> {\n  const scope = currentAccessScope();\n  const next: DispatchMcpAppAccessSettings = {\n    mode: input.mode,\n    selectedAppIds: uniqueAppIds(input.selectedAppIds),\n    updatedAt: new Date().toISOString(),\n    updatedBy: scope.actor,\n  };\n  const value = next as unknown as Record<string, unknown>;\n  if (scope.kind === \"org\") {\n    await putOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n  } else {\n    await putUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n  }\n  return next;\n}\n\nexport function isAppAllowedByMcpAccess(\n  appId: string,\n  settings: DispatchMcpAppAccessSettings,\n): boolean {\n  const normalized = appId.trim().toLowerCase();\n  if (!normalized) return false;\n  if (settings.mode === \"all-apps\") return true;\n  return settings.selectedAppIds.includes(normalized);\n}\n"]}
+{"version":3,"file":"mcp-access-store.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAWrE,MAAM,iBAAkB,SAAQ,KAAK;IACnC,UAAU,CAAS;IAEnB,YAAY,OAAe,EAAE,UAAkB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAQD,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,KAAK;SACF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAY;IAEZ,MAAM,MAAM,GACV,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;IACvE,OAAO;QACL,IAAI;QACJ,cAAc,EACZ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QAClE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACrE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAAkB;IAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IAElC,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CACzB,yEAAyE,EACzE,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B;IACnD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC;QAC5D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAClE,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAiC;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,KAAK;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,IAA0C,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAsC;IAEtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import { getDbExec } from \"@agent-native/core/db\";\nimport {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport {\n  getOrgSetting,\n  getUserSetting,\n  putOrgSetting,\n  putUserSetting,\n} from \"@agent-native/core/settings\";\n\nexport const MCP_APP_ACCESS_SETTINGS_KEY = \"dispatch-mcp-app-access\";\n\nexport type DispatchMcpAppAccessMode = \"all-apps\" | \"selected-apps\";\n\nexport interface DispatchMcpAppAccessSettings {\n  mode: DispatchMcpAppAccessMode;\n  selectedAppIds: string[];\n  updatedAt?: string;\n  updatedBy?: string;\n}\n\nclass McpAppAccessError extends Error {\n  statusCode: number;\n\n  constructor(message: string, statusCode: number) {\n    super(message);\n    this.name = \"McpAppAccessError\";\n    this.statusCode = statusCode;\n  }\n}\n\ninterface AccessScope {\n  kind: \"org\" | \"user\";\n  id: string;\n  actor: string;\n}\n\nfunction uniqueAppIds(values: unknown): string[] {\n  const input = Array.isArray(values) ? values : [];\n  return Array.from(\n    new Set(\n      input\n        .filter((value): value is string => typeof value === \"string\")\n        .map((value) => value.trim().toLowerCase())\n        .filter(Boolean),\n    ),\n  );\n}\n\nexport function normalizeMcpAppAccessSettings(\n  raw: unknown,\n): DispatchMcpAppAccessSettings {\n  const record =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? (raw as Record<string, unknown>)\n      : {};\n  const mode = record.mode === \"all-apps\" ? \"all-apps\" : \"selected-apps\";\n  return {\n    mode,\n    selectedAppIds:\n      raw == null ? [\"dispatch\"] : uniqueAppIds(record.selectedAppIds),\n    updatedAt:\n      typeof record.updatedAt === \"string\" ? record.updatedAt : undefined,\n    updatedBy:\n      typeof record.updatedBy === \"string\" ? record.updatedBy : undefined,\n  };\n}\n\nfunction currentAccessScope(): AccessScope {\n  const actor = getRequestUserEmail();\n  if (!actor) throw new Error(\"no authenticated user\");\n  const orgId = getRequestOrgId();\n  if (orgId) return { kind: \"org\", id: orgId, actor };\n  return { kind: \"user\", id: actor, actor };\n}\n\nasync function assertCanManageMcpAppAccess(scope: AccessScope): Promise<void> {\n  if (scope.kind === \"user\") return;\n\n  let role: unknown = null;\n  try {\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n      args: [scope.id, scope.actor.toLowerCase()],\n    });\n    role = rows[0]?.role;\n  } catch {\n    // Fail closed when org membership cannot be verified.\n  }\n\n  if (role !== \"owner\" && role !== \"admin\") {\n    throw new McpAppAccessError(\n      \"Only organization owners and admins can change Dispatch MCP app access.\",\n      403,\n    );\n  }\n}\n\nexport async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {\n  const scope = currentAccessScope();\n  const raw =\n    scope.kind === \"org\"\n      ? await getOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY)\n      : await getUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY);\n  return normalizeMcpAppAccessSettings(raw);\n}\n\nexport async function setDispatchMcpAppAccessSettings(input: {\n  mode: DispatchMcpAppAccessMode;\n  selectedAppIds?: string[];\n}): Promise<DispatchMcpAppAccessSettings> {\n  const scope = currentAccessScope();\n  await assertCanManageMcpAppAccess(scope);\n  const next: DispatchMcpAppAccessSettings = {\n    mode: input.mode,\n    selectedAppIds: uniqueAppIds(input.selectedAppIds),\n    updatedAt: new Date().toISOString(),\n    updatedBy: scope.actor,\n  };\n  const value = next as unknown as Record<string, unknown>;\n  if (scope.kind === \"org\") {\n    await putOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n  } else {\n    await putUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n  }\n  return next;\n}\n\nexport function isAppAllowedByMcpAccess(\n  appId: string,\n  settings: DispatchMcpAppAccessSettings,\n): boolean {\n  const normalized = appId.trim().toLowerCase();\n  if (!normalized) return false;\n  if (settings.mode === \"all-apps\") return true;\n  return settings.selectedAppIds.includes(normalized);\n}\n"]}

package/dist/server/lib/vault-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/vault-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,4BAA4B,CAAC;AASpC,OAAO,EAAS,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAUlD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAM1C;AA0DD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiBrE;AAoBD,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAU3E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,IAAI,EAAE,eAAe,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmB/B;AAID,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,iBAcA;AAED,wBAAsB,cAAc,CAAC,KAAK,SAAK;;;;;;;;;;;KAQ9C;AAID,wBAAsB,WAAW;;;;;;;;;;;;KAOhC;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ;;;;;;;;;;;;GAa9D;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE;IACL,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACD,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAmGlC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EACD,MAAM,GACN;IACE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACL,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAsGlC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAwClC;AAID,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;;;;;;;;;;;KAcA;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,QAA4B;;;;;;;;;;;GAclC;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;GAuClC;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;;;;;;;;;;;GAkClC;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,QAA4B;;;;;;;;;;;GAkClC;AAID,KAAK,cAAc,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC;AAE9D,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,QAAQ,GAAG;IAC9D,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB,CAGA;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,cAAc,EAAE,EACzB,GAAG,EAAE,QAAQ;WATN,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,WAAW,CAAC;aACvC,MAAM;;GA0BhB;AAED,wBAAsB,mCAAmC,CACvD,GAAG,EAAE,QAAQ,EACb,aAAa,CAAC,EAAE,MAAM,EAAE,iBA+BzB;AAID,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;;;QAsH7B,KAAK;QACL,OAAO;QACP,MAAM;;;gBA/EI,QAAQ;cAAQ,MAAM,EAAE;;gBACxB,SAAS;gBAAU,MAAM;;gBACzB,QAAQ;gBAAU,MAAM;;GAiFvC;AAID,wBAAsB,YAAY,CAAC,MAAM,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;KAW9D;AAED,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAclC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;;;;;;;;;;;;;GA+BA;AAED,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAoElC;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAmClC;AAID,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAkF1E;AAID,wBAAsB,iBAAiB;;;;;;GAiBtC"}
+{"version":3,"file":"vault-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/vault-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,4BAA4B,CAAC;AASpC,OAAO,EAAS,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAUlD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAM1C;AA0DD,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiBrE;AAoBD,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAU3E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,IAAI,EAAE,eAAe,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmB/B;AAID,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,iBAcA;AAED,wBAAsB,cAAc,CAAC,KAAK,SAAK;;;;;;;;;;;KAQ9C;AAID,wBAAsB,WAAW;;;;;;;;;;;;KAOhC;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ;;;;;;;;;;;;GAa9D;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE;IACL,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACD,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAmGlC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EACD,MAAM,GACN;IACE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACL,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAsGlC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAwClC;AAID,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;;;;;;;;;;;KAcA;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,QAA4B;;;;;;;;;;;GAclC;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;GA0FlC;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;;;;;;;;;;;GAkClC;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,QAA4B;;;;;;;;;;;GAkClC;AAID,KAAK,cAAc,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC;AAE9D,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,QAAQ,GAAG;IAC9D,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB,CAGA;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,cAAc,EAAE,EACzB,GAAG,EAAE,QAAQ;WATN,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,WAAW,CAAC;aACvC,MAAM;;GA0BhB;AAED,wBAAsB,mCAAmC,CACvD,GAAG,EAAE,QAAQ,EACb,aAAa,CAAC,EAAE,MAAM,EAAE,iBA+BzB;AAID,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;;;QAsH7B,KAAK;QACL,OAAO;QACP,MAAM;;;gBA/EI,QAAQ;cAAQ,MAAM,EAAE;;gBACxB,SAAS;gBAAU,MAAM;;gBACzB,QAAQ;gBAAU,MAAM;;GAiFvC;AAID,wBAAsB,YAAY,CAAC,MAAM,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;KAW9D;AAED,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAclC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;;;;;;;;;;;;;GA+BA;AAED,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAsHlC;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAwClC;AAID,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAkF1E;AAID,wBAAsB,iBAAiB;;;;;;GAiBtC"}