npm - @agent-native/dispatch - Versions diffs - 0.14.3 → 0.14.4 - Mend

@agent-native/dispatch 0.14.3 → 0.14.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (127) hide show

package/README.md +114 -128
package/dist/actions/list_apps.d.ts +1 -0
package/dist/actions/list_apps.js +16 -8
package/dist/actions/list_apps.js.map +1 -1
package/dist/actions/set-mcp-app-access.js +1 -4
package/dist/actions/set-mcp-app-access.js.map +1 -1
package/dist/components/action-query-error.d.ts +8 -0
package/dist/components/action-query-error.d.ts.map +1 -0
package/dist/components/action-query-error.js +10 -0
package/dist/components/action-query-error.js.map +1 -0
package/dist/components/app-keys-popover.d.ts +4 -0
package/dist/components/app-keys-popover.d.ts.map +1 -1
package/dist/components/app-keys-popover.js +26 -14
package/dist/components/app-keys-popover.js.map +1 -1
package/dist/components/dispatch-control-plane.d.ts.map +1 -1
package/dist/components/dispatch-control-plane.js +31 -27
package/dist/components/dispatch-control-plane.js.map +1 -1
package/dist/components/index.d.ts +1 -0
package/dist/components/index.d.ts.map +1 -1
package/dist/components/index.js +1 -0
package/dist/components/index.js.map +1 -1
package/dist/components/layout/Layout.d.ts +1 -0
package/dist/components/layout/Layout.d.ts.map +1 -1
package/dist/components/layout/Layout.js +19 -21
package/dist/components/layout/Layout.js.map +1 -1
package/dist/components/ui/sheet.js +1 -1
package/dist/components/ui/sheet.js.map +1 -1
package/dist/components/ui/toast.js +1 -1
package/dist/components/ui/toast.js.map +1 -1
package/dist/components/workspace-app-card.d.ts.map +1 -1
package/dist/components/workspace-app-card.js +8 -5
package/dist/components/workspace-app-card.js.map +1 -1
package/dist/components/workspace-resource-effective-stack.d.ts.map +1 -1
package/dist/components/workspace-resource-effective-stack.js +6 -1
package/dist/components/workspace-resource-effective-stack.js.map +1 -1
package/dist/components/workspace-resource-impact-preview.d.ts.map +1 -1
package/dist/components/workspace-resource-impact-preview.js +6 -1
package/dist/components/workspace-resource-impact-preview.js.map +1 -1
package/dist/routes/pages/$appId.d.ts.map +1 -1
package/dist/routes/pages/$appId.js +6 -1
package/dist/routes/pages/$appId.js.map +1 -1
package/dist/routes/pages/agents.d.ts.map +1 -1
package/dist/routes/pages/agents.js +5 -8
package/dist/routes/pages/agents.js.map +1 -1
package/dist/routes/pages/approval.d.ts.map +1 -1
package/dist/routes/pages/approval.js +6 -1
package/dist/routes/pages/approval.js.map +1 -1
package/dist/routes/pages/approvals.d.ts.map +1 -1
package/dist/routes/pages/approvals.js +8 -5
package/dist/routes/pages/approvals.js.map +1 -1
package/dist/routes/pages/apps.$appId.d.ts.map +1 -1
package/dist/routes/pages/apps.$appId.js +4 -2
package/dist/routes/pages/apps.$appId.js.map +1 -1
package/dist/routes/pages/apps.d.ts.map +1 -1
package/dist/routes/pages/apps.js +9 -3
package/dist/routes/pages/apps.js.map +1 -1
package/dist/routes/pages/audit.d.ts.map +1 -1
package/dist/routes/pages/audit.js +4 -2
package/dist/routes/pages/audit.js.map +1 -1
package/dist/routes/pages/chat.d.ts.map +1 -1
package/dist/routes/pages/chat.js +16 -2
package/dist/routes/pages/chat.js.map +1 -1
package/dist/routes/pages/destinations.d.ts.map +1 -1
package/dist/routes/pages/destinations.js +5 -3
package/dist/routes/pages/destinations.js.map +1 -1
package/dist/routes/pages/identities.d.ts.map +1 -1
package/dist/routes/pages/identities.js +5 -3
package/dist/routes/pages/identities.js.map +1 -1
package/dist/routes/pages/integrations.d.ts.map +1 -1
package/dist/routes/pages/integrations.js +9 -3
package/dist/routes/pages/integrations.js.map +1 -1
package/dist/routes/pages/thread-debug.d.ts.map +1 -1
package/dist/routes/pages/thread-debug.js +7 -6
package/dist/routes/pages/thread-debug.js.map +1 -1
package/dist/routes/pages/vault.d.ts.map +1 -1
package/dist/routes/pages/vault.js +23 -7
package/dist/routes/pages/vault.js.map +1 -1
package/dist/routes/pages/workspace.d.ts.map +1 -1
package/dist/routes/pages/workspace.js +9 -3
package/dist/routes/pages/workspace.js.map +1 -1
package/dist/server/lib/dispatch-store.d.ts.map +1 -1
package/dist/server/lib/dispatch-store.js +2 -2
package/dist/server/lib/dispatch-store.js.map +1 -1
package/dist/server/lib/mcp-access-store.d.ts.map +1 -1
package/dist/server/lib/mcp-access-store.js +30 -2
package/dist/server/lib/mcp-access-store.js.map +1 -1
package/dist/server/plugins/agent-chat.d.ts +1 -1
package/package.json +2 -2
package/src/actions/list_apps.spec.ts +52 -0
package/src/actions/list_apps.ts +16 -8
package/src/actions/set-mcp-app-access.spec.ts +73 -0
package/src/actions/set-mcp-app-access.ts +1 -5
package/src/components/action-query-error.spec.tsx +56 -0
package/src/components/action-query-error.tsx +32 -0
package/src/components/app-keys-popover.spec.tsx +85 -0
package/src/components/app-keys-popover.tsx +76 -50
package/src/components/dispatch-control-plane.spec.tsx +106 -0
package/src/components/dispatch-control-plane.tsx +71 -115
package/src/components/index.ts +1 -0
package/src/components/layout/Layout.spec.tsx +42 -2
package/src/components/layout/Layout.tsx +22 -27
package/src/components/ui/sheet.tsx +1 -1
package/src/components/ui/toast.tsx +1 -1
package/src/components/workspace-app-card.spec.tsx +80 -0
package/src/components/workspace-app-card.tsx +36 -25
package/src/components/workspace-resource-effective-stack.tsx +13 -1
package/src/components/workspace-resource-impact-preview.tsx +12 -1
package/src/routes/pages/$appId.tsx +17 -1
package/src/routes/pages/agents.tsx +24 -11
package/src/routes/pages/approval.tsx +16 -4
package/src/routes/pages/approvals.tsx +108 -89
package/src/routes/pages/apps.$appId.tsx +9 -2
package/src/routes/pages/apps.tsx +20 -7
package/src/routes/pages/audit.tsx +29 -20
package/src/routes/pages/chat.spec.tsx +94 -0
package/src/routes/pages/chat.tsx +30 -10
package/src/routes/pages/destinations.tsx +75 -62
package/src/routes/pages/identities.tsx +74 -63
package/src/routes/pages/integrations.tsx +17 -10
package/src/routes/pages/thread-debug.tsx +18 -12
package/src/routes/pages/vault.tsx +59 -26
package/src/routes/pages/workspace.tsx +69 -55
package/src/server/lib/approval-fencing.spec.ts +113 -2
package/src/server/lib/dispatch-store.ts +2 -0
package/src/server/lib/mcp-access-store.spec.ts +116 -4
package/src/server/lib/mcp-access-store.ts +37 -2
package/src/server/lib/mcp-gateway.spec.ts +79 -3

package/dist/server/lib/dispatch-store.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"dispatch-store.js","sourceRoot":"","sources":["../../../src/server/lib/dispatch-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AACvD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,6EAA6E;AAC7E,EAAE;AACF,oFAAoF;AACpF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,kBAAkB;AAClB,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAO9B,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE5D,SAAS,cAAc,CACrB,QAAgB,EAChB,cAAyC;IAEzC,OAAO,GAAG,QAAQ,KAAK,cAAc,IAAI,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC1C,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,mDAAmD;IACnD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,GAAG,mBAAmB,CACzC,CAAC;IACF,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACjD,KAAK,CAAC,YAAY,GAAG,KAAK,GAAG,kBAAkB,CAAC;QAChD,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEf,YAAY;IAD/B,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAA4B,YAAoB;QAC9C,KAAK,CACH,+CAA+C,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAC7F,CAAC;4BAHwB,YAAY;IAIxC,CAAC;CACF;AAmBD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,eAAe,EAAE,IAAI,IAAI,CAAC;AACnC,CAAC;AAaD,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CACf,KAAQ,EACR,GAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,EAAE;IACT,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,GAAG;IACV,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI;QAC9B,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CACvB,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;YACH,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,KAAK,GAAG,iBAAiB,EAAE,EAC3B,KAAK,GAAG,YAAY,EAAE;IAEtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,EAAE,mBAAmB,EAAE;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,kBAAkB;QAC1B,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,qDAAqD;QACzD,QAAQ,EAAE,KAAK;QACf,KAAK;KACN,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA6B;IACnE,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,qBAAqB,CAAC;QAC3B,UAAU,EAAE,wBAAwB;QACpC,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,kCAAkC;QACtC,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KASjC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;QACjD,EAAE,EAAE,EAAE,EAAE;QACR,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE;QACnD,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE;QAC/D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,GAAG,EAAE;IAC9C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EAC9D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAC7C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;SACnD,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACjC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EAC/D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAC9C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACjC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAA+B,EAC/B,KAAK,GAAG,iBAAiB,EAAE,EAC3B,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;aACnC,GAAG,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF,CAAC;IACN,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;YAClD,EAAE,EAAE,aAAa;YACjB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,CAAC;QAChB,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB;QAChE,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,EAAE;QAC1F,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,aAAqB,EACrB,KAAK,GAAG,iBAAiB,EAAE,EAC3B,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACnC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF,CAAC;IACJ,MAAM,WAAW,CAAC;QAChB,KAAK;QACL,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,CAAC,IAAI,EAAE;QACpE,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,OAAe;IAC/D,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE9E,MAAM,KAAK,CAAC,uCAAuC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrD,OAAO,EAAE,6BAA6B;iBACvC;aACF;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACrB,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,GAAG,OAAO,uBAAuB,MAAM,YAAY;iBAC3D;aACF;YACD,WAAW,EAAE,EAAE,SAAS,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;QACtD,EAAE,EAAE,SAAS;QACb,UAAU,EAAE,iBAAiB,EAAE;QAC/B,KAAK,EAAE,YAAY,EAAE;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAChC,WAAW,EACT,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QACtE,UAAU,EACR,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QACpE,WAAW,EAAE,iBAAiB,EAAE;QAChC,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA+B;IACrE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;YAC1B,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,EAAE;YACxF,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,UAAU,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,CAAC,IAAI,EAAE;YACnE,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE;YAC9B,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EACnE,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;QAClD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAClD,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAgC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,sBAAsB,CAC3B,OAAO,EACP,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,sBAAsB,CAC3B,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,wBAAwB,EAAE,CAAC;QACpD,OAAO,mBAAmB,CACxB,OAAO,EACP,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CAAC,KAAK,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAClD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACzE,OAAO,0BAA0B,CAC/B,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB;IACpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,mBAAmB,GAAG,SAAS,GAAG,uBAAuB,CAAC;IAChE,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CACA,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,EACrD,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,EACtD,GAAG,CAAA,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,MAAM,mBAAmB,EAAE,CAC3E,CACF,CACF,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;aACvC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CACvD,CACF,CAAC;QACJ,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,iBAAiB,EAAE;QAC/B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CACvD,CACF;SACA,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9D,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAsB;IAC3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,iBAAiB,EAAE;QAC/B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CACtD,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE;KACvD,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,yDAAyD;IACzD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,EAAE,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;QAChD,EAAE,EAAE,QAAQ;QACZ,KAAK;QACL,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,YAAY,EAAE;QACrB,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC9C,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,IAAI;QAC7B,yBAAyB,EAAE,IAAI;QAC/B,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,6BAA6B;QACrC,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,WAAW,QAAQ,mBAAmB,KAAK,EAAE;QACtD,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;KAC9B,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,OAAO,EAAE,SAAS,KAAK,EAAE;QACzB,QAAQ;QACR,SAAS,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,CACjB,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,EAClD,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,CACtB,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,EAC/C,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAC5C,CAAC;IACF,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;aAClC,KAAK,CAAC,OAAO,CAAC;aACd,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACxD,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;aAC/B,KAAK,CAAC,YAAY,CAAC;aACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;KACtD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,cAA8B,EAC9B,OAAO,GAGH,EAAE;IAEN,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACnD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,EAC/D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnD,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEvD,wEAAwE;IACxE,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,YAAY,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACnD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,CAChE,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,EAAE,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,qCAAqC;IACrC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACtD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CACjD,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;SAClD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;QAC/B,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACzD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACrE,QAAQ,CAAC,KAAK;QACZ,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;aACpC,GAAG,CAAC;YACH,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,QAAQ,EAAE,QAAQ,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;YACnD,EAAE,EAAE,EAAE,EAAE;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,QAAQ,EAAE,QAAQ,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;SACjC,GAAG,CAAC;QACH,SAAS,EAAE,SAAS;QACpB,uBAAuB,EAAE,KAAK,CAAC,cAAc;QAC7C,yBAAyB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;QACzD,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAExD,+DAA+D;IAC/D,6CAA6C;IAC7C,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAExD,MAAM,WAAW,CAAC;QAChB,KAAK,EAAE,QAAQ,CAAC,SAAS;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,eAAe;QAC3B,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,OAAO,EAAE,UAAU,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,EAAE;QAC1F,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,UAAU,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,GAC1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,gBAAgB,EAAE;QAClB,oBAAoB,EAAE;QACtB,iBAAiB,EAAE;QACnB,eAAe,CAAC,EAAE,CAAC;QACnB,iBAAiB,EAAE;KACpB,CAAC,CAAC;IAEL,OAAO;QACL,MAAM,EAAE;YACN,YAAY,EAAE,YAAY,CAAC,MAAM;YACjC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;iBACpE,MAAM;YACT,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;YACzC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CACpD,CAAC,MAAM;SACT;QACD,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport { and, desc, eq, isNull, or, sql } from \"@agent-native/core/db/schema\";\nimport {\n getRequestUserEmail,\n getRequestOrgId,\n} from \"@agent-native/core/server\";\nimport { getOrgSetting, putOrgSetting } from \"@agent-native/core/settings\";\n\nimport { getDb, schema } from \"../../db/index.js\";\n\nexport const SHARED_DISPATCH_OWNER = \"dispatch@shared\";\nconst APPROVAL_POLICY_KEY = \"dispatch-approval-policy\";\nconst APPROVAL_APPLY_LEASE_MS = 5 * 60 * 1000;\n\n// ─── /link rate limiting ──────────────────────────────────────────────────\n//\n// Failed `/link <token>` attempts are rate-limited per `(platform, externalUserId)`\n// to deter token brute-force after the H5 entropy bump. The window /\n// threshold are tuned so legitimate retries (typo, expired token) don't\n// trip the limit, while a scripted attacker burns out their per-account\n// budget quickly.\n//\n// State is process-local: works for the single-node dispatch deployment\n// we ship today. TODO: move to a SQL-backed counter table when dispatch\n// is sharded across multiple regions / processes — otherwise an\n// attacker can scale around the limit by hammering more than one node.\nconst LINK_FAIL_WINDOW_MS = 5 * 60 * 1000;\nconst LINK_FAIL_BLOCK_MS = 30 * 60 * 1000;\nconst LINK_FAIL_THRESHOLD = 5;\n\ninterface LinkFailureState {\n failures: number[]; // unix-ms timestamps of recent failures within the window\n blockedUntil: number; // unix-ms; 0 if not currently blocked\n}\n\nconst _linkFailureMap = new Map<string, LinkFailureState>();\n\nfunction linkFailureKey(\n platform: string,\n externalUserId: string \| null \| undefined,\n): string {\n return `${platform}::${externalUserId ?? \"\"}`;\n}\n\nfunction getLinkFailureState(key: string): LinkFailureState {\n let state = _linkFailureMap.get(key);\n if (!state) {\n state = { failures: [], blockedUntil: 0 };\n _linkFailureMap.set(key, state);\n }\n return state;\n}\n\nfunction isLinkAttemptBlocked(\n platform: string,\n externalUserId: string \| null \| undefined,\n): { blocked: true; retryAfterMs: number } \| { blocked: false } {\n if (!externalUserId) return { blocked: false };\n const key = linkFailureKey(platform, externalUserId);\n const state = _linkFailureMap.get(key);\n if (!state) return { blocked: false };\n const nowMs = Date.now();\n if (state.blockedUntil > nowMs) {\n return { blocked: true, retryAfterMs: state.blockedUntil - nowMs };\n }\n return { blocked: false };\n}\n\nfunction recordLinkFailure(\n platform: string,\n externalUserId: string \| null \| undefined,\n): void {\n if (!externalUserId) return;\n const key = linkFailureKey(platform, externalUserId);\n const state = getLinkFailureState(key);\n const nowMs = Date.now();\n // Drop expired failure timestamps before counting.\n state.failures = state.failures.filter(\n (ts) => nowMs - ts < LINK_FAIL_WINDOW_MS,\n );\n state.failures.push(nowMs);\n if (state.failures.length >= LINK_FAIL_THRESHOLD) {\n state.blockedUntil = nowMs + LINK_FAIL_BLOCK_MS;\n state.failures = [];\n }\n}\n\nfunction clearLinkFailures(\n platform: string,\n externalUserId: string \| null \| undefined,\n): void {\n if (!externalUserId) return;\n _linkFailureMap.delete(linkFailureKey(platform, externalUserId));\n}\n\n/*\n 429-style error returned when /link attempts are rate-limited. The\n * adapter layer can branch on `code === \"LINK_RATE_LIMITED\"` to send a\n * platform-appropriate message back to the user.\n /\nexport class LinkRateLimitError extends Error {\n readonly code = \"LINK_RATE_LIMITED\";\n constructor(public readonly retryAfterMs: number) {\n super(\n `Too many failed link attempts. Try again in ${Math.ceil(retryAfterMs / 60_000)} minute(s).`,\n );\n }\n}\n\nexport interface DispatchApprovalPolicy {\n enabled: boolean;\n approverEmails: string[];\n}\n\nexport interface DispatchDestinationInput {\n id?: string;\n name: string;\n platform: string;\n destination: string;\n threadRef?: string \| null;\n notes?: string \| null;\n}\n\ntype DispatchApprovalRequest =\n typeof schema.dispatchApprovalRequests.$inferSelect;\n\nexport function currentOwnerEmail(): string {\n const email = getRequestUserEmail();\n if (!email) throw new Error(\"no authenticated user\");\n return email;\n}\n\nexport function currentOrgId(): string \| null {\n return getRequestOrgId() \|\| null;\n}\n\n/\n Caller-supplied access context for dispatch operations that work by\n * id (destinations, etc.). Looking up a row by id alone is unsafe —\n * UUIDs are not authorization. A row matches the ctx if either the\n * caller owns it or it lives in the caller's active org.\n /\nexport interface DispatchCtx {\n ownerEmail: string;\n orgId: string \| null;\n}\n\nexport function requireDispatchCtx(): DispatchCtx {\n return { ownerEmail: currentOwnerEmail(), orgId: currentOrgId() };\n}\n\nfunction ctxScope<T extends { ownerEmail: any; orgId: any }>(\n table: T,\n ctx: DispatchCtx,\n) {\n if (!ctx.orgId) {\n return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\n }\n return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));\n}\n\nfunction id() {\n return crypto.randomUUID();\n}\n\nfunction now() {\n return Date.now();\n}\n\nfunction safeJson(value: unknown) {\n return JSON.stringify(value ?? null);\n}\n\nexport async function getApprovalPolicy(): Promise<DispatchApprovalPolicy> {\n const orgId = currentOrgId();\n if (!orgId) return { enabled: false, approverEmails: [] };\n const raw = await getOrgSetting(orgId, APPROVAL_POLICY_KEY);\n return {\n enabled: raw?.enabled === true,\n approverEmails: Array.isArray(raw?.approverEmails)\n ? raw.approverEmails.filter(\n (value): value is string => typeof value === \"string\",\n )\n : [],\n };\n}\n\nasync function applyApprovalPolicy(\n input: DispatchApprovalPolicy,\n actor = currentOwnerEmail(),\n orgId = currentOrgId(),\n) {\n if (!orgId) {\n throw new Error(\n \"Dispatch approval settings require an active organization\",\n );\n }\n await putOrgSetting(orgId, APPROVAL_POLICY_KEY, {\n enabled: input.enabled,\n approverEmails: input.approverEmails,\n });\n await recordAudit({\n action: \"settings.updated\",\n targetType: \"dispatch-settings\",\n targetId: APPROVAL_POLICY_KEY,\n summary: input.enabled\n ? \"Enabled approval flow for durable dispatch changes\"\n : \"Disabled approval flow for durable dispatch changes\",\n metadata: input,\n actor,\n });\n return {\n enabled: input.enabled,\n approverEmails: input.approverEmails,\n };\n}\n\nexport async function setApprovalPolicy(input: DispatchApprovalPolicy) {\n const current = await getApprovalPolicy();\n if (!current.enabled) {\n return applyApprovalPolicy(input);\n }\n return createApprovalRequest({\n changeType: \"approval-policy.update\",\n targetType: \"dispatch-settings\",\n targetId: APPROVAL_POLICY_KEY,\n summary: input.enabled\n ? \"Update dispatch approval policy\"\n : \"Disable dispatch approval policy\",\n payload: input,\n beforeValue: current,\n afterValue: input,\n });\n}\n\nexport async function recordAudit(input: {\n action: string;\n targetType: string;\n targetId?: string \| null;\n summary: string;\n metadata?: unknown;\n actor?: string;\n ownerEmail?: string;\n orgId?: string \| null;\n}) {\n const db = getDb();\n const timestamp = now();\n await db.insert(schema.dispatchAuditEvents).values({\n id: id(),\n ownerEmail: input.ownerEmail \|\| currentOwnerEmail(),\n orgId: input.orgId !== undefined ? input.orgId : currentOrgId(),\n actor: input.actor \|\| currentOwnerEmail(),\n action: input.action,\n targetType: input.targetType,\n targetId: input.targetId \|\| null,\n summary: input.summary,\n metadata: input.metadata ? safeJson(input.metadata) : null,\n createdAt: timestamp,\n });\n}\n\nexport async function listAuditEvents(limit = 50) {\n const db = getDb();\n const orgId = currentOrgId();\n return db\n .select()\n .from(schema.dispatchAuditEvents)\n .where(\n and(\n eq(schema.dispatchAuditEvents.ownerEmail, currentOwnerEmail()),\n orgId\n ? eq(schema.dispatchAuditEvents.orgId, orgId)\n : isNull(schema.dispatchAuditEvents.orgId),\n ),\n )\n .orderBy(desc(schema.dispatchAuditEvents.createdAt))\n .limit(limit);\n}\n\nexport async function listDestinations() {\n const db = getDb();\n const orgId = currentOrgId();\n return db\n .select()\n .from(schema.dispatchDestinations)\n .where(\n and(\n eq(schema.dispatchDestinations.ownerEmail, currentOwnerEmail()),\n orgId\n ? eq(schema.dispatchDestinations.orgId, orgId)\n : isNull(schema.dispatchDestinations.orgId),\n ),\n )\n .orderBy(desc(schema.dispatchDestinations.updatedAt));\n}\n\nexport async function getDestinationById(\n destinationId: string,\n ctx: DispatchCtx = requireDispatchCtx(),\n) {\n const db = getDb();\n const [row] = await db\n .select()\n .from(schema.dispatchDestinations)\n .where(\n and(\n eq(schema.dispatchDestinations.id, destinationId),\n ctxScope(schema.dispatchDestinations, ctx),\n ),\n )\n .limit(1);\n return row ?? null;\n}\n\nasync function applyDestinationUpsert(\n input: DispatchDestinationInput,\n actor = currentOwnerEmail(),\n ctx: DispatchCtx = requireDispatchCtx(),\n) {\n const db = getDb();\n const timestamp = now();\n const destinationId = input.id \|\| id();\n const existing = input.id ? await getDestinationById(input.id, ctx) : null;\n\n if (existing) {\n await db\n .update(schema.dispatchDestinations)\n .set({\n name: input.name,\n platform: input.platform,\n destination: input.destination,\n threadRef: input.threadRef \|\| null,\n notes: input.notes \|\| null,\n updatedAt: timestamp,\n })\n .where(\n and(\n eq(schema.dispatchDestinations.id, destinationId),\n ctxScope(schema.dispatchDestinations, ctx),\n ),\n );\n } else {\n await db.insert(schema.dispatchDestinations).values({\n id: destinationId,\n ownerEmail: ctx.ownerEmail,\n orgId: ctx.orgId,\n name: input.name,\n platform: input.platform,\n destination: input.destination,\n threadRef: input.threadRef \|\| null,\n notes: input.notes \|\| null,\n createdBy: actor,\n createdAt: timestamp,\n updatedAt: timestamp,\n });\n }\n\n await recordAudit({\n actor,\n action: existing ? \"destination.updated\" : \"destination.created\",\n targetType: \"destination\",\n targetId: destinationId,\n summary: `${existing ? \"Updated\" : \"Created\"} ${input.platform} destination ${input.name}`,\n metadata: input,\n });\n\n return getDestinationById(destinationId, ctx);\n}\n\nasync function applyDestinationDelete(\n destinationId: string,\n actor = currentOwnerEmail(),\n ctx: DispatchCtx = requireDispatchCtx(),\n) {\n const db = getDb();\n const existing = await getDestinationById(destinationId, ctx);\n if (!existing) {\n throw new Error(\"Destination not found\");\n }\n await db\n .delete(schema.dispatchDestinations)\n .where(\n and(\n eq(schema.dispatchDestinations.id, destinationId),\n ctxScope(schema.dispatchDestinations, ctx),\n ),\n );\n await recordAudit({\n actor,\n action: \"destination.deleted\",\n targetType: \"destination\",\n targetId: destinationId,\n summary: `Deleted ${existing.platform} destination ${existing.name}`,\n metadata: existing,\n });\n return existing;\n}\n\nasync function notifyApprovers(requestId: string, summary: string) {\n const policy = await getApprovalPolicy();\n const apiKey = process.env.SENDGRID_API_KEY;\n const from = process.env.SENDGRID_FROM_EMAIL;\n const appUrl = process.env.APP_URL;\n if (!apiKey \|\| !from \|\| !appUrl \|\| policy.approverEmails.length === 0) return;\n\n await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n personalizations: [\n {\n to: policy.approverEmails.map((email) => ({ email })),\n subject: \"Dispatch approval requested\",\n },\n ],\n from: { email: from },\n content: [\n {\n type: \"text/plain\",\n value: `${summary}\\n\\nReview it here: ${appUrl}/approvals`,\n },\n ],\n custom_args: { requestId },\n }),\n }).catch(() => {});\n}\n\nexport async function createApprovalRequest(input: {\n changeType: string;\n targetType: string;\n targetId?: string \| null;\n summary: string;\n payload: unknown;\n beforeValue?: unknown;\n afterValue?: unknown;\n}) {\n const db = getDb();\n const timestamp = now();\n const requestId = id();\n await db.insert(schema.dispatchApprovalRequests).values({\n id: requestId,\n ownerEmail: currentOwnerEmail(),\n orgId: currentOrgId(),\n changeType: input.changeType,\n targetType: input.targetType,\n targetId: input.targetId \|\| null,\n status: \"pending\",\n summary: input.summary,\n payload: safeJson(input.payload),\n beforeValue:\n input.beforeValue === undefined ? null : safeJson(input.beforeValue),\n afterValue:\n input.afterValue === undefined ? null : safeJson(input.afterValue),\n requestedBy: currentOwnerEmail(),\n reviewedBy: null,\n reviewedAt: null,\n createdAt: timestamp,\n updatedAt: timestamp,\n });\n await recordAudit({\n action: \"approval.requested\",\n targetType: input.targetType,\n targetId: input.targetId \|\| requestId,\n summary: input.summary,\n metadata: input,\n });\n await notifyApprovers(requestId, input.summary);\n return getApprovalRequest(requestId);\n}\n\nexport async function upsertDestination(input: DispatchDestinationInput) {\n const policy = await getApprovalPolicy();\n if (policy.enabled) {\n const existing = input.id ? await getDestinationById(input.id) : null;\n return createApprovalRequest({\n changeType: \"destination.upsert\",\n targetType: \"destination\",\n targetId: input.id \|\| null,\n summary: `${existing ? \"Update\" : \"Create\"} ${input.platform} destination ${input.name}`,\n payload: input,\n beforeValue: existing,\n afterValue: input,\n });\n }\n return applyDestinationUpsert(input);\n}\n\nexport async function deleteDestination(destinationId: string) {\n const policy = await getApprovalPolicy();\n const existing = await getDestinationById(destinationId);\n if (!existing) {\n throw new Error(\"Destination not found\");\n }\n if (policy.enabled) {\n return createApprovalRequest({\n changeType: \"destination.delete\",\n targetType: \"destination\",\n targetId: destinationId,\n summary: `Delete ${existing.platform} destination ${existing.name}`,\n payload: { id: destinationId },\n beforeValue: existing,\n afterValue: null,\n });\n }\n return applyDestinationDelete(destinationId);\n}\n\nexport async function listApprovalRequests() {\n const db = getDb();\n const orgId = currentOrgId();\n return db\n .select()\n .from(schema.dispatchApprovalRequests)\n .where(\n and(\n eq(schema.dispatchApprovalRequests.ownerEmail, currentOwnerEmail()),\n orgId\n ? eq(schema.dispatchApprovalRequests.orgId, orgId)\n : isNull(schema.dispatchApprovalRequests.orgId),\n ),\n )\n .orderBy(desc(schema.dispatchApprovalRequests.updatedAt));\n}\n\nasync function getApprovalRequest(\n requestId: string,\n ctx: DispatchCtx = requireDispatchCtx(),\n) {\n const db = getDb();\n const [row] = await db\n .select()\n .from(schema.dispatchApprovalRequests)\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n ctxScope(schema.dispatchApprovalRequests, ctx),\n ),\n )\n .limit(1);\n return row ?? null;\n}\n\nasync function applyApprovedRequest(request: DispatchApprovalRequest) {\n const payload = JSON.parse(request.payload);\n const requestCtx = {\n ownerEmail: request.ownerEmail,\n orgId: request.orgId,\n };\n if (request.changeType === \"destination.upsert\") {\n return applyDestinationUpsert(\n payload,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"destination.delete\") {\n return applyDestinationDelete(\n payload.id,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"approval-policy.update\") {\n return applyApprovalPolicy(\n payload,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx.orgId,\n );\n }\n if (request.changeType === \"dream-proposal.apply\") {\n const { applyApprovedDreamProposal } = await import(\"./dreams-store.js\");\n return applyApprovedDreamProposal(\n payload.proposalId,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"workspace-resource.create\") {\n const { applyWorkspaceResourceCreate } =\n await import(\"./workspace-resources-store.js\");\n return applyWorkspaceResourceCreate(\n payload.input,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"workspace-resource.update\") {\n const { applyWorkspaceResourceUpdate } =\n await import(\"./workspace-resources-store.js\");\n return applyWorkspaceResourceUpdate(\n payload.id,\n payload.input,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"workspace-resource.delete\") {\n const { applyWorkspaceResourceDelete } =\n await import(\"./workspace-resources-store.js\");\n return applyWorkspaceResourceDelete(\n payload.id,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n throw new Error(`Unsupported approval request type: ${request.changeType}`);\n}\n\nexport async function approveRequest(requestId: string) {\n const db = getDb();\n const ctx = requireDispatchCtx();\n const request = await getApprovalRequest(requestId, ctx);\n if (!request) throw new Error(\"Approval request not found\");\n\n const timestamp = now();\n const staleApplyingBefore = timestamp - APPROVAL_APPLY_LEASE_MS;\n // Fence the transition on the current status so a concurrent approve can't\n // both win. A crashed worker can leave its lease in \"applying\", so reclaim\n // only a lease that has been idle for the full lease interval.\n const claimed = await db\n .update(schema.dispatchApprovalRequests)\n .set({\n status: \"applying\",\n updatedAt: timestamp,\n })\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n ctxScope(schema.dispatchApprovalRequests, ctx),\n or(\n eq(schema.dispatchApprovalRequests.status, \"pending\"),\n and(\n eq(schema.dispatchApprovalRequests.status, \"applying\"),\n sql`${schema.dispatchApprovalRequests.updatedAt} < ${staleApplyingBefore}`,\n ),\n ),\n ),\n )\n .returning();\n\n if (claimed.length === 0) {\n const current = (await getApprovalRequest(requestId, ctx)) ?? request;\n if (current.status === \"applying\") {\n throw new Error(\"Approval is already being applied\");\n }\n return current;\n }\n\n const applying = claimed[0];\n try {\n await applyApprovedRequest(applying);\n } catch (error) {\n // Applying a request can have succeeded partially before throwing. Do not\n // return it to pending: that would allow an immediate retry to duplicate a\n // non-idempotent effect. Keep the lease until it becomes stale, which\n // serializes any recovery attempt behind the same fencing rule.\n await db\n .update(schema.dispatchApprovalRequests)\n .set({ updatedAt: now() })\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n ctxScope(schema.dispatchApprovalRequests, ctx),\n eq(schema.dispatchApprovalRequests.status, \"applying\"),\n ),\n );\n throw error;\n }\n const [updated] = await db\n .update(schema.dispatchApprovalRequests)\n .set({\n status: \"approved\",\n reviewedBy: currentOwnerEmail(),\n reviewedAt: timestamp,\n updatedAt: now(),\n })\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n eq(schema.dispatchApprovalRequests.status, \"applying\"),\n ),\n )\n .returning();\n if (!updated) throw new Error(\"Approval request disappeared\");\n await recordAudit({\n action: \"approval.approved\",\n targetType: updated.targetType,\n targetId: requestId,\n summary: `Approved ${updated.summary}`,\n metadata: updated,\n });\n return updated;\n}\n\nexport async function rejectRequest(requestId: string, reason?: string \| null) {\n const db = getDb();\n const ctx = requireDispatchCtx();\n const request = await getApprovalRequest(requestId, ctx);\n if (!request) throw new Error(\"Approval request not found\");\n\n const timestamp = now();\n const claimed = await db\n .update(schema.dispatchApprovalRequests)\n .set({\n status: \"rejected\",\n reviewedBy: currentOwnerEmail(),\n reviewedAt: timestamp,\n updatedAt: timestamp,\n })\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n eq(schema.dispatchApprovalRequests.status, \"pending\"),\n ),\n )\n .returning();\n\n if (claimed.length === 0) {\n return (await getApprovalRequest(requestId, ctx)) ?? request;\n }\n\n const updated = claimed[0];\n await recordAudit({\n action: \"approval.rejected\",\n targetType: updated.targetType,\n targetId: requestId,\n summary: `Rejected ${updated.summary}`,\n metadata: { request: updated, reason: reason \|\| null },\n });\n return updated;\n}\n\nexport async function createLinkToken(platform: string) {\n const db = getDb();\n const timestamp = now();\n // 16 bytes = 128 bits of entropy. Previous size was 4 bytes (32 bits,\n // ~4.29 billion keyspace) which is brute-forceable in well under an\n // hour given a 7-day expiry and no rate limiting on /link attempts.\n // Old 8-hex-char tokens minted before this change continue to verify\n // until they expire; we don't migrate retroactively. See\n // /tmp/security-audit/07-webhooks.md (H5).\n const token = crypto.randomBytes(16).toString(\"hex\");\n const recordId = id();\n const owner = currentOwnerEmail();\n await db.insert(schema.dispatchLinkTokens).values({\n id: recordId,\n token,\n ownerEmail: owner,\n orgId: currentOrgId(),\n platform,\n createdBy: owner,\n expiresAt: timestamp + 7 24 * 60 * 60 * 1000,\n claimedAt: null,\n claimedByExternalUserId: null,\n claimedByExternalUserName: null,\n createdAt: timestamp,\n updatedAt: timestamp,\n });\n await recordAudit({\n action: \"identity.link-token-created\",\n targetType: \"link-token\",\n targetId: recordId,\n summary: `Created ${platform} link token for ${owner}`,\n metadata: { token, platform },\n });\n return {\n token,\n command: `/link ${token}`,\n platform,\n expiresAt: timestamp + 7 * 24 * 60 * 60 * 1000,\n };\n}\n\nexport async function listIdentityState() {\n const db = getDb();\n const owner = currentOwnerEmail();\n const orgId = currentOrgId();\n const filters = and(\n eq(schema.dispatchIdentityLinks.ownerEmail, owner),\n orgId\n ? eq(schema.dispatchIdentityLinks.orgId, orgId)\n : isNull(schema.dispatchIdentityLinks.orgId),\n );\n const tokenFilters = and(\n eq(schema.dispatchLinkTokens.ownerEmail, owner),\n orgId\n ? eq(schema.dispatchLinkTokens.orgId, orgId)\n : isNull(schema.dispatchLinkTokens.orgId),\n );\n const [links, tokens] = await Promise.all([\n db\n .select()\n .from(schema.dispatchIdentityLinks)\n .where(filters)\n .orderBy(desc(schema.dispatchIdentityLinks.updatedAt)),\n db\n .select()\n .from(schema.dispatchLinkTokens)\n .where(tokenFilters)\n .orderBy(desc(schema.dispatchLinkTokens.updatedAt)),\n ]);\n return { links, tokens };\n}\n\nexport async function resolveLinkedOwner(\n platform: string,\n externalUserId?: string \| null,\n options: {\n orgId?: string \| null;\n allowAnyOrgFallback?: boolean;\n } = {},\n) {\n if (!externalUserId) return null;\n const db = getDb();\n const orgId = options.orgId !== undefined ? options.orgId : currentOrgId();\n const rows = await db\n .select()\n .from(schema.dispatchIdentityLinks)\n .where(\n and(\n eq(schema.dispatchIdentityLinks.platform, platform),\n eq(schema.dispatchIdentityLinks.externalUserId, externalUserId),\n orgId\n ? eq(schema.dispatchIdentityLinks.orgId, orgId)\n : isNull(schema.dispatchIdentityLinks.orgId),\n ),\n )\n .orderBy(desc(schema.dispatchIdentityLinks.updatedAt))\n .limit(1);\n if (rows[0]?.ownerEmail) return rows[0].ownerEmail;\n\n if (!options.allowAnyOrgFallback \|\| orgId) return null;\n\n // Webhook processors run outside a normal request/org context. A linked\n // Slack/Telegram identity may still be scoped to an org, so fall back to any\n // org only when every matching link resolves to the same owner.\n const fallbackRows = await db\n .select()\n .from(schema.dispatchIdentityLinks)\n .where(\n and(\n eq(schema.dispatchIdentityLinks.platform, platform),\n eq(schema.dispatchIdentityLinks.externalUserId, externalUserId),\n ),\n )\n .orderBy(desc(schema.dispatchIdentityLinks.updatedAt))\n .limit(25);\n const owners = new Set(fallbackRows.map((row) => row.ownerEmail));\n return owners.size === 1 ? fallbackRows[0]?.ownerEmail \|\| null : null;\n}\n\nexport async function consumeLinkToken(input: {\n platform: string;\n token: string;\n externalUserId?: string \| null;\n externalUserName?: string \| null;\n}) {\n if (!input.externalUserId) {\n throw new Error(\"Linking requires a platform user id\");\n }\n\n // Rate-limit failed attempts per (platform, externalUserId). Once\n // tripped, all further attempts are short-circuited until the block\n // window passes — including the lookup, so an attacker can't probe\n // for valid tokens during the block.\n const blockState = isLinkAttemptBlocked(input.platform, input.externalUserId);\n if (blockState.blocked) {\n throw new LinkRateLimitError(blockState.retryAfterMs);\n }\n\n const db = getDb();\n const tokenRows = await db\n .select()\n .from(schema.dispatchLinkTokens)\n .where(\n and(\n eq(schema.dispatchLinkTokens.platform, input.platform),\n eq(schema.dispatchLinkTokens.token, input.token),\n ),\n )\n .orderBy(desc(schema.dispatchLinkTokens.createdAt))\n .limit(2);\n if (tokenRows.length > 1) {\n recordLinkFailure(input.platform, input.externalUserId);\n throw new Error(\"Link token is ambiguous. Create a fresh token and retry.\");\n }\n const tokenRow = tokenRows[0];\n if (!tokenRow) {\n recordLinkFailure(input.platform, input.externalUserId);\n throw new Error(\"Link token not found\");\n }\n if (tokenRow.claimedAt) {\n recordLinkFailure(input.platform, input.externalUserId);\n throw new Error(\"Link token has already been claimed\");\n }\n if (tokenRow.expiresAt < now()) {\n recordLinkFailure(input.platform, input.externalUserId);\n throw new Error(\"Link token has expired\");\n }\n\n const timestamp = now();\n const [existing] = await db\n .select()\n .from(schema.dispatchIdentityLinks)\n .where(\n and(\n eq(schema.dispatchIdentityLinks.platform, input.platform),\n eq(schema.dispatchIdentityLinks.externalUserId, input.externalUserId),\n tokenRow.orgId\n ? eq(schema.dispatchIdentityLinks.orgId, tokenRow.orgId)\n : isNull(schema.dispatchIdentityLinks.orgId),\n ),\n )\n .limit(1);\n\n if (existing) {\n await db\n .update(schema.dispatchIdentityLinks)\n .set({\n ownerEmail: tokenRow.ownerEmail,\n orgId: tokenRow.orgId,\n externalUserName: input.externalUserName \|\| null,\n linkedBy: tokenRow.createdBy,\n updatedAt: timestamp,\n })\n .where(eq(schema.dispatchIdentityLinks.id, existing.id));\n } else {\n await db.insert(schema.dispatchIdentityLinks).values({\n id: id(),\n ownerEmail: tokenRow.ownerEmail,\n orgId: tokenRow.orgId,\n platform: input.platform,\n externalUserId: input.externalUserId,\n externalUserName: input.externalUserName \|\| null,\n linkedBy: tokenRow.createdBy,\n createdAt: timestamp,\n updatedAt: timestamp,\n });\n }\n\n await db\n .update(schema.dispatchLinkTokens)\n .set({\n claimedAt: timestamp,\n claimedByExternalUserId: input.externalUserId,\n claimedByExternalUserName: input.externalUserName \|\| null,\n updatedAt: timestamp,\n })\n .where(eq(schema.dispatchLinkTokens.id, tokenRow.id));\n\n // Successful claim — reset the rate-limit budget so subsequent\n // links from this external user start fresh.\n clearLinkFailures(input.platform, input.externalUserId);\n\n await recordAudit({\n actor: tokenRow.createdBy,\n ownerEmail: tokenRow.ownerEmail,\n orgId: tokenRow.orgId,\n action: \"identity.linked\",\n targetType: \"identity-link\",\n targetId: input.externalUserId,\n summary: `Linked ${input.platform} user ${input.externalUserName \|\| input.externalUserId}`,\n metadata: input,\n });\n\n return tokenRow.ownerEmail;\n}\n\nexport async function listOverview() {\n const [destinations, approvals, identities, audit, settings] =\n await Promise.all([\n listDestinations(),\n listApprovalRequests(),\n listIdentityState(),\n listAuditEvents(12),\n getApprovalPolicy(),\n ]);\n\n return {\n counts: {\n destinations: destinations.length,\n pendingApprovals: approvals.filter((item) => item.status === \"pending\")\n .length,\n linkedIdentities: identities.links.length,\n activeTokens: identities.tokens.filter(\n (item) => !item.claimedAt && item.expiresAt > now(),\n ).length,\n },\n recentDestinations: destinations.slice(0, 5),\n recentApprovals: approvals.slice(0, 5),\n recentAudit: audit.slice(0, 8),\n settings,\n };\n}\n"]}
1	+ {"version":3,"file":"dispatch-store.js","sourceRoot":"","sources":["../../../src/server/lib/dispatch-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AACvD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C,6EAA6E;AAC7E,EAAE;AACF,oFAAoF;AACpF,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,kBAAkB;AAClB,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,gEAAgE;AAChE,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAO9B,MAAM,eAAe,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE5D,SAAS,cAAc,CACrB,QAAgB,EAChB,cAAyC;IAEzC,OAAO,GAAG,QAAQ,KAAK,cAAc,IAAI,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC1C,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,mDAAmD;IACnD,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CACpC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,GAAG,mBAAmB,CACzC,CAAC;IACF,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACjD,KAAK,CAAC,YAAY,GAAG,KAAK,GAAG,kBAAkB,CAAC;QAChD,KAAK,CAAC,QAAQ,GAAG,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,cAAyC;IAEzC,IAAI,CAAC,cAAc;QAAE,OAAO;IAC5B,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEf,YAAY;IAD/B,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAA4B,YAAoB;QAC9C,KAAK,CACH,+CAA+C,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,CAC7F,CAAC;4BAHwB,YAAY;IAIxC,CAAC;CACF;AAmBD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,eAAe,EAAE,IAAI,IAAI,CAAC;AACnC,CAAC;AAaD,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CACf,KAAQ,EACR,GAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,EAAE;IACT,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,GAAG;IACV,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IAC5D,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI;QAC9B,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CACvB,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CACtD;YACH,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,KAAK,GAAG,iBAAiB,EAAE,EAC3B,KAAK,GAAG,YAAY,EAAE;IAEtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,CAAC,KAAK,EAAE,mBAAmB,EAAE;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,kBAAkB;QAC1B,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,qDAAqD;QACzD,QAAQ,EAAE,KAAK;QACf,KAAK;KACN,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA6B;IACnE,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,qBAAqB,CAAC;QAC3B,UAAU,EAAE,wBAAwB;QACpC,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,EAAE,mBAAmB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;YACpB,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,kCAAkC;QACtC,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,OAAO;QACpB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KASjC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;QACjD,EAAE,EAAE,EAAE,EAAE;QACR,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE;QACnD,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE;QAC/D,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,GAAG,EAAE;IAC9C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAChC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EAC9D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAC7C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;SACnD,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACjC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EAC/D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAC9C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACjC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAA+B,EAC/B,KAAK,GAAG,iBAAiB,EAAE,EAC3B,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;aACnC,GAAG,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF,CAAC;IACN,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;YAClD,EAAE,EAAE,aAAa;YACjB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,CAAC;QAChB,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB;QAChE,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,EAAE;QAC1F,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,aAAqB,EACrB,KAAK,GAAG,iBAAiB,EAAE,EAC3B,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC;SACnC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAC3C,CACF,CAAC;IACJ,MAAM,WAAW,CAAC;QAChB,KAAK;QACL,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,WAAW,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,CAAC,IAAI,EAAE;QACpE,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,OAAe;IAC/D,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE9E,MAAM,KAAK,CAAC,uCAAuC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACrD,OAAO,EAAE,6BAA6B;iBACvC;aACF;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACrB,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,GAAG,OAAO,uBAAuB,MAAM,YAAY;iBAC3D;aACF;YACD,WAAW,EAAE,EAAE,SAAS,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;IACvB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC;QACtD,EAAE,EAAE,SAAS;QACb,UAAU,EAAE,iBAAiB,EAAE;QAC/B,KAAK,EAAE,YAAY,EAAE;QACrB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAChC,WAAW,EACT,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QACtE,UAAU,EACR,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QACpE,WAAW,EAAE,iBAAiB,EAAE;QAChC,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS;QACrC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA+B;IACrE,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;YAC1B,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,gBAAgB,KAAK,CAAC,IAAI,EAAE;YACxF,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,qBAAqB,CAAC;YAC3B,UAAU,EAAE,oBAAoB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,UAAU,QAAQ,CAAC,QAAQ,gBAAgB,QAAQ,CAAC,IAAI,EAAE;YACnE,OAAO,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE;YAC9B,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC,EACnE,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;QAClD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAClD,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,GAAG,GAAgB,kBAAkB,EAAE;IAEvC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACrC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAgC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,sBAAsB,CAC3B,OAAO,EACP,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAChD,OAAO,sBAAsB,CAC3B,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,wBAAwB,EAAE,CAAC;QACpD,OAAO,mBAAmB,CACxB,OAAO,EACP,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CAAC,KAAK,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,sBAAsB,EAAE,CAAC;QAClD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACzE,OAAO,0BAA0B,CAC/B,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,2BAA2B,EAAE,CAAC;QACvD,MAAM,EAAE,4BAA4B,EAAE,GACpC,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,OAAO,4BAA4B,CACjC,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,EACzC,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB;IACpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,mBAAmB,GAAG,SAAS,GAAG,uBAAuB,CAAC;IAChE,2EAA2E;IAC3E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CACA,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,EACrD,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,EACtD,GAAG,CAAA,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,MAAM,mBAAmB,EAAE,CAC3E,CACF,CACF,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;aACvC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CACvD,CACF,CAAC;QACJ,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,iBAAiB,EAAE;QAC/B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CACvD,CACF;SACA,SAAS,EAAE,CAAC;IACf,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC9D,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAsB;IAC3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAE5D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;SACvC,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,iBAAiB,EAAE;QAC/B,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,EAAE,SAAS,CAAC,EACjD,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAC9C,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CACtD,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;IAC/D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,mBAAmB;QAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,EAAE;QACtC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE;KACvD,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,yDAAyD;IACzD,2CAA2C;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,EAAE,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;QAChD,EAAE,EAAE,QAAQ;QACZ,KAAK;QACL,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,YAAY,EAAE;QACrB,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC9C,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,IAAI;QAC7B,yBAAyB,EAAE,IAAI;QAC/B,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,6BAA6B;QACrC,UAAU,EAAE,YAAY;QACxB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,WAAW,QAAQ,mBAAmB,KAAK,EAAE;QACtD,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;KAC9B,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,OAAO,EAAE,SAAS,KAAK,EAAE;QACzB,QAAQ;QACR,SAAS,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,GAAG,CACjB,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,UAAU,EAAE,KAAK,CAAC,EAClD,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,CACtB,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,EAC/C,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAC5C,CAAC;IACF,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;aAClC,KAAK,CAAC,OAAO,CAAC;aACd,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACxD,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;aAC/B,KAAK,CAAC,YAAY,CAAC;aACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;KACtD,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,cAA8B,EAC9B,OAAO,GAGH,EAAE;IAEN,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACnD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,EAC/D,KAAK;QACH,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC/C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnD,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAEvD,wEAAwE;IACxE,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,YAAY,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACnD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,CAChE,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;SACrD,KAAK,CAAC,EAAE,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAKtC;IACC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,qCAAqC;IACrC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;SAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACtD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CACjD,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;SAClD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC;QAC/B,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;SAClC,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EACzD,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,EACrE,QAAQ,CAAC,KAAK;QACZ,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAC/C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC;aACpC,GAAG,CAAC;YACH,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,QAAQ,EAAE,QAAQ,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC;YACnD,EAAE,EAAE,EAAE,EAAE;YACR,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,QAAQ,EAAE,QAAQ,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;SACjC,GAAG,CAAC;QACH,SAAS,EAAE,SAAS;QACpB,uBAAuB,EAAE,KAAK,CAAC,cAAc;QAC7C,yBAAyB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;QACzD,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAExD,+DAA+D;IAC/D,6CAA6C;IAC7C,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAExD,MAAM,WAAW,CAAC;QAChB,KAAK,EAAE,QAAQ,CAAC,SAAS;QACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,eAAe;QAC3B,QAAQ,EAAE,KAAK,CAAC,cAAc;QAC9B,OAAO,EAAE,UAAU,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,EAAE;QAC1F,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,UAAU,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,GAC1D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,gBAAgB,EAAE;QAClB,oBAAoB,EAAE;QACtB,iBAAiB,EAAE;QACnB,eAAe,CAAC,EAAE,CAAC;QACnB,iBAAiB,EAAE;KACpB,CAAC,CAAC;IAEL,OAAO;QACL,MAAM,EAAE;YACN,YAAY,EAAE,YAAY,CAAC,MAAM;YACjC,gBAAgB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;iBACpE,MAAM;YACT,gBAAgB,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM;YACzC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CACpD,CAAC,MAAM;SACT;QACD,kBAAkB,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9B,QAAQ;KACT,CAAC;AACJ,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport { and, desc, eq, isNull, or, sql } from \"@agent-native/core/db/schema\";\nimport {\n getRequestUserEmail,\n getRequestOrgId,\n} from \"@agent-native/core/server\";\nimport { getOrgSetting, putOrgSetting } from \"@agent-native/core/settings\";\n\nimport { getDb, schema } from \"../../db/index.js\";\n\nexport const SHARED_DISPATCH_OWNER = \"dispatch@shared\";\nconst APPROVAL_POLICY_KEY = \"dispatch-approval-policy\";\nconst APPROVAL_APPLY_LEASE_MS = 5 * 60 * 1000;\n\n// ─── /link rate limiting ──────────────────────────────────────────────────\n//\n// Failed `/link <token>` attempts are rate-limited per `(platform, externalUserId)`\n// to deter token brute-force after the H5 entropy bump. The window /\n// threshold are tuned so legitimate retries (typo, expired token) don't\n// trip the limit, while a scripted attacker burns out their per-account\n// budget quickly.\n//\n// State is process-local: works for the single-node dispatch deployment\n// we ship today. TODO: move to a SQL-backed counter table when dispatch\n// is sharded across multiple regions / processes — otherwise an\n// attacker can scale around the limit by hammering more than one node.\nconst LINK_FAIL_WINDOW_MS = 5 * 60 * 1000;\nconst LINK_FAIL_BLOCK_MS = 30 * 60 * 1000;\nconst LINK_FAIL_THRESHOLD = 5;\n\ninterface LinkFailureState {\n failures: number[]; // unix-ms timestamps of recent failures within the window\n blockedUntil: number; // unix-ms; 0 if not currently blocked\n}\n\nconst _linkFailureMap = new Map<string, LinkFailureState>();\n\nfunction linkFailureKey(\n platform: string,\n externalUserId: string \| null \| undefined,\n): string {\n return `${platform}::${externalUserId ?? \"\"}`;\n}\n\nfunction getLinkFailureState(key: string): LinkFailureState {\n let state = _linkFailureMap.get(key);\n if (!state) {\n state = { failures: [], blockedUntil: 0 };\n _linkFailureMap.set(key, state);\n }\n return state;\n}\n\nfunction isLinkAttemptBlocked(\n platform: string,\n externalUserId: string \| null \| undefined,\n): { blocked: true; retryAfterMs: number } \| { blocked: false } {\n if (!externalUserId) return { blocked: false };\n const key = linkFailureKey(platform, externalUserId);\n const state = _linkFailureMap.get(key);\n if (!state) return { blocked: false };\n const nowMs = Date.now();\n if (state.blockedUntil > nowMs) {\n return { blocked: true, retryAfterMs: state.blockedUntil - nowMs };\n }\n return { blocked: false };\n}\n\nfunction recordLinkFailure(\n platform: string,\n externalUserId: string \| null \| undefined,\n): void {\n if (!externalUserId) return;\n const key = linkFailureKey(platform, externalUserId);\n const state = getLinkFailureState(key);\n const nowMs = Date.now();\n // Drop expired failure timestamps before counting.\n state.failures = state.failures.filter(\n (ts) => nowMs - ts < LINK_FAIL_WINDOW_MS,\n );\n state.failures.push(nowMs);\n if (state.failures.length >= LINK_FAIL_THRESHOLD) {\n state.blockedUntil = nowMs + LINK_FAIL_BLOCK_MS;\n state.failures = [];\n }\n}\n\nfunction clearLinkFailures(\n platform: string,\n externalUserId: string \| null \| undefined,\n): void {\n if (!externalUserId) return;\n _linkFailureMap.delete(linkFailureKey(platform, externalUserId));\n}\n\n/*\n 429-style error returned when /link attempts are rate-limited. The\n * adapter layer can branch on `code === \"LINK_RATE_LIMITED\"` to send a\n * platform-appropriate message back to the user.\n /\nexport class LinkRateLimitError extends Error {\n readonly code = \"LINK_RATE_LIMITED\";\n constructor(public readonly retryAfterMs: number) {\n super(\n `Too many failed link attempts. Try again in ${Math.ceil(retryAfterMs / 60_000)} minute(s).`,\n );\n }\n}\n\nexport interface DispatchApprovalPolicy {\n enabled: boolean;\n approverEmails: string[];\n}\n\nexport interface DispatchDestinationInput {\n id?: string;\n name: string;\n platform: string;\n destination: string;\n threadRef?: string \| null;\n notes?: string \| null;\n}\n\ntype DispatchApprovalRequest =\n typeof schema.dispatchApprovalRequests.$inferSelect;\n\nexport function currentOwnerEmail(): string {\n const email = getRequestUserEmail();\n if (!email) throw new Error(\"no authenticated user\");\n return email;\n}\n\nexport function currentOrgId(): string \| null {\n return getRequestOrgId() \|\| null;\n}\n\n/\n Caller-supplied access context for dispatch operations that work by\n * id (destinations, etc.). Looking up a row by id alone is unsafe —\n * UUIDs are not authorization. A row matches the ctx if either the\n * caller owns it or it lives in the caller's active org.\n /\nexport interface DispatchCtx {\n ownerEmail: string;\n orgId: string \| null;\n}\n\nexport function requireDispatchCtx(): DispatchCtx {\n return { ownerEmail: currentOwnerEmail(), orgId: currentOrgId() };\n}\n\nfunction ctxScope<T extends { ownerEmail: any; orgId: any }>(\n table: T,\n ctx: DispatchCtx,\n) {\n if (!ctx.orgId) {\n return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\n }\n return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));\n}\n\nfunction id() {\n return crypto.randomUUID();\n}\n\nfunction now() {\n return Date.now();\n}\n\nfunction safeJson(value: unknown) {\n return JSON.stringify(value ?? null);\n}\n\nexport async function getApprovalPolicy(): Promise<DispatchApprovalPolicy> {\n const orgId = currentOrgId();\n if (!orgId) return { enabled: false, approverEmails: [] };\n const raw = await getOrgSetting(orgId, APPROVAL_POLICY_KEY);\n return {\n enabled: raw?.enabled === true,\n approverEmails: Array.isArray(raw?.approverEmails)\n ? raw.approverEmails.filter(\n (value): value is string => typeof value === \"string\",\n )\n : [],\n };\n}\n\nasync function applyApprovalPolicy(\n input: DispatchApprovalPolicy,\n actor = currentOwnerEmail(),\n orgId = currentOrgId(),\n) {\n if (!orgId) {\n throw new Error(\n \"Dispatch approval settings require an active organization\",\n );\n }\n await putOrgSetting(orgId, APPROVAL_POLICY_KEY, {\n enabled: input.enabled,\n approverEmails: input.approverEmails,\n });\n await recordAudit({\n action: \"settings.updated\",\n targetType: \"dispatch-settings\",\n targetId: APPROVAL_POLICY_KEY,\n summary: input.enabled\n ? \"Enabled approval flow for durable dispatch changes\"\n : \"Disabled approval flow for durable dispatch changes\",\n metadata: input,\n actor,\n });\n return {\n enabled: input.enabled,\n approverEmails: input.approverEmails,\n };\n}\n\nexport async function setApprovalPolicy(input: DispatchApprovalPolicy) {\n const current = await getApprovalPolicy();\n if (!current.enabled) {\n return applyApprovalPolicy(input);\n }\n return createApprovalRequest({\n changeType: \"approval-policy.update\",\n targetType: \"dispatch-settings\",\n targetId: APPROVAL_POLICY_KEY,\n summary: input.enabled\n ? \"Update dispatch approval policy\"\n : \"Disable dispatch approval policy\",\n payload: input,\n beforeValue: current,\n afterValue: input,\n });\n}\n\nexport async function recordAudit(input: {\n action: string;\n targetType: string;\n targetId?: string \| null;\n summary: string;\n metadata?: unknown;\n actor?: string;\n ownerEmail?: string;\n orgId?: string \| null;\n}) {\n const db = getDb();\n const timestamp = now();\n await db.insert(schema.dispatchAuditEvents).values({\n id: id(),\n ownerEmail: input.ownerEmail \|\| currentOwnerEmail(),\n orgId: input.orgId !== undefined ? input.orgId : currentOrgId(),\n actor: input.actor \|\| currentOwnerEmail(),\n action: input.action,\n targetType: input.targetType,\n targetId: input.targetId \|\| null,\n summary: input.summary,\n metadata: input.metadata ? safeJson(input.metadata) : null,\n createdAt: timestamp,\n });\n}\n\nexport async function listAuditEvents(limit = 50) {\n const db = getDb();\n const orgId = currentOrgId();\n return db\n .select()\n .from(schema.dispatchAuditEvents)\n .where(\n and(\n eq(schema.dispatchAuditEvents.ownerEmail, currentOwnerEmail()),\n orgId\n ? eq(schema.dispatchAuditEvents.orgId, orgId)\n : isNull(schema.dispatchAuditEvents.orgId),\n ),\n )\n .orderBy(desc(schema.dispatchAuditEvents.createdAt))\n .limit(limit);\n}\n\nexport async function listDestinations() {\n const db = getDb();\n const orgId = currentOrgId();\n return db\n .select()\n .from(schema.dispatchDestinations)\n .where(\n and(\n eq(schema.dispatchDestinations.ownerEmail, currentOwnerEmail()),\n orgId\n ? eq(schema.dispatchDestinations.orgId, orgId)\n : isNull(schema.dispatchDestinations.orgId),\n ),\n )\n .orderBy(desc(schema.dispatchDestinations.updatedAt));\n}\n\nexport async function getDestinationById(\n destinationId: string,\n ctx: DispatchCtx = requireDispatchCtx(),\n) {\n const db = getDb();\n const [row] = await db\n .select()\n .from(schema.dispatchDestinations)\n .where(\n and(\n eq(schema.dispatchDestinations.id, destinationId),\n ctxScope(schema.dispatchDestinations, ctx),\n ),\n )\n .limit(1);\n return row ?? null;\n}\n\nasync function applyDestinationUpsert(\n input: DispatchDestinationInput,\n actor = currentOwnerEmail(),\n ctx: DispatchCtx = requireDispatchCtx(),\n) {\n const db = getDb();\n const timestamp = now();\n const destinationId = input.id \|\| id();\n const existing = input.id ? await getDestinationById(input.id, ctx) : null;\n\n if (existing) {\n await db\n .update(schema.dispatchDestinations)\n .set({\n name: input.name,\n platform: input.platform,\n destination: input.destination,\n threadRef: input.threadRef \|\| null,\n notes: input.notes \|\| null,\n updatedAt: timestamp,\n })\n .where(\n and(\n eq(schema.dispatchDestinations.id, destinationId),\n ctxScope(schema.dispatchDestinations, ctx),\n ),\n );\n } else {\n await db.insert(schema.dispatchDestinations).values({\n id: destinationId,\n ownerEmail: ctx.ownerEmail,\n orgId: ctx.orgId,\n name: input.name,\n platform: input.platform,\n destination: input.destination,\n threadRef: input.threadRef \|\| null,\n notes: input.notes \|\| null,\n createdBy: actor,\n createdAt: timestamp,\n updatedAt: timestamp,\n });\n }\n\n await recordAudit({\n actor,\n action: existing ? \"destination.updated\" : \"destination.created\",\n targetType: \"destination\",\n targetId: destinationId,\n summary: `${existing ? \"Updated\" : \"Created\"} ${input.platform} destination ${input.name}`,\n metadata: input,\n });\n\n return getDestinationById(destinationId, ctx);\n}\n\nasync function applyDestinationDelete(\n destinationId: string,\n actor = currentOwnerEmail(),\n ctx: DispatchCtx = requireDispatchCtx(),\n) {\n const db = getDb();\n const existing = await getDestinationById(destinationId, ctx);\n if (!existing) {\n throw new Error(\"Destination not found\");\n }\n await db\n .delete(schema.dispatchDestinations)\n .where(\n and(\n eq(schema.dispatchDestinations.id, destinationId),\n ctxScope(schema.dispatchDestinations, ctx),\n ),\n );\n await recordAudit({\n actor,\n action: \"destination.deleted\",\n targetType: \"destination\",\n targetId: destinationId,\n summary: `Deleted ${existing.platform} destination ${existing.name}`,\n metadata: existing,\n });\n return existing;\n}\n\nasync function notifyApprovers(requestId: string, summary: string) {\n const policy = await getApprovalPolicy();\n const apiKey = process.env.SENDGRID_API_KEY;\n const from = process.env.SENDGRID_FROM_EMAIL;\n const appUrl = process.env.APP_URL;\n if (!apiKey \|\| !from \|\| !appUrl \|\| policy.approverEmails.length === 0) return;\n\n await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n personalizations: [\n {\n to: policy.approverEmails.map((email) => ({ email })),\n subject: \"Dispatch approval requested\",\n },\n ],\n from: { email: from },\n content: [\n {\n type: \"text/plain\",\n value: `${summary}\\n\\nReview it here: ${appUrl}/approvals`,\n },\n ],\n custom_args: { requestId },\n }),\n }).catch(() => {});\n}\n\nexport async function createApprovalRequest(input: {\n changeType: string;\n targetType: string;\n targetId?: string \| null;\n summary: string;\n payload: unknown;\n beforeValue?: unknown;\n afterValue?: unknown;\n}) {\n const db = getDb();\n const timestamp = now();\n const requestId = id();\n await db.insert(schema.dispatchApprovalRequests).values({\n id: requestId,\n ownerEmail: currentOwnerEmail(),\n orgId: currentOrgId(),\n changeType: input.changeType,\n targetType: input.targetType,\n targetId: input.targetId \|\| null,\n status: \"pending\",\n summary: input.summary,\n payload: safeJson(input.payload),\n beforeValue:\n input.beforeValue === undefined ? null : safeJson(input.beforeValue),\n afterValue:\n input.afterValue === undefined ? null : safeJson(input.afterValue),\n requestedBy: currentOwnerEmail(),\n reviewedBy: null,\n reviewedAt: null,\n createdAt: timestamp,\n updatedAt: timestamp,\n });\n await recordAudit({\n action: \"approval.requested\",\n targetType: input.targetType,\n targetId: input.targetId \|\| requestId,\n summary: input.summary,\n metadata: input,\n });\n await notifyApprovers(requestId, input.summary);\n return getApprovalRequest(requestId);\n}\n\nexport async function upsertDestination(input: DispatchDestinationInput) {\n const policy = await getApprovalPolicy();\n if (policy.enabled) {\n const existing = input.id ? await getDestinationById(input.id) : null;\n return createApprovalRequest({\n changeType: \"destination.upsert\",\n targetType: \"destination\",\n targetId: input.id \|\| null,\n summary: `${existing ? \"Update\" : \"Create\"} ${input.platform} destination ${input.name}`,\n payload: input,\n beforeValue: existing,\n afterValue: input,\n });\n }\n return applyDestinationUpsert(input);\n}\n\nexport async function deleteDestination(destinationId: string) {\n const policy = await getApprovalPolicy();\n const existing = await getDestinationById(destinationId);\n if (!existing) {\n throw new Error(\"Destination not found\");\n }\n if (policy.enabled) {\n return createApprovalRequest({\n changeType: \"destination.delete\",\n targetType: \"destination\",\n targetId: destinationId,\n summary: `Delete ${existing.platform} destination ${existing.name}`,\n payload: { id: destinationId },\n beforeValue: existing,\n afterValue: null,\n });\n }\n return applyDestinationDelete(destinationId);\n}\n\nexport async function listApprovalRequests() {\n const db = getDb();\n const orgId = currentOrgId();\n return db\n .select()\n .from(schema.dispatchApprovalRequests)\n .where(\n and(\n eq(schema.dispatchApprovalRequests.ownerEmail, currentOwnerEmail()),\n orgId\n ? eq(schema.dispatchApprovalRequests.orgId, orgId)\n : isNull(schema.dispatchApprovalRequests.orgId),\n ),\n )\n .orderBy(desc(schema.dispatchApprovalRequests.updatedAt));\n}\n\nasync function getApprovalRequest(\n requestId: string,\n ctx: DispatchCtx = requireDispatchCtx(),\n) {\n const db = getDb();\n const [row] = await db\n .select()\n .from(schema.dispatchApprovalRequests)\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n ctxScope(schema.dispatchApprovalRequests, ctx),\n ),\n )\n .limit(1);\n return row ?? null;\n}\n\nasync function applyApprovedRequest(request: DispatchApprovalRequest) {\n const payload = JSON.parse(request.payload);\n const requestCtx = {\n ownerEmail: request.ownerEmail,\n orgId: request.orgId,\n };\n if (request.changeType === \"destination.upsert\") {\n return applyDestinationUpsert(\n payload,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"destination.delete\") {\n return applyDestinationDelete(\n payload.id,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"approval-policy.update\") {\n return applyApprovalPolicy(\n payload,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx.orgId,\n );\n }\n if (request.changeType === \"dream-proposal.apply\") {\n const { applyApprovedDreamProposal } = await import(\"./dreams-store.js\");\n return applyApprovedDreamProposal(\n payload.proposalId,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"workspace-resource.create\") {\n const { applyWorkspaceResourceCreate } =\n await import(\"./workspace-resources-store.js\");\n return applyWorkspaceResourceCreate(\n payload.input,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"workspace-resource.update\") {\n const { applyWorkspaceResourceUpdate } =\n await import(\"./workspace-resources-store.js\");\n return applyWorkspaceResourceUpdate(\n payload.id,\n payload.input,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n if (request.changeType === \"workspace-resource.delete\") {\n const { applyWorkspaceResourceDelete } =\n await import(\"./workspace-resources-store.js\");\n return applyWorkspaceResourceDelete(\n payload.id,\n request.reviewedBy \|\| currentOwnerEmail(),\n requestCtx,\n );\n }\n throw new Error(`Unsupported approval request type: ${request.changeType}`);\n}\n\nexport async function approveRequest(requestId: string) {\n const db = getDb();\n const ctx = requireDispatchCtx();\n const request = await getApprovalRequest(requestId, ctx);\n if (!request) throw new Error(\"Approval request not found\");\n\n const timestamp = now();\n const staleApplyingBefore = timestamp - APPROVAL_APPLY_LEASE_MS;\n // Fence the transition on the current status so a concurrent approve can't\n // both win. A crashed worker can leave its lease in \"applying\", so reclaim\n // only a lease that has been idle for the full lease interval.\n const claimed = await db\n .update(schema.dispatchApprovalRequests)\n .set({\n status: \"applying\",\n updatedAt: timestamp,\n })\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n ctxScope(schema.dispatchApprovalRequests, ctx),\n or(\n eq(schema.dispatchApprovalRequests.status, \"pending\"),\n and(\n eq(schema.dispatchApprovalRequests.status, \"applying\"),\n sql`${schema.dispatchApprovalRequests.updatedAt} < ${staleApplyingBefore}`,\n ),\n ),\n ),\n )\n .returning();\n\n if (claimed.length === 0) {\n const current = (await getApprovalRequest(requestId, ctx)) ?? request;\n if (current.status === \"applying\") {\n throw new Error(\"Approval is already being applied\");\n }\n return current;\n }\n\n const applying = claimed[0];\n try {\n await applyApprovedRequest(applying);\n } catch (error) {\n // Applying a request can have succeeded partially before throwing. Do not\n // return it to pending: that would allow an immediate retry to duplicate a\n // non-idempotent effect. Keep the lease until it becomes stale, which\n // serializes any recovery attempt behind the same fencing rule.\n await db\n .update(schema.dispatchApprovalRequests)\n .set({ updatedAt: now() })\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n ctxScope(schema.dispatchApprovalRequests, ctx),\n eq(schema.dispatchApprovalRequests.status, \"applying\"),\n ),\n );\n throw error;\n }\n const [updated] = await db\n .update(schema.dispatchApprovalRequests)\n .set({\n status: \"approved\",\n reviewedBy: currentOwnerEmail(),\n reviewedAt: timestamp,\n updatedAt: now(),\n })\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n ctxScope(schema.dispatchApprovalRequests, ctx),\n eq(schema.dispatchApprovalRequests.status, \"applying\"),\n ),\n )\n .returning();\n if (!updated) throw new Error(\"Approval request disappeared\");\n await recordAudit({\n action: \"approval.approved\",\n targetType: updated.targetType,\n targetId: requestId,\n summary: `Approved ${updated.summary}`,\n metadata: updated,\n });\n return updated;\n}\n\nexport async function rejectRequest(requestId: string, reason?: string \| null) {\n const db = getDb();\n const ctx = requireDispatchCtx();\n const request = await getApprovalRequest(requestId, ctx);\n if (!request) throw new Error(\"Approval request not found\");\n\n const timestamp = now();\n const claimed = await db\n .update(schema.dispatchApprovalRequests)\n .set({\n status: \"rejected\",\n reviewedBy: currentOwnerEmail(),\n reviewedAt: timestamp,\n updatedAt: timestamp,\n })\n .where(\n and(\n eq(schema.dispatchApprovalRequests.id, requestId),\n ctxScope(schema.dispatchApprovalRequests, ctx),\n eq(schema.dispatchApprovalRequests.status, \"pending\"),\n ),\n )\n .returning();\n\n if (claimed.length === 0) {\n return (await getApprovalRequest(requestId, ctx)) ?? request;\n }\n\n const updated = claimed[0];\n await recordAudit({\n action: \"approval.rejected\",\n targetType: updated.targetType,\n targetId: requestId,\n summary: `Rejected ${updated.summary}`,\n metadata: { request: updated, reason: reason \|\| null },\n });\n return updated;\n}\n\nexport async function createLinkToken(platform: string) {\n const db = getDb();\n const timestamp = now();\n // 16 bytes = 128 bits of entropy. Previous size was 4 bytes (32 bits,\n // ~4.29 billion keyspace) which is brute-forceable in well under an\n // hour given a 7-day expiry and no rate limiting on /link attempts.\n // Old 8-hex-char tokens minted before this change continue to verify\n // until they expire; we don't migrate retroactively. See\n // /tmp/security-audit/07-webhooks.md (H5).\n const token = crypto.randomBytes(16).toString(\"hex\");\n const recordId = id();\n const owner = currentOwnerEmail();\n await db.insert(schema.dispatchLinkTokens).values({\n id: recordId,\n token,\n ownerEmail: owner,\n orgId: currentOrgId(),\n platform,\n createdBy: owner,\n expiresAt: timestamp + 7 24 * 60 * 60 * 1000,\n claimedAt: null,\n claimedByExternalUserId: null,\n claimedByExternalUserName: null,\n createdAt: timestamp,\n updatedAt: timestamp,\n });\n await recordAudit({\n action: \"identity.link-token-created\",\n targetType: \"link-token\",\n targetId: recordId,\n summary: `Created ${platform} link token for ${owner}`,\n metadata: { token, platform },\n });\n return {\n token,\n command: `/link ${token}`,\n platform,\n expiresAt: timestamp + 7 * 24 * 60 * 60 * 1000,\n };\n}\n\nexport async function listIdentityState() {\n const db = getDb();\n const owner = currentOwnerEmail();\n const orgId = currentOrgId();\n const filters = and(\n eq(schema.dispatchIdentityLinks.ownerEmail, owner),\n orgId\n ? eq(schema.dispatchIdentityLinks.orgId, orgId)\n : isNull(schema.dispatchIdentityLinks.orgId),\n );\n const tokenFilters = and(\n eq(schema.dispatchLinkTokens.ownerEmail, owner),\n orgId\n ? eq(schema.dispatchLinkTokens.orgId, orgId)\n : isNull(schema.dispatchLinkTokens.orgId),\n );\n const [links, tokens] = await Promise.all([\n db\n .select()\n .from(schema.dispatchIdentityLinks)\n .where(filters)\n .orderBy(desc(schema.dispatchIdentityLinks.updatedAt)),\n db\n .select()\n .from(schema.dispatchLinkTokens)\n .where(tokenFilters)\n .orderBy(desc(schema.dispatchLinkTokens.updatedAt)),\n ]);\n return { links, tokens };\n}\n\nexport async function resolveLinkedOwner(\n platform: string,\n externalUserId?: string \| null,\n options: {\n orgId?: string \| null;\n allowAnyOrgFallback?: boolean;\n } = {},\n) {\n if (!externalUserId) return null;\n const db = getDb();\n const orgId = options.orgId !== undefined ? options.orgId : currentOrgId();\n const rows = await db\n .select()\n .from(schema.dispatchIdentityLinks)\n .where(\n and(\n eq(schema.dispatchIdentityLinks.platform, platform),\n eq(schema.dispatchIdentityLinks.externalUserId, externalUserId),\n orgId\n ? eq(schema.dispatchIdentityLinks.orgId, orgId)\n : isNull(schema.dispatchIdentityLinks.orgId),\n ),\n )\n .orderBy(desc(schema.dispatchIdentityLinks.updatedAt))\n .limit(1);\n if (rows[0]?.ownerEmail) return rows[0].ownerEmail;\n\n if (!options.allowAnyOrgFallback \|\| orgId) return null;\n\n // Webhook processors run outside a normal request/org context. A linked\n // Slack/Telegram identity may still be scoped to an org, so fall back to any\n // org only when every matching link resolves to the same owner.\n const fallbackRows = await db\n .select()\n .from(schema.dispatchIdentityLinks)\n .where(\n and(\n eq(schema.dispatchIdentityLinks.platform, platform),\n eq(schema.dispatchIdentityLinks.externalUserId, externalUserId),\n ),\n )\n .orderBy(desc(schema.dispatchIdentityLinks.updatedAt))\n .limit(25);\n const owners = new Set(fallbackRows.map((row) => row.ownerEmail));\n return owners.size === 1 ? fallbackRows[0]?.ownerEmail \|\| null : null;\n}\n\nexport async function consumeLinkToken(input: {\n platform: string;\n token: string;\n externalUserId?: string \| null;\n externalUserName?: string \| null;\n}) {\n if (!input.externalUserId) {\n throw new Error(\"Linking requires a platform user id\");\n }\n\n // Rate-limit failed attempts per (platform, externalUserId). Once\n // tripped, all further attempts are short-circuited until the block\n // window passes — including the lookup, so an attacker can't probe\n // for valid tokens during the block.\n const blockState = isLinkAttemptBlocked(input.platform, input.externalUserId);\n if (blockState.blocked) {\n throw new LinkRateLimitError(blockState.retryAfterMs);\n }\n\n const db = getDb();\n const tokenRows = await db\n .select()\n .from(schema.dispatchLinkTokens)\n .where(\n and(\n eq(schema.dispatchLinkTokens.platform, input.platform),\n eq(schema.dispatchLinkTokens.token, input.token),\n ),\n )\n .orderBy(desc(schema.dispatchLinkTokens.createdAt))\n .limit(2);\n if (tokenRows.length > 1) {\n recordLinkFailure(input.platform, input.externalUserId);\n throw new Error(\"Link token is ambiguous. Create a fresh token and retry.\");\n }\n const tokenRow = tokenRows[0];\n if (!tokenRow) {\n recordLinkFailure(input.platform, input.externalUserId);\n throw new Error(\"Link token not found\");\n }\n if (tokenRow.claimedAt) {\n recordLinkFailure(input.platform, input.externalUserId);\n throw new Error(\"Link token has already been claimed\");\n }\n if (tokenRow.expiresAt < now()) {\n recordLinkFailure(input.platform, input.externalUserId);\n throw new Error(\"Link token has expired\");\n }\n\n const timestamp = now();\n const [existing] = await db\n .select()\n .from(schema.dispatchIdentityLinks)\n .where(\n and(\n eq(schema.dispatchIdentityLinks.platform, input.platform),\n eq(schema.dispatchIdentityLinks.externalUserId, input.externalUserId),\n tokenRow.orgId\n ? eq(schema.dispatchIdentityLinks.orgId, tokenRow.orgId)\n : isNull(schema.dispatchIdentityLinks.orgId),\n ),\n )\n .limit(1);\n\n if (existing) {\n await db\n .update(schema.dispatchIdentityLinks)\n .set({\n ownerEmail: tokenRow.ownerEmail,\n orgId: tokenRow.orgId,\n externalUserName: input.externalUserName \|\| null,\n linkedBy: tokenRow.createdBy,\n updatedAt: timestamp,\n })\n .where(eq(schema.dispatchIdentityLinks.id, existing.id));\n } else {\n await db.insert(schema.dispatchIdentityLinks).values({\n id: id(),\n ownerEmail: tokenRow.ownerEmail,\n orgId: tokenRow.orgId,\n platform: input.platform,\n externalUserId: input.externalUserId,\n externalUserName: input.externalUserName \|\| null,\n linkedBy: tokenRow.createdBy,\n createdAt: timestamp,\n updatedAt: timestamp,\n });\n }\n\n await db\n .update(schema.dispatchLinkTokens)\n .set({\n claimedAt: timestamp,\n claimedByExternalUserId: input.externalUserId,\n claimedByExternalUserName: input.externalUserName \|\| null,\n updatedAt: timestamp,\n })\n .where(eq(schema.dispatchLinkTokens.id, tokenRow.id));\n\n // Successful claim — reset the rate-limit budget so subsequent\n // links from this external user start fresh.\n clearLinkFailures(input.platform, input.externalUserId);\n\n await recordAudit({\n actor: tokenRow.createdBy,\n ownerEmail: tokenRow.ownerEmail,\n orgId: tokenRow.orgId,\n action: \"identity.linked\",\n targetType: \"identity-link\",\n targetId: input.externalUserId,\n summary: `Linked ${input.platform} user ${input.externalUserName \|\| input.externalUserId}`,\n metadata: input,\n });\n\n return tokenRow.ownerEmail;\n}\n\nexport async function listOverview() {\n const [destinations, approvals, identities, audit, settings] =\n await Promise.all([\n listDestinations(),\n listApprovalRequests(),\n listIdentityState(),\n listAuditEvents(12),\n getApprovalPolicy(),\n ]);\n\n return {\n counts: {\n destinations: destinations.length,\n pendingApprovals: approvals.filter((item) => item.status === \"pending\")\n .length,\n linkedIdentities: identities.links.length,\n activeTokens: identities.tokens.filter(\n (item) => !item.claimedAt && item.expiresAt > now(),\n ).length,\n },\n recentDestinations: destinations.slice(0, 5),\n recentApprovals: approvals.slice(0, 5),\n recentAudit: audit.slice(0, 8),\n settings,\n };\n}\n"]}

package/dist/server/lib/mcp-access-store.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-access-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"~~AAWA~~,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,eAAe,CAAC;AAEpE,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;~~AAoBD~~,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,OAAO,GACX,4BAA4B,~~CAc9B~~;~~AAUD~~,wBAAsB,+BAA+B,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAO7F;AAED,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,IAAI,EAAE,wBAAwB,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,OAAO,CAAC,4BAA4B,CAAC,~~CAexC~~;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,4BAA4B,GACrC,OAAO,CAKT"}
1	+ {"version":3,"file":"mcp-access-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,eAAe,CAAC;AAEpE,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8BD,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAe9B;AAgCD,wBAAsB,+BAA+B,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAO7F;AAED,wBAAsB,+BAA+B,CAAC,KAAK,EAAE;IAC3D,IAAI,EAAE,wBAAwB,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAgBxC;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,4BAA4B,GACrC,OAAO,CAKT"}

package/dist/server/lib/mcp-access-store.js CHANGED Viewed

@@ -1,6 +1,15 @@
+import { getDbExec } from "@agent-native/core/db";
 import { getRequestOrgId, getRequestUserEmail, } from "@agent-native/core/server";
 import { getOrgSetting, getUserSetting, putOrgSetting, putUserSetting, } from "@agent-native/core/settings";
 export const MCP_APP_ACCESS_SETTINGS_KEY = "dispatch-mcp-app-access";
+class McpAppAccessError extends Error {
+    statusCode;
+    constructor(message, statusCode) {
+        super(message);
+        this.name = "McpAppAccessError";
+        this.statusCode = statusCode;
+    }
+}
 function uniqueAppIds(values) {
     const input = Array.isArray(values) ? values : [];
     return Array.from(new Set(input
@@ -12,10 +21,10 @@ export function normalizeMcpAppAccessSettings(raw) {
     const record = raw && typeof raw === "object" && !Array.isArray(raw)
         ? raw
         : {};
-    const mode = record.mode === "selected-apps" ? "selected-apps" : "all-apps";
+    const mode = record.mode === "all-apps" ? "all-apps" : "selected-apps";
     return {
         mode,
-        selectedAppIds: uniqueAppIds(record.selectedAppIds),
+        selectedAppIds: raw == null ? ["dispatch"] : uniqueAppIds(record.selectedAppIds),
         updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : undefined,
         updatedBy: typeof record.updatedBy === "string" ? record.updatedBy : undefined,
     };
@@ -29,6 +38,24 @@ function currentAccessScope() {
         return { kind: "org", id: orgId, actor };
     return { kind: "user", id: actor, actor };
 }
+async function assertCanManageMcpAppAccess(scope) {
+    if (scope.kind === "user")
+        return;
+    let role = null;
+    try {
+        const { rows } = await getDbExec().execute({
+            sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+            args: [scope.id, scope.actor.toLowerCase()],
+        });
+        role = rows[0]?.role;
+    }
+    catch {
+        // Fail closed when org membership cannot be verified.
+    }
+    if (role !== "owner" && role !== "admin") {
+        throw new McpAppAccessError("Only organization owners and admins can change Dispatch MCP app access.", 403);
+    }
+}
 export async function getDispatchMcpAppAccessSettings() {
     const scope = currentAccessScope();
     const raw = scope.kind === "org"
@@ -38,6 +65,7 @@ export async function getDispatchMcpAppAccessSettings() {
 }
 export async function setDispatchMcpAppAccessSettings(input) {
     const scope = currentAccessScope();
+    await assertCanManageMcpAppAccess(scope);
     const next = {
         mode: input.mode,
         selectedAppIds: uniqueAppIds(input.selectedAppIds),

package/dist/server/lib/mcp-access-store.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-access-store.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;~~AAiBrE~~,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,KAAK;SACF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAY;IAEZ,MAAM,MAAM,GACV,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,~~eAAe~~,CAAC,CAAC,CAAC,~~eAAe~~,CAAC,CAAC,CAAC,~~UAAU~~,CAAC;~~IAC5E~~,OAAO;QACL,IAAI;QACJ,cAAc,~~EAAE~~,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;~~QACnD~~,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACrE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B;IACnD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC;QAC5D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAClE,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAiC;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,KAAK;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,IAA0C,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAsC;IAEtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import {\n getRequestOrgId,\n getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport {\n getOrgSetting,\n getUserSetting,\n putOrgSetting,\n putUserSetting,\n} from \"@agent-native/core/settings\";\n\nexport const MCP_APP_ACCESS_SETTINGS_KEY = \"dispatch-mcp-app-access\";\n\nexport type DispatchMcpAppAccessMode = \"all-apps\" \| \"selected-apps\";\n\nexport interface DispatchMcpAppAccessSettings {\n mode: DispatchMcpAppAccessMode;\n selectedAppIds: string[];\n updatedAt?: string;\n updatedBy?: string;\n}\n\ninterface AccessScope {\n kind: \"org\" \| \"user\";\n id: string;\n actor: string;\n}\n\nfunction uniqueAppIds(values: unknown): string[] {\n const input = Array.isArray(values) ? values : [];\n return Array.from(\n new Set(\n input\n .filter((value): value is string => typeof value === \"string\")\n .map((value) => value.trim().toLowerCase())\n .filter(Boolean),\n ),\n );\n}\n\nexport function normalizeMcpAppAccessSettings(\n raw: unknown,\n): DispatchMcpAppAccessSettings {\n const record =\n raw && typeof raw === \"object\" && !Array.isArray(raw)\n ? (raw as Record<string, unknown>)\n : {};\n const mode = record.mode === \"~~selected~~-apps\" ? \"~~selected~~-apps\" : \"~~all~~-apps\";\n return {\n mode,\n selectedAppIds: uniqueAppIds(record.selectedAppIds),\n updatedAt:\n typeof record.updatedAt === \"string\" ? record.updatedAt : undefined,\n updatedBy:\n typeof record.updatedBy === \"string\" ? record.updatedBy : undefined,\n };\n}\n\nfunction currentAccessScope(): AccessScope {\n const actor = getRequestUserEmail();\n if (!actor) throw new Error(\"no authenticated user\");\n const orgId = getRequestOrgId();\n if (orgId) return { kind: \"org\", id: orgId, actor };\n return { kind: \"user\", id: actor, actor };\n}\n\nexport async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {\n const scope = currentAccessScope();\n const raw =\n scope.kind === \"org\"\n ? await getOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY)\n : await getUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY);\n return normalizeMcpAppAccessSettings(raw);\n}\n\nexport async function setDispatchMcpAppAccessSettings(input: {\n mode: DispatchMcpAppAccessMode;\n selectedAppIds?: string[];\n}): Promise<DispatchMcpAppAccessSettings> {\n const scope = currentAccessScope();\n const next: DispatchMcpAppAccessSettings = {\n mode: input.mode,\n selectedAppIds: uniqueAppIds(input.selectedAppIds),\n updatedAt: new Date().toISOString(),\n updatedBy: scope.actor,\n };\n const value = next as unknown as Record<string, unknown>;\n if (scope.kind === \"org\") {\n await putOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n } else {\n await putUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n }\n return next;\n}\n\nexport function isAppAllowedByMcpAccess(\n appId: string,\n settings: DispatchMcpAppAccessSettings,\n): boolean {\n const normalized = appId.trim().toLowerCase();\n if (!normalized) return false;\n if (settings.mode === \"all-apps\") return true;\n return settings.selectedAppIds.includes(normalized);\n}\n"]}
1	+ {"version":3,"file":"mcp-access-store.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAWrE,MAAM,iBAAkB,SAAQ,KAAK;IACnC,UAAU,CAAS;IAEnB,YAAY,OAAe,EAAE,UAAkB;QAC7C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAQD,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,KAAK;SACF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAY;IAEZ,MAAM,MAAM,GACV,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;IACvE,OAAO;QACL,IAAI;QACJ,cAAc,EACZ,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QAClE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACrE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAAkB;IAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO;IAElC,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE,4EAA4E;YACjF,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,iBAAiB,CACzB,yEAAyE,EACzE,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B;IACnD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC;QAC5D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAClE,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAiC;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,KAAK;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,IAA0C,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAsC;IAEtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import { getDbExec } from \"@agent-native/core/db\";\nimport {\n getRequestOrgId,\n getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport {\n getOrgSetting,\n getUserSetting,\n putOrgSetting,\n putUserSetting,\n} from \"@agent-native/core/settings\";\n\nexport const MCP_APP_ACCESS_SETTINGS_KEY = \"dispatch-mcp-app-access\";\n\nexport type DispatchMcpAppAccessMode = \"all-apps\" \| \"selected-apps\";\n\nexport interface DispatchMcpAppAccessSettings {\n mode: DispatchMcpAppAccessMode;\n selectedAppIds: string[];\n updatedAt?: string;\n updatedBy?: string;\n}\n\nclass McpAppAccessError extends Error {\n statusCode: number;\n\n constructor(message: string, statusCode: number) {\n super(message);\n this.name = \"McpAppAccessError\";\n this.statusCode = statusCode;\n }\n}\n\ninterface AccessScope {\n kind: \"org\" \| \"user\";\n id: string;\n actor: string;\n}\n\nfunction uniqueAppIds(values: unknown): string[] {\n const input = Array.isArray(values) ? values : [];\n return Array.from(\n new Set(\n input\n .filter((value): value is string => typeof value === \"string\")\n .map((value) => value.trim().toLowerCase())\n .filter(Boolean),\n ),\n );\n}\n\nexport function normalizeMcpAppAccessSettings(\n raw: unknown,\n): DispatchMcpAppAccessSettings {\n const record =\n raw && typeof raw === \"object\" && !Array.isArray(raw)\n ? (raw as Record<string, unknown>)\n : {};\n const mode = record.mode === \"all-apps\" ? \"all-apps\" : \"selected-apps\";\n return {\n mode,\n selectedAppIds:\n raw == null ? [\"dispatch\"] : uniqueAppIds(record.selectedAppIds),\n updatedAt:\n typeof record.updatedAt === \"string\" ? record.updatedAt : undefined,\n updatedBy:\n typeof record.updatedBy === \"string\" ? record.updatedBy : undefined,\n };\n}\n\nfunction currentAccessScope(): AccessScope {\n const actor = getRequestUserEmail();\n if (!actor) throw new Error(\"no authenticated user\");\n const orgId = getRequestOrgId();\n if (orgId) return { kind: \"org\", id: orgId, actor };\n return { kind: \"user\", id: actor, actor };\n}\n\nasync function assertCanManageMcpAppAccess(scope: AccessScope): Promise<void> {\n if (scope.kind === \"user\") return;\n\n let role: unknown = null;\n try {\n const { rows } = await getDbExec().execute({\n sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n args: [scope.id, scope.actor.toLowerCase()],\n });\n role = rows[0]?.role;\n } catch {\n // Fail closed when org membership cannot be verified.\n }\n\n if (role !== \"owner\" && role !== \"admin\") {\n throw new McpAppAccessError(\n \"Only organization owners and admins can change Dispatch MCP app access.\",\n 403,\n );\n }\n}\n\nexport async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {\n const scope = currentAccessScope();\n const raw =\n scope.kind === \"org\"\n ? await getOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY)\n : await getUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY);\n return normalizeMcpAppAccessSettings(raw);\n}\n\nexport async function setDispatchMcpAppAccessSettings(input: {\n mode: DispatchMcpAppAccessMode;\n selectedAppIds?: string[];\n}): Promise<DispatchMcpAppAccessSettings> {\n const scope = currentAccessScope();\n await assertCanManageMcpAppAccess(scope);\n const next: DispatchMcpAppAccessSettings = {\n mode: input.mode,\n selectedAppIds: uniqueAppIds(input.selectedAppIds),\n updatedAt: new Date().toISOString(),\n updatedBy: scope.actor,\n };\n const value = next as unknown as Record<string, unknown>;\n if (scope.kind === \"org\") {\n await putOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n } else {\n await putUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n }\n return next;\n}\n\nexport function isAppAllowedByMcpAccess(\n appId: string,\n settings: DispatchMcpAppAccessSettings,\n): boolean {\n const normalized = appId.trim().toLowerCase();\n if (!normalized) return false;\n if (settings.mode === \"all-apps\") return true;\n return settings.selectedAppIds.includes(normalized);\n}\n"]}

package/dist/server/plugins/agent-chat.d.ts CHANGED Viewed

@@ -1,3 +1,3 @@
-declare const _default: (nitroApp: any) => void | Promise<void>;
+declare const _default: import("node_modules/@agent-native/core/dist/server/agent-chat/plugin-options.js").NitroPluginDef;
 export default _default;
 //# sourceMappingURL=agent-chat.d.ts.map

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.14.3",
+  "version": "0.14.4",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -93,7 +93,7 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.97.0"
+    "@agent-native/core": "0.98.0"
   },
   "peerDependencies": {
     "@agent-native/core": ">=0.8.0",

package/src/actions/list_apps.spec.ts ADDED Viewed

@@ -0,0 +1,52 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+const mocks = vi.hoisted(() => ({
+  listGrantedApps: vi.fn(),
+}));
+vi.mock("../server/lib/mcp-gateway.js", () => ({
+  listGrantedDispatchMcpApps: mocks.listGrantedApps,
+}));
+import listApps from "./list_apps.js";
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.listGrantedApps.mockResolvedValue([
+    {
+      id: "slides",
+      name: "Slides",
+      description: "Create presentations",
+      url: "https://slides.example.test",
+    },
+    {
+      id: "analytics",
+      name: "Analytics",
+      description: "Answer data questions",
+      url: "https://analytics.example.test",
+    },
+  ]);
+});
+describe("list_apps", () => {
+  it("returns a compact valid JSON message for MCP hosts", async () => {
+    const result = await listApps.run({});
+    expect(JSON.parse(result.message)).toEqual({
+      apps: [
+        { id: "slides", name: "Slides" },
+        { id: "analytics", name: "Analytics" },
+      ],
+    });
+    expect(result.apps).toEqual([
+      expect.objectContaining({
+        id: "slides",
+        url: "https://slides.example.test",
+      }),
+      expect.objectContaining({
+        id: "analytics",
+        url: "https://analytics.example.test",
+      }),
+    ]);
+  });
+});

package/src/actions/list_apps.ts CHANGED Viewed

@@ -12,17 +12,25 @@ export default defineAction({
   parallelSafe: true,
   run: async () => {
     const apps = await listGrantedDispatchMcpApps();
+    const appSummaries = apps.map((app) => ({
+      id: app.id,
+      name: app.name,
+      description: app.description,
+      url: app.url,
+      running: true,
+      source: "dispatch-mcp-grant",
+    }));
     return {
       workspace: true,
       gateway: "dispatch",
-      apps: apps.map((app) => ({
-        id: app.id,
-        name: app.name,
-        description: app.description,
-        url: app.url,
-        running: true,
-        source: "dispatch-mcp-grant",
-      })),
+      apps: appSummaries,
+      // MCP model-visible results are deliberately text-only unless a tool is
+      // app-only or opens an MCP App. Supplying a compact, valid JSON message
+      // keeps large app catalogs machine-readable instead of letting the
+      // generic text limiter cut the full result into invalid JSON.
+      message: JSON.stringify({
+        apps: appSummaries.map(({ id, name }) => ({ id, name })),
+      }),
     };
   },
 });

package/src/actions/set-mcp-app-access.spec.ts ADDED Viewed

@@ -0,0 +1,73 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+const mocks = vi.hoisted(() => ({
+  discoverAgents: vi.fn(),
+  setAccess: vi.fn(),
+  recordAudit: vi.fn(),
+  listAccess: vi.fn(),
+}));
+vi.mock("@agent-native/core/server/agent-discovery", () => ({
+  discoverAgents: mocks.discoverAgents,
+}));
+vi.mock("../server/lib/mcp-access-store.js", () => ({
+  setDispatchMcpAppAccessSettings: mocks.setAccess,
+}));
+vi.mock("../server/lib/dispatch-store.js", () => ({
+  recordAudit: mocks.recordAudit,
+}));
+vi.mock("./list-mcp-app-access.js", () => ({
+  default: { run: mocks.listAccess },
+}));
+import setMcpAppAccess from "./set-mcp-app-access.js";
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.discoverAgents.mockResolvedValue([
+    { id: "analytics" },
+    { id: "slides" },
+  ]);
+  mocks.setAccess.mockResolvedValue(undefined);
+  mocks.recordAudit.mockResolvedValue(undefined);
+  mocks.listAccess.mockResolvedValue({ mode: "selected-apps" });
+});
+describe("set-mcp-app-access", () => {
+  it("accepts Dispatch itself in selected-app mode", async () => {
+    await setMcpAppAccess.run({
+      mode: "selected-apps",
+      selectedAppIds: ["Dispatch", "slides"],
+    });
+    expect(mocks.setAccess).toHaveBeenCalledWith({
+      mode: "selected-apps",
+      selectedAppIds: ["dispatch", "slides"],
+    });
+  });
+  it("allows an owner or admin to revoke every app grant", async () => {
+    await setMcpAppAccess.run({
+      mode: "selected-apps",
+      selectedAppIds: [],
+    });
+    expect(mocks.setAccess).toHaveBeenCalledWith({
+      mode: "selected-apps",
+      selectedAppIds: [],
+    });
+  });
+  it("rejects unknown app ids before changing access", async () => {
+    await expect(
+      setMcpAppAccess.run({
+        mode: "selected-apps",
+        selectedAppIds: ["unknown"],
+      }),
+    ).rejects.toThrow(/Unknown app/);
+    expect(mocks.setAccess).not.toHaveBeenCalled();
+  });
+});

package/src/actions/set-mcp-app-access.ts CHANGED Viewed

@@ -22,7 +22,7 @@ export default defineAction({
   }),
   run: async (args) => {
     const agents = await discoverAgents("dispatch");
-    const knownIds = new Set(agents.map((agent) => agent.id));
+    const knownIds = new Set(["dispatch", ...agents.map((agent) => agent.id)]);
     const selectedAppIds = Array.from(
       new Set(
         args.selectedAppIds
@@ -36,10 +36,6 @@ export default defineAction({
         `Unknown app(s): ${unknown.join(", ")}. Use list-mcp-app-access to see available app IDs.`,
       );
     }
-    if (args.mode === "selected-apps" && selectedAppIds.length === 0) {
-      throw new Error("selected-apps mode requires at least one app ID.");
-    }
     await setDispatchMcpAppAccessSettings({
       mode: args.mode,
       selectedAppIds,