@agent-native/dispatch 0.27.3 → 0.27.4

package/dist/server/lib/mcp-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-gateway.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AA6B5E,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,uBAAuB,CAAC;AA4B/B,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAkCD,KAAK,iCAAiC,GAClC,WAAW,GACX,SAAS,GACT,cAAc,GACd,cAAc,CAAC;AAEnB,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,iBAAS,wBAAwB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GACT,wBAAwB,CAyC1B;AA+XD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;CAClC,CAAC,CAcD;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CACzD,wBAAwB,EAAE,CAC3B,CAGA;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG1E;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAwBnC;AAgHD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAqCtD;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CA+DnC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC,CAkDD;AA6MD,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAWD;AA8ED,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAmBD"}
+{"version":3,"file":"mcp-gateway.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,IAAI,EAAE,MAAM,wBAAwB,CAAC;AA6B5E,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,uBAAuB,CAAC;AA4B/B,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAkCD,KAAK,iCAAiC,GAClC,WAAW,GACX,SAAS,GACT,cAAc,GACd,cAAc,CAAC;AAEnB,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,iBAAS,wBAAwB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GACT,wBAAwB,CAyC1B;AA+XD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;CAClC,CAAC,CAcD;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CACzD,wBAAwB,EAAE,CAC3B,CAGA;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG1E;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAwBnC;AA6ID,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAqCtD;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CA+DnC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC,CAkDD;AA6MD,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAWD;AA8ED,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAmBD"}

package/dist/server/lib/mcp-gateway.js

@@ -462,6 +462,18 @@ function workspaceSsoOriginForApp(appId) {
     const custom = parseWorkspaceSsoAppRegistrations(process.env.IDENTITY_SSO_APP_REGISTRY_JSON).find((registration) => registration.appId === appId);
     return custom?.origin ?? null;
 }
+function workspaceSsoGatewayOrigin() {
+    const configured = process.env.WORKSPACE_GATEWAY_URL?.trim();
+    if (!configured)
+        return null;
+    try {
+        return new URL(configured).origin;
+    }
+    catch {
+        // coercion-ok: malformed deployment configuration is not a trusted origin.
+        return null;
+    }
+}
 function isWorkspaceSsoCanonicalApp(app) {
     const origin = safeAppOrigin(app);
     if (!origin)
@@ -498,7 +510,8 @@ async function isEligibleWorkspaceSsoApp(candidate, mountedApps) {
         color: DISPATCH_COLOR,
         granted: true,
     });
-    if (origin !== dispatchOrigin)
+    const trustedMountedOrigin = workspaceSsoGatewayOrigin() ?? dispatchOrigin;
+    if (origin !== trustedMountedOrigin)
         return false;
     return mountedApps.some((mounted) => sameWorkspaceApp(candidate, mounted));
 }
@@ -507,15 +520,34 @@ async function listWorkspaceSsoApps() {
         discoverAgents("dispatch"),
         listWorkspaceApps({ includeAgentCards: false }),
     ]);
-    const candidates = agents
-        .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)
-        .map((agent) => ({
-        ...toAccessibleApp(agent, {
-            mode: "all-apps",
-            selectedAppIds: [],
-        }),
-        granted: true,
-    }));
+    const candidatesById = new Map();
+    for (const agent of agents) {
+        if (normalizeAppId(agent.id) === DISPATCH_APP_ID)
+            continue;
+        candidatesById.set(agent.id, {
+            ...toAccessibleApp(agent, {
+                mode: "all-apps",
+                selectedAppIds: [],
+            }),
+            granted: true,
+        });
+    }
+    // The hosted Dispatch database is separate from the shared Workspace
+    // database. Overlay the live mounted registry so custom apps are eligible
+    // without copying a stale app list into Dispatch configuration.
+    for (const app of mountedApps) {
+        if (app.isDispatch || !app.url)
+            continue;
+        candidatesById.set(app.id, {
+            id: app.id,
+            name: app.name,
+            description: app.description,
+            url: app.url,
+            color: DISPATCH_COLOR,
+            granted: true,
+        });
+    }
+    const candidates = [...candidatesById.values()];
     const eligible = [];
     for (const candidate of candidates) {
         if (await isEligibleWorkspaceSsoApp(candidate, mountedApps)) {

package/dist/server/lib/mcp-gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-gateway.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAa,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,GAEf,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EACL,mCAAmC,EACnC,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,oBAAoB,GACxB,kGAAkG,CAAC;AACrG,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAC/C,MAAM,uCAAuC,GAAG,MAAM,CAAC;AACvD,MAAM,mCAAmC,GAAG,MAAM,CAAC;AACnD,MAAM,iCAAiC,GAAG,KAAK,CAAC;AAChD,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAC/C,MAAM,uCAAuC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAU,CAAC;AAC3E,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAC/C,WAAW;IACX,QAAQ;IACR,UAAU;IACV,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,iCAAkC,SAAQ,KAAK;IACnD;QACE,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAWD,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAY;IAC/C,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,uCAAuC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAU;IACxC,OAAO,gCAAgC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU;IAClC,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;QACxB,EAAE,MAAM,CACN,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CACvE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,IAAI,EAAE,CAChB,CAAC;AACJ,CAAC;AAyBD,SAAS,wBAAwB,CAC/B,GAAW,EACX,IAAU;IAEV,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG;QACX,GAAG;QACH,SAAS,EAAE,KAAc;QACzB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM;KACP,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,eAAe,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACjD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,KAAK,EAAE,QAAQ,IAAI,gBAAgB,MAAM,GAAG;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,aAAa,GACjB,QAAQ,IAAI,0DAA0D,CAAC;QACzE,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,aAAa;YACvB,aAAa;YACb,OAAO,EAAE,aAAa;SACvB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE,iCAAiC;QAC9C,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SACpC;QACD,OAAO,EACL,oBAAoB,MAAM,6BAA6B;YACvD,WAAW,IAAI,CAAC,EAAE,mCAAmC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAMtC;IAIC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,KAAK,EAAE,kBAA2B,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,EACf,EAAE,kBAAkB,EAAE,CACvB,CAAC;YACF,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,oEAAoE;QACtE,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAAE,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,SAAS;QAAE,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAA4B;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,iBAAiB,EAAE,EAAE,aAAa;YACpC,CAAC,CAAC,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,aAAa,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9D,OAAO;QACL,MAAM,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE;YACjD,gBAAgB,EACd,WAAW,IAAI,IAAI;gBACjB,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,+BAA+B,EAAE,WAAW,CAAC,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,GAAY;IACxD,OAAO,iCAAiC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACxD,CAAC;AAED,SAAS,iCAAiC,CACxC,GAAY;IAEZ,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,kCAAkC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,cAAc,CAAC;IACvE,IAAI,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,0EAA0E,CAAC,IAAI,CAC7E,UAAU,CACX,EACD,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kCAAkC,CAAC,GAAY;IACtD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,UAAU,GAAI,GAAkC,CAAC,IAAI,CAAC;IAC5D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAI,GAAG,CAAC,KAA4B,CAAC,IAAI,CAAC;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,8BAA8B,CAAC,MAAc;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAChD,GAAW,EACX,MAAc,EACd,aAAgD,EAChD,QAAgB;IAEhB,OAAO;QACL,GAAG;QACH,SAAS,EAAE,KAAK;QAChB,MAAM;QACN,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,IAAI;QACf,aAAa;QACb,QAAQ;QACR,WAAW,EAAE,iCAAiC;QAC9C,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SAC3B;QACD,OAAO,EACL,2EAA2E;YAC3E,mEAAmE;YACnE,wDAAwD;KAC3D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,SAA2B,EAC3B,QAAgB;IAEhB,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,IAAI,iCAAiC,EAAE,CAAC;IAEpE,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,SAAS,EAAE;YACX,IAAI,OAAO,CAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAClC,OAAO,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,iCAAiC,EAAE,CAAC,EACrD,WAAW,CACZ,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAiB,EACjB,IAAU,EACV,QAA4B;IAE5B,IAAI,QAAQ,IAAI,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CACR,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,SAAS,CAAC,CACvD,CACF,CAAC;QACF,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,OAAO,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,+BAA+B,CAC7C,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAC7B,QAAQ,CACT,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iCAAiC;gBAAE,OAAO,OAAO,CAAC;YACrE,IAAI,CAAC,oCAAoC,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA8B;IACtD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;QAC5E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,aAAa,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3E,IAAI,aAAa;QAAE,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAEhE,MAAM,UAAU,GACd,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QACjC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,UAAU;QAAE,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC1C,CAAC,CAAC,mCAAmC;QACrC,CAAC,CAAC,uBAAuB,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CACtB,QAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,oBAAoB;QACjC,GAAG,EAAE,mBAAmB,EAAE;QAC1B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,uBAAuB,CAAC,eAAe,EAAE,QAAQ,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE7D,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACnD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,MAA6D;IAE7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAA6B;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAA6B;IAC/C,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,8BAA8B,CACrC,GAA6B,EAC7B,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,OAAO,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAA6B;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA6B,EAAE,GAAQ;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA6B;IACvD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,GAA6B,EAAE,GAAQ;IAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjB,OAAO,GAAG,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAmB;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/C,OAAO,CACL,KAAK,KAAK,aAAa;QACvB,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;QAChC,KAAK,KAAK,QAAQ;QAClB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA6B,EAAE,IAAY;IACvE,IAAI,GAAG,CAAC,EAAE,KAAK,eAAe,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,oFAAoF,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAsB,EACtB,QAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAIvC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,+BAA+B,EAAE;QACjC,cAAc,CAAC,UAAU,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,IAAI,EAAE;YACJ,eAAe,CAAC,QAAQ,CAAC;YACzB,GAAG,MAAM;iBACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,eAAe,CAAC;iBAC/D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAG9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,IAAI,GAAG,MAAM,0BAA0B,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACrE,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,+DAA+D,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,CAAC,EAAE,oEAAoE,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qBAAqB,KAAK,CAAC,EAAE,wDAAwD,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,SAAS,GACb,mCAAmC,CACjC,KAAyD,CAC1D,CAAC;IACJ,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,iCAAiC,CAC9C,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAC3C,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACvD,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,0BAA0B,CAAC,GAA6B;IAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC7C,4EAA4E;IAC5E,yEAAyE;IACzE,+CAA+C;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,gBAAgB,CAAC,MAAM,CAAC;QACtE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAClC,mCAAmC,EACnC,GAAG,CAAC,EAAE,CACP;QACH,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAmC,EACnC,OAA4B;IAE5B,IAAI,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,SAAmC,EACnC,WAAkC;IAElC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,0BAA0B,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,YAAY,GAAG,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,cAAc,GAAG,aAAa,CAAC;QACnC,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,oBAAoB;QACjC,GAAG,EAAE,mBAAmB,EAAE;QAC1B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,cAAc,CAAC,UAAU,CAAC;QAC1B,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM;SACtB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,eAAe,CAAC;SAC/D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,GAAG,eAAe,CAAC,KAAK,EAAE;YACxB,IAAI,EAAE,UAAU;YAChB,cAAc,EAAE,EAAE;SACnB,CAAC;QACF,OAAO,EAAE,IAAI;KACd,CAAC,CAAC,CAAC;IACN,MAAM,QAAQ,GAAG,EAAgC,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO;QACL;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,oBAAoB;YACjC,GAAG,EAAE,mBAAmB,EAAE;YAC1B,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,IAAI;SACd;QACD,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,GAAW;IAEX,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACrE,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,4CAA4C,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,OAAe,EACf,OAAiD;IAEjD,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEjB,MAAM,YAAY,GAChB,OAAO,EAAE,KAAK,KAAK,IAAI;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACzD,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,SAAS;QACT,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KAChD,EACD,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAC1B,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW,EACX,MAAc;IAEd,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,SAAS;QACT,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,SAAS,EAAE,SAAS,IAAI,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,uCAAuC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,KACE,IAAI,OAAO,GAAG,CAAC,EACf,OAAO,IAAI,uCAAuC,CAAC,MAAM,EACzD,OAAO,EAAE,EACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACjD,OAAO,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,uCAAuC,CAAC,OAAO,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,aAAa,IAAI,IAAI,CAAC;YACxC,MAAM,SAAS,GAAG,SAAS,IAAI,OAAO,IAAI,IAAI,CAAC;YAC/C,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,2CAA2C,EAAE;oBACxD,GAAG,EAAE,MAAM,CAAC,EAAE;oBACd,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,aAAa;oBACrB,UAAU,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,CAAC;oBACtD,OAAO,EAAE,OAAO,GAAG,CAAC;oBACpB,WAAW;oBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACjC,aAAa;oBACb,SAAS,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG;oBACvD,SAAS,EAAE,kCAAkC,CAAC,GAAG,CAAC;oBAClD,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,MAAM,GAAG,CAAC;YAC1B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,yCAAyC,CAC9C,MAAM,CAAC,EAAE,EACT,aAAa,EACb,aAAa,EACb,WAAW,CACZ,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IAWC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,IAAI;QAAE,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI;QACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,aAAa,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,IAAI;YACJ,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACP,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAC7C,IAAI,YAAY,GAEL,IAAI,CAAC;IAChB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,oCAAoC,CAAC;gBACxD,GAAG,EAAE,MAAM,CAAC,EAAE;gBACd,GAAG;gBACH,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,uDAAuD,MAAM,CAAC,EAAE,GAAG,EACnE,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,EAAE;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG;QACH,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,YAAY,EAAE,UAAU;YAC1B,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,UAAU,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,YAAY,EAAE,SAAS,KAAK,QAAQ;YAC7C,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,SAAS,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,UAAU,GAAI,MAAc,CAAC,iBAAiB,CAAC;QACrD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC;YAClD,CAAC,CAAG,MAAc,CAAC,OAA0C;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CACrB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CACjE,EAAE,IAAI,CAAC;QACR,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAK,MAAc,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK;QACpB,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5B,IACE,mEAAmE,CAAC,IAAI,CACtE,OAAO,CACR,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,2HAA2H,CAAC,IAAI,CACrI,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,IAAI,GACR,kCAAkC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,OAAO,EAAE;gBACP,CAAC,QAAQ,CAAC,EAAE;oBACV,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM;oBACnC,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;qBACvC;iBACF;aACF;SACF,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAClD;gBACE,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;aAC/B,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,OAAO,IAAI,6BAA6B;gBACxC,CAAC,yBAAyB,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;gBACvC,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,SAAS,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAIC,EACD,OAIC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACrE,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO;YACL,GAAG,EAAE,WAAW;YAChB,IAAI;YACJ,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5D,OAAO;YACL,GAAG,EAAE,WAAW;YAChB,IAAI;YACJ,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI;SAChB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAIzC;IACC,OAAO,kBAAkB,CAAC,KAAK,EAAE;QAC/B,UAAU,EAAE,4BAA4B;QACxC,QAAQ,EAAE,0BAA0B;QACpC,QAAQ,EAAE,2DAA2D;KACtE,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAI7C;IACC,OAAO,kBAAkB,CAAC,KAAK,EAAE;QAC/B,UAAU,EAAE,sBAAsB;QAClC,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EACN,4EAA4E;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAM7C;IAMC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;QACtD,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,eAAe;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IAMC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAEvD,OAAO,gCAAgC,CAAC;QACtC,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,eAAe,EAAE;QACxB,MAAM;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAK/C;IAMC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAEpD,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,8BAA8B,CAAC;YACpC,UAAU;YACV,KAAK;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjB,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,eAAe,IAAI,eAAe,CAAC;IACzD,MAAM,eAAe,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,UAAU,EACV,eAAe,EACf,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAC5C;QACE,SAAS,EAAE,IAAI;QACf,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,kBAAkB,EAAE,CAAC,aAAa;KACnC,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM;KACP,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAI3C,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAKR;QACF,QAAQ,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC;QACrE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;KACnB,CAAC;IACF,IAAI,MAAM,CAAC,UAAU;QAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC7D,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAKpD;IAMC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IACzC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,2BAA2B,EAAE;QACtE,SAAS,EAAE,UAAU;QACrB,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,eAAe,EAAE;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,gCAAgC,CAAC;QACtC,UAAU;QACV,KAAK,EAAE,eAAe,EAAE;QACxB,MAAM;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { A2AClient, signA2AToken, type Task } from \"@agent-native/core/a2a\";\nimport { isFeatureFlagEnabled } from \"@agent-native/core/feature-flags\";\nimport {\n  buildMcpToolName,\n  McpClientManager,\n} from \"@agent-native/core/mcp-client\";\nimport { getOrgA2ASecret, getOrgDomain } from \"@agent-native/core/org\";\nimport {\n  buildDeepLink,\n  buildEmbedStartPath,\n  createEmbedSessionTicket,\n  getRequestContext,\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport {\n  discoverAgents,\n  type DiscoveredAgent,\n} from \"@agent-native/core/server/agent-discovery\";\n\nimport {\n  CANONICAL_WORKSPACE_SSO_APP_ORIGINS,\n  DISPATCH_WORKSPACE_SSO_FLAG,\n  parseWorkspaceSsoAppRegistrations,\n} from \"../../shared/workspace-sso.js\";\nimport {\n  listWorkspaceApps,\n  type WorkspaceAppSummary,\n} from \"./app-creation-store.js\";\nimport {\n  getDispatchMcpAppAccessSettings,\n  isAppAllowedByMcpAccess,\n  type DispatchMcpAppAccessSettings,\n} from \"./mcp-access-store.js\";\n\nconst DISPATCH_APP_ID = \"dispatch\";\nconst DISPATCH_NAME = \"Dispatch\";\nconst DISPATCH_DESCRIPTION =\n  \"Workspace control plane for extensions, agents, vault, integrations, approvals, and app routing.\";\nconst DISPATCH_COLOR = \"#14B8A6\";\nconst TARGET_EMBED_SESSION_ATTEMPTS = 3;\nconst TARGET_EMBED_SESSION_RETRY_BASE_MS = 250;\nconst DISPATCH_ASK_APP_DEFAULT_INLINE_WAIT_MS = 20_000;\nconst DISPATCH_ASK_APP_MAX_INLINE_WAIT_MS = 25_000;\nconst DISPATCH_ASK_APP_POLL_INTERVAL_MS = 1_500;\nconst DISPATCH_A2A_REQUEST_TIMEOUT_MS = 10_000;\nconst DISPATCH_ASK_APP_STATUS_RETRY_DELAYS_MS = [250, 750, 1_500] as const;\nconst DISPATCH_ASK_APP_TERMINAL_STATES = new Set([\n  \"completed\",\n  \"failed\",\n  \"canceled\",\n  \"input-required\",\n]);\n\nclass DispatchAskAppInlineDeadlineError extends Error {\n  constructor() {\n    super(\"ask_app inline wait deadline reached\");\n    this.name = \"DispatchAskAppInlineDeadlineError\";\n  }\n}\n\nexport interface DispatchMcpAccessibleApp {\n  id: string;\n  name: string;\n  description: string;\n  url: string;\n  color: string;\n  granted: boolean;\n}\n\nfunction normalizeAppId(value: string): string {\n  return value.trim().toLowerCase();\n}\n\nfunction boundedDispatchAskAppWaitMs(raw: unknown): number {\n  if (raw == null || raw === \"\") {\n    return DISPATCH_ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  }\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed)) return DISPATCH_ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  return Math.max(\n    0,\n    Math.min(DISPATCH_ASK_APP_MAX_INLINE_WAIT_MS, Math.trunc(parsed)),\n  );\n}\n\nfunction isTerminalDispatchTask(task: Task): boolean {\n  return DISPATCH_ASK_APP_TERMINAL_STATES.has(String(task.status.state));\n}\n\nfunction dispatchTaskText(task: Task): string {\n  return (\n    task.status.message?.parts\n      ?.filter(\n        (part): part is { type: \"text\"; text: string } => part.type === \"text\",\n      )\n      .map((part) => part.text)\n      .join(\"\\n\")\n      .trim() ?? \"\"\n  );\n}\n\ntype DispatchAskAppStatusErrorCategory =\n  | \"transport\"\n  | \"timeout\"\n  | \"upstream_5xx\"\n  | \"rate_limited\";\n\ntype DispatchAskAppTaskResult = {\n  app: string;\n  routedVia: \"a2a\";\n  taskId: string;\n  status: string;\n  response?: string;\n  error?: string;\n  inputRequired?: string;\n  statusRead?: \"unavailable\";\n  retryable?: true;\n  errorCategory?: DispatchAskAppStatusErrorCategory;\n  attempts?: number;\n  pollAfterMs?: number;\n  poll?: { tool: \"ask_app_status\"; arguments: { app: string; taskId: string } };\n  message?: string;\n};\n\nfunction dispatchAskAppTaskResult(\n  app: string,\n  task: Task,\n): DispatchAskAppTaskResult {\n  const status = String(task.status.state);\n  const response = dispatchTaskText(task);\n  const base = {\n    app,\n    routedVia: \"a2a\" as const,\n    taskId: task.id,\n    status,\n  };\n\n  if (status === \"completed\") {\n    return { ...base, response: response || \"(no response)\" };\n  }\n  if (status === \"failed\" || status === \"canceled\") {\n    return {\n      ...base,\n      ...(response ? { response } : {}),\n      error: response || `ask_app task ${status}.`,\n    };\n  }\n  if (status === \"input-required\") {\n    const inputRequired =\n      response || \"The agent needs additional input before it can continue.\";\n    return {\n      ...base,\n      response: inputRequired,\n      inputRequired,\n      message: inputRequired,\n    };\n  }\n  return {\n    ...base,\n    pollAfterMs: DISPATCH_ASK_APP_POLL_INTERVAL_MS,\n    poll: {\n      tool: \"ask_app_status\",\n      arguments: { app, taskId: task.id },\n    },\n    message:\n      `ask_app is still ${status}. Call ask_app_status with ` +\n      `taskId \"${task.id}\" to retrieve the final response.`,\n  };\n}\n\nasync function createDispatchA2AClient(input: {\n  targetUrl: string;\n  userEmail: string;\n  orgDomain?: string;\n  orgSecret?: string;\n  deadline?: number;\n}): Promise<{\n  client: A2AClient;\n  metadata: Record<string, unknown>;\n}> {\n  const apiKeys: string[] = [];\n  const addSignedToken = async (preferGlobalSecret: boolean) => {\n    try {\n      const token = await signA2AToken(\n        input.userEmail,\n        input.orgDomain,\n        input.orgSecret,\n        { preferGlobalSecret },\n      );\n      if (token && !apiKeys.includes(token)) apiKeys.push(token);\n    } catch {\n      // A2A can still be configured for local/dev unauthenticated calls. If\n      // signing is unavailable, let the target return its own auth error.\n    }\n  };\n\n  if (process.env.A2A_SECRET?.trim()) await addSignedToken(true);\n  if (input.orgSecret) await addSignedToken(false);\n\n  const metadata: Record<string, unknown> = {\n    userEmail: input.userEmail,\n    ...(input.orgDomain ? { orgDomain: input.orgDomain } : {}),\n    ...(getRequestContext()?.requestOrigin\n      ? { requestOrigin: getRequestContext()?.requestOrigin }\n      : {}),\n  };\n  const remainingMs =\n    input.deadline == null ? null : input.deadline - Date.now();\n  return {\n    client: new A2AClient(input.targetUrl, apiKeys[0], {\n      requestTimeoutMs:\n        remainingMs == null\n          ? DISPATCH_A2A_REQUEST_TIMEOUT_MS\n          : Math.max(1, Math.min(DISPATCH_A2A_REQUEST_TIMEOUT_MS, remainingMs)),\n      ...(apiKeys.length > 1 ? { fallbackApiKeys: apiKeys.slice(1) } : {}),\n    }),\n    metadata,\n  };\n}\n\nfunction isTransientDispatchAskAppStatusError(err: unknown): boolean {\n  return dispatchAskAppStatusErrorCategory(err) != null;\n}\n\nfunction dispatchAskAppStatusErrorCategory(\n  err: unknown,\n): DispatchAskAppStatusErrorCategory | null {\n  const message = err instanceof Error ? err.message : String(err ?? \"\");\n  const causeCode = dispatchAskAppStatusErrorCauseCode(err) ?? \"\";\n  const diagnostic = `${message} ${causeCode}`;\n  if (/A2A request failed \\(429\\)/i.test(message)) return \"rate_limited\";\n  if (/A2A request failed \\((?:500|502|503|504)\\)/i.test(message)) {\n    return \"upstream_5xx\";\n  }\n  if (/etimedout|timeout|aborted|aborterror/i.test(diagnostic)) {\n    return \"timeout\";\n  }\n  if (\n    /\\bfetch failed\\b|failed to fetch|networkerror|socket hang up|econnreset/i.test(\n      diagnostic,\n    )\n  ) {\n    return \"transport\";\n  }\n  return null;\n}\n\nfunction dispatchAskAppStatusErrorCauseCode(err: unknown): string | undefined {\n  if (!(err instanceof Error)) return undefined;\n  const directCode = (err as Error & { code?: unknown }).code;\n  if (typeof directCode === \"string\" && directCode.trim()) {\n    return directCode.trim();\n  }\n  if (!err.cause || typeof err.cause !== \"object\") return undefined;\n  const code = (err.cause as { code?: unknown }).code;\n  return typeof code === \"string\" && code.trim() ? code.trim() : undefined;\n}\n\nfunction dispatchAskAppStatusOriginHost(origin: string): string {\n  try {\n    return new URL(origin).host;\n  } catch {\n    return \"unknown\";\n  }\n}\n\nfunction dispatchAskAppStatusReadUnavailableResult(\n  app: string,\n  taskId: string,\n  errorCategory: DispatchAskAppStatusErrorCategory,\n  attempts: number,\n): DispatchAskAppTaskResult {\n  return {\n    app,\n    routedVia: \"a2a\",\n    taskId,\n    status: \"unknown\",\n    statusRead: \"unavailable\",\n    retryable: true,\n    errorCategory,\n    attempts,\n    pollAfterMs: DISPATCH_ASK_APP_POLL_INTERVAL_MS,\n    poll: {\n      tool: \"ask_app_status\",\n      arguments: { app, taskId },\n    },\n    message:\n      \"The durable ask_app task status could not be read after bounded retries. \" +\n      \"The task may still be running or completed. Retry ask_app_status \" +\n      \"with the same app and taskId; do not resubmit ask_app.\",\n  };\n}\n\nasync function runBeforeDispatchAskAppDeadline<T>(\n  operation: () => Promise<T>,\n  deadline: number,\n): Promise<T> {\n  const remainingMs = deadline - Date.now();\n  if (remainingMs <= 0) throw new DispatchAskAppInlineDeadlineError();\n\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      operation(),\n      new Promise<T>((_resolve, reject) => {\n        timeout = setTimeout(\n          () => reject(new DispatchAskAppInlineDeadlineError()),\n          remainingMs,\n        );\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nasync function waitForDispatchA2ATask(\n  client: A2AClient,\n  task: Task,\n  deadline: number | undefined,\n): Promise<Task> {\n  if (deadline == null || isTerminalDispatchTask(task)) return task;\n  let current = task;\n  while (!isTerminalDispatchTask(current)) {\n    const remaining = deadline - Date.now();\n    if (remaining <= 0) return current;\n    await new Promise((resolve) =>\n      setTimeout(\n        resolve,\n        Math.min(DISPATCH_ASK_APP_POLL_INTERVAL_MS, remaining),\n      ),\n    );\n    if (Date.now() >= deadline) return current;\n    try {\n      current = await runBeforeDispatchAskAppDeadline(\n        () => client.getTask(task.id),\n        deadline,\n      );\n    } catch (err) {\n      if (err instanceof DispatchAskAppInlineDeadlineError) return current;\n      if (!isTransientDispatchAskAppStatusError(err)) throw err;\n      if (Date.now() >= deadline) return current;\n    }\n  }\n  return current;\n}\n\nfunction normalizeBaseUrl(raw: string | undefined | null): string | null {\n  const value = raw?.trim();\n  if (!value) return null;\n  try {\n    const url = new URL(value);\n    if (url.protocol !== \"http:\" && url.protocol !== \"https:\") return null;\n    return url.toString().replace(/\\/+$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeBasePath(value: string | undefined): string {\n  const trimmed = value?.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  const normalized = trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  return normalized ? `/${normalized}` : \"\";\n}\n\nfunction withConfiguredBasePath(baseUrl: string): string {\n  const basePath = normalizeBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n  if (!basePath) return baseUrl;\n  try {\n    const url = new URL(baseUrl);\n    const path = normalizeBasePath(url.pathname);\n    if (path === basePath || path.startsWith(`${basePath}/`)) {\n      return baseUrl;\n    }\n    url.pathname = path && path !== \"/\" ? `${basePath}${path}` : `${basePath}/`;\n    return url.toString().replace(/\\/+$/, \"\");\n  } catch {\n    return baseUrl;\n  }\n}\n\nfunction dispatchSelfBaseUrl(): string {\n  const requestOrigin = normalizeBaseUrl(getRequestContext()?.requestOrigin);\n  if (requestOrigin) return withConfiguredBasePath(requestOrigin);\n\n  const configured =\n    normalizeBaseUrl(process.env.WORKSPACE_GATEWAY_URL) ??\n    normalizeBaseUrl(process.env.APP_URL) ??\n    normalizeBaseUrl(process.env.URL) ??\n    normalizeBaseUrl(process.env.DEPLOY_URL) ??\n    normalizeBaseUrl(process.env.BETTER_AUTH_URL);\n  if (configured) return withConfiguredBasePath(configured);\n\n  return process.env.NODE_ENV === \"production\"\n    ? \"https://dispatch.agent-native.com\"\n    : \"http://localhost:8092\";\n}\n\nfunction dispatchSelfApp(\n  settings: DispatchMcpAppAccessSettings,\n): DispatchMcpAccessibleApp {\n  return {\n    id: DISPATCH_APP_ID,\n    name: DISPATCH_NAME,\n    description: DISPATCH_DESCRIPTION,\n    url: dispatchSelfBaseUrl(),\n    color: DISPATCH_COLOR,\n    granted: isAppAllowedByMcpAccess(DISPATCH_APP_ID, settings),\n  };\n}\n\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\n\nfunction safeAppPath(raw: unknown): string | null {\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\n  const value = raw.trim();\n  if (CONTROL_CHARS.test(value)) return null;\n  if (!value.startsWith(\"/\")) return null;\n  if (value.startsWith(\"//\") || value.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(value)) return null;\n  if (/%(?:2f|5c)/i.test(value)) return null;\n  const rawPath = value.split(/[?#]/, 1)[0] ?? value;\n  let parsed: URL;\n  try {\n    parsed = new URL(value, \"http://agent-native.invalid\");\n  } catch {\n    return null;\n  }\n  if (parsed.pathname !== rawPath) return null;\n  return value;\n}\n\nfunction appendParamsToPath(\n  path: string,\n  params: Record<string, string | number | boolean> | undefined,\n): string {\n  if (!params || Object.keys(params).length === 0) return path;\n  const url = new URL(path, \"http://agent-native.invalid\");\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, String(value));\n  }\n  return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction safeAppOrigin(app: DispatchMcpAccessibleApp): string | null {\n  try {\n    const url = new URL(app.url);\n    return url.protocol === \"http:\" || url.protocol === \"https:\"\n      ? url.origin\n      : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    const hostname = new URL(origin).hostname;\n    return [\"localhost\", \"127.0.0.1\", \"::1\"].includes(hostname);\n  } catch {\n    // coercion-ok: only a previously validated app origin reaches this helper;\n    // malformed values are ineligible for the loopback development exception.\n    return false;\n  }\n}\n\nfunction appBaseUrl(app: DispatchMcpAccessibleApp): string {\n  return app.url.replace(/\\/+$/, \"\");\n}\n\nfunction resolveGrantedAppEmbedStartUrl(\n  app: DispatchMcpAccessibleApp,\n  startUrl: string,\n): string {\n  try {\n    const baseUrl = appBaseUrl(app);\n    const resolved = new URL(startUrl, `${baseUrl}/`);\n    if (!appMatchesUrlPath(app, resolved)) {\n      throw new Error(\n        \"Target app returned an embed start URL outside the granted app.\",\n      );\n    }\n    return resolved.toString();\n  } catch {\n    throw new Error(\"Target app returned an invalid embed start URL.\");\n  }\n}\n\nfunction appBasePath(app: DispatchMcpAccessibleApp): string {\n  const pathname = new URL(appBaseUrl(app)).pathname.replace(/\\/+$/, \"\");\n  return pathname === \"/\" ? \"\" : pathname;\n}\n\nfunction appMatchesUrlPath(app: DispatchMcpAccessibleApp, url: URL): boolean {\n  const origin = safeAppOrigin(app);\n  if (!origin || url.origin !== origin) return false;\n  const basePath = appBasePath(app);\n  if (!basePath) return true;\n  return url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);\n}\n\nfunction appPathSpecificity(app: DispatchMcpAccessibleApp): number {\n  return appBasePath(app).length;\n}\n\nfunction appRelativePath(app: DispatchMcpAccessibleApp, url: URL): string {\n  const basePath = appBasePath(app);\n  const path = basePath\n    ? url.pathname === basePath\n      ? \"/\"\n      : url.pathname.slice(basePath.length)\n    : url.pathname;\n  return `${path || \"/\"}${url.search}${url.hash}`;\n}\n\nfunction isDispatchControlPath(path: string | null): boolean {\n  if (!path) return false;\n  const route = path.split(/[?#]/, 1)[0] ?? path;\n  return (\n    route === \"/extensions\" ||\n    route.startsWith(\"/extensions/\") ||\n    route === \"/tools\" ||\n    route.startsWith(\"/tools/\")\n  );\n}\n\nfunction assertAppCanOpenPath(app: DispatchMcpAccessibleApp, path: string) {\n  if (app.id !== DISPATCH_APP_ID && isDispatchControlPath(path)) {\n    throw new Error(\n      `Path \"${path}\" belongs to Dispatch. Use app: \"dispatch\" for Dispatch extension and tool routes.`,\n    );\n  }\n}\n\nfunction toAccessibleApp(\n  agent: DiscoveredAgent,\n  settings: DispatchMcpAppAccessSettings,\n): DispatchMcpAccessibleApp {\n  return {\n    id: agent.id,\n    name: agent.name,\n    description: agent.description,\n    url: agent.url,\n    color: agent.color,\n    granted: isAppAllowedByMcpAccess(agent.id, settings),\n  };\n}\n\nexport async function listDispatchMcpApps(): Promise<{\n  settings: DispatchMcpAppAccessSettings;\n  apps: DispatchMcpAccessibleApp[];\n}> {\n  const [settings, agents] = await Promise.all([\n    getDispatchMcpAppAccessSettings(),\n    discoverAgents(\"dispatch\"),\n  ]);\n  return {\n    settings,\n    apps: [\n      dispatchSelfApp(settings),\n      ...agents\n        .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)\n        .map((agent) => toAccessibleApp(agent, settings)),\n    ],\n  };\n}\n\nexport async function listGrantedDispatchMcpApps(): Promise<\n  DispatchMcpAccessibleApp[]\n> {\n  const { apps } = await listDispatchMcpApps();\n  return apps.filter((app) => app.granted && safeAppOrigin(app));\n}\n\nexport async function listGrantedDispatchMcpAppOrigins(): Promise<string[]> {\n  const apps = await listGrantedDispatchMcpApps();\n  return Array.from(new Set(apps.flatMap((app) => safeAppOrigin(app) ?? [])));\n}\n\nexport async function resolveGrantedDispatchMcpApp(\n  app: string,\n): Promise<DispatchMcpAccessibleApp> {\n  const target = normalizeAppId(app);\n  if (!target) throw new Error(\"app is required\");\n  const { apps } = await listDispatchMcpApps();\n  const match = apps.find(\n    (candidate) =>\n      candidate.id === target || candidate.name.toLowerCase() === target,\n  );\n  if (!match) {\n    throw new Error(\n      `Unknown app \"${app}\". Call list_apps to see apps available through Dispatch MCP.`,\n    );\n  }\n  if (!match.granted) {\n    throw new Error(\n      `Dispatch MCP access to \"${match.id}\" is not granted. Open Dispatch > Agents to change MCP app access.`,\n    );\n  }\n  if (!safeAppOrigin(match)) {\n    throw new Error(\n      `Dispatch MCP app \"${match.id}\" has an invalid URL and cannot be opened through MCP.`,\n    );\n  }\n  return match;\n}\n\nfunction workspaceSsoOriginForApp(appId: string): string | null {\n  const canonical =\n    CANONICAL_WORKSPACE_SSO_APP_ORIGINS[\n      appId as keyof typeof CANONICAL_WORKSPACE_SSO_APP_ORIGINS\n    ];\n  if (canonical) return canonical;\n  const custom = parseWorkspaceSsoAppRegistrations(\n    process.env.IDENTITY_SSO_APP_REGISTRY_JSON,\n  ).find((registration) => registration.appId === appId);\n  return custom?.origin ?? null;\n}\n\nfunction isWorkspaceSsoCanonicalApp(app: DispatchMcpAccessibleApp): boolean {\n  const origin = safeAppOrigin(app);\n  if (!origin) return false;\n  const registeredOrigin = workspaceSsoOriginForApp(app.id);\n  if (origin === registeredOrigin) return true;\n  // The built-in discovery table intentionally points at local dev ports when\n  // running outside production. Keep local development usable without ever\n  // weakening the production exact-origin check.\n  return process.env.NODE_ENV !== \"production\" && isLoopbackOrigin(origin)\n    ? Object.prototype.hasOwnProperty.call(\n        CANONICAL_WORKSPACE_SSO_APP_ORIGINS,\n        app.id,\n      )\n    : false;\n}\n\nfunction sameWorkspaceApp(\n  candidate: DispatchMcpAccessibleApp,\n  mounted: WorkspaceAppSummary,\n): boolean {\n  if (candidate.id !== mounted.id || !mounted.url) return false;\n  return candidate.url.replace(/\\/+$/, \"\") === mounted.url.replace(/\\/+$/, \"\");\n}\n\nasync function isEligibleWorkspaceSsoApp(\n  candidate: DispatchMcpAccessibleApp,\n  mountedApps: WorkspaceAppSummary[],\n): Promise<boolean> {\n  const origin = safeAppOrigin(candidate);\n  if (!origin) return false;\n  if (isWorkspaceSsoCanonicalApp(candidate)) return true;\n\n  const customOrigin = workspaceSsoOriginForApp(candidate.id);\n  if (customOrigin === origin) return true;\n\n  const dispatchOrigin = safeAppOrigin({\n    id: DISPATCH_APP_ID,\n    name: DISPATCH_NAME,\n    description: DISPATCH_DESCRIPTION,\n    url: dispatchSelfBaseUrl(),\n    color: DISPATCH_COLOR,\n    granted: true,\n  });\n  if (origin !== dispatchOrigin) return false;\n  return mountedApps.some((mounted) => sameWorkspaceApp(candidate, mounted));\n}\n\nasync function listWorkspaceSsoApps(): Promise<DispatchMcpAccessibleApp[]> {\n  const [agents, mountedApps] = await Promise.all([\n    discoverAgents(\"dispatch\"),\n    listWorkspaceApps({ includeAgentCards: false }),\n  ]);\n  const candidates = agents\n    .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)\n    .map((agent) => ({\n      ...toAccessibleApp(agent, {\n        mode: \"all-apps\",\n        selectedAppIds: [],\n      }),\n      granted: true,\n    }));\n  const eligible = [] as DispatchMcpAccessibleApp[];\n  for (const candidate of candidates) {\n    if (await isEligibleWorkspaceSsoApp(candidate, mountedApps)) {\n      eligible.push(candidate);\n    }\n  }\n  return [\n    {\n      id: DISPATCH_APP_ID,\n      name: DISPATCH_NAME,\n      description: DISPATCH_DESCRIPTION,\n      url: dispatchSelfBaseUrl(),\n      color: DISPATCH_COLOR,\n      granted: true,\n    },\n    ...eligible,\n  ];\n}\n\nasync function resolveWorkspaceSsoApp(\n  app: string,\n): Promise<DispatchMcpAccessibleApp> {\n  const target = normalizeAppId(app);\n  if (!target) throw new Error(\"app is required\");\n  const apps = await listWorkspaceSsoApps();\n  const match = apps.find(\n    (candidate) =>\n      candidate.id === target || candidate.name.toLowerCase() === target,\n  );\n  if (!match) {\n    throw new Error(\n      `Workspace app \"${app}\" is not registered for workspace sign-in.`,\n    );\n  }\n  return match;\n}\n\nexport async function askGrantedDispatchMcpApp(\n  app: string,\n  message: string,\n  options?: { async?: boolean; maxWaitMs?: number },\n): Promise<ReturnType<typeof dispatchAskAppTaskResult>> {\n  const trimmedMessage = message.trim();\n  if (!trimmedMessage) throw new Error(\"message is required\");\n  const target = await resolveGrantedDispatchMcpApp(app);\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  const orgId = getRequestOrgId();\n  const [orgDomain, orgSecret] = orgId\n    ? await Promise.all([\n        getOrgDomain(orgId).catch(() => null),\n        getOrgA2ASecret(orgId).catch(() => null),\n      ])\n    : [null, null];\n\n  const inlineWaitMs =\n    options?.async === true\n      ? 0\n      : boundedDispatchAskAppWaitMs(options?.maxWaitMs);\n  const deadline = inlineWaitMs > 0 ? Date.now() + inlineWaitMs : undefined;\n\n  const { client, metadata } = await createDispatchA2AClient({\n    targetUrl: target.url,\n    userEmail,\n    orgDomain: orgDomain ?? undefined,\n    orgSecret: orgSecret ?? undefined,\n    deadline,\n  });\n  const task = await client.send(\n    {\n      role: \"user\",\n      parts: [{ type: \"text\", text: trimmedMessage }],\n    },\n    { async: true, metadata },\n  );\n  const finalOrRunning = await waitForDispatchA2ATask(client, task, deadline);\n  return dispatchAskAppTaskResult(target.id, finalOrRunning);\n}\n\nexport async function getGrantedDispatchMcpAppTask(\n  app: string,\n  taskId: string,\n): Promise<DispatchAskAppTaskResult> {\n  const trimmedTaskId = taskId.trim();\n  if (!trimmedTaskId) throw new Error(\"taskId is required\");\n  const target = await resolveGrantedDispatchMcpApp(app);\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  const orgId = getRequestOrgId();\n  const [orgDomain, orgSecret] = orgId\n    ? await Promise.all([\n        getOrgDomain(orgId).catch(() => null),\n        getOrgA2ASecret(orgId).catch(() => null),\n      ])\n    : [null, null];\n  const { client } = await createDispatchA2AClient({\n    targetUrl: target.url,\n    userEmail,\n    orgDomain: orgDomain ?? undefined,\n    orgSecret: orgSecret ?? undefined,\n  });\n  const maxAttempts = DISPATCH_ASK_APP_STATUS_RETRY_DELAYS_MS.length + 1;\n  for (\n    let attempt = 0;\n    attempt <= DISPATCH_ASK_APP_STATUS_RETRY_DELAYS_MS.length;\n    attempt++\n  ) {\n    const startedAt = Date.now();\n    try {\n      const task = await client.getTask(trimmedTaskId);\n      return dispatchAskAppTaskResult(target.id, task);\n    } catch (err) {\n      const delayMs = DISPATCH_ASK_APP_STATUS_RETRY_DELAYS_MS[attempt];\n      const errorCategory = dispatchAskAppStatusErrorCategory(err);\n      const retryable = errorCategory != null;\n      const willRetry = retryable && delayMs != null;\n      if (retryable) {\n        console.warn(\"[ask_app_status] tasks/get attempt failed\", {\n          app: target.id,\n          routedVia: \"a2a\",\n          taskId: trimmedTaskId,\n          originHost: dispatchAskAppStatusOriginHost(target.url),\n          attempt: attempt + 1,\n          maxAttempts,\n          elapsedMs: Date.now() - startedAt,\n          errorCategory,\n          errorName: err instanceof Error ? err.name : typeof err,\n          causeCode: dispatchAskAppStatusErrorCauseCode(err),\n          willRetry,\n        });\n      }\n      if (!retryable) throw err;\n      if (delayMs == null) {\n        return dispatchAskAppStatusReadUnavailableResult(\n          target.id,\n          trimmedTaskId,\n          errorCategory,\n          maxAttempts,\n        );\n      }\n      await new Promise((resolve) => setTimeout(resolve, delayMs));\n    }\n  }\n  throw new Error(\"ask_app_status retry loop exited unexpectedly.\");\n}\n\nexport async function openGrantedDispatchMcpApp(input: {\n  app: string;\n  view?: string;\n  path?: string;\n  params?: Record<string, string | number | boolean>;\n  embed?: boolean;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  app: string;\n  view?: string;\n  path?: string;\n  url: string;\n  embed?: boolean;\n  chrome?: \"full\" | \"minimal\";\n  embedStartUrl?: string;\n  embedTargetPath?: string;\n  embedExpiresAt?: number;\n}> {\n  const view = input.view?.trim() ?? \"\";\n  const hasPathInput = input.path != null;\n  const path = safeAppPath(input.path);\n  if (hasPathInput && !path) {\n    throw new Error(\"path must be a safe app-relative route\");\n  }\n  if (!view && !path) throw new Error(\"open_app requires view or path\");\n  const target = await resolveGrantedDispatchMcpApp(input.app);\n  if (path) assertAppCanOpenPath(target, path);\n  const relUrl = path\n    ? appendParamsToPath(path, input.params)\n    : buildDeepLink({\n        app: target.id,\n        view,\n        params: input.params,\n      });\n  const url = `${appBaseUrl(target)}${relUrl}`;\n  let embedSession: Awaited<\n    ReturnType<typeof createGrantedDispatchMcpEmbedSession>\n  > | null = null;\n  if (input.embed) {\n    try {\n      embedSession = await createGrantedDispatchMcpEmbedSession({\n        app: target.id,\n        url,\n        chrome: input.chrome,\n      });\n    } catch (error) {\n      console.warn(\n        `[dispatch] Could not pre-mint MCP embed session for ${target.id}:`,\n        error,\n      );\n    }\n  }\n  return {\n    app: target.id,\n    ...(view ? { view } : {}),\n    ...(path ? { path } : {}),\n    url,\n    ...(input.embed === true ? { embed: true } : {}),\n    ...(input.chrome ? { chrome: input.chrome } : {}),\n    ...(embedSession?.startUrl ? { embedStartUrl: embedSession.startUrl } : {}),\n    ...(embedSession?.targetPath\n      ? { embedTargetPath: embedSession.targetPath }\n      : {}),\n    ...(typeof embedSession?.expiresAt === \"number\"\n      ? { embedExpiresAt: embedSession.expiresAt }\n      : {}),\n  };\n}\n\nfunction parseMcpToolTextResult(result: unknown): Record<string, unknown> {\n  if (result && typeof result === \"object\") {\n    const structured = (result as any).structuredContent;\n    if (structured && typeof structured === \"object\") return structured;\n    const parts = Array.isArray((result as any).content)\n      ? ((result as any).content as Array<Record<string, unknown>>)\n      : [];\n    const text = parts.find(\n      (part) => part?.type === \"text\" && typeof part.text === \"string\",\n    )?.text;\n    if (typeof text === \"string\" && text.trim()) {\n      if ((result as any).isError) throw new Error(text.trim());\n      const parsed = JSON.parse(text);\n      if (parsed && typeof parsed === \"object\") return parsed;\n    }\n  }\n  throw new Error(\"Target app did not return an embed session.\");\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction isRetryableTargetMcpError(error: unknown): boolean {\n  const message =\n    error instanceof Error\n      ? error.message\n      : typeof error === \"string\"\n        ? error\n        : String(error ?? \"\");\n  if (\n    /rejected the request|unauthorized|forbidden|401|403|404|405|html/i.test(\n      message,\n    )\n  ) {\n    return false;\n  }\n  return /streamable http|handshake|failed to fetch|fetch failed|networkerror|econnrefused|enotfound|timed out|timeout|502|503|504/i.test(\n    message,\n  );\n}\n\nfunction targetMcpRetryDelay(attempt: number): number {\n  const base =\n    TARGET_EMBED_SESSION_RETRY_BASE_MS * Math.pow(2, Math.max(0, attempt - 1));\n  return base + Math.floor(Math.random() * 100);\n}\n\nasync function callTargetCreateEmbedSession(input: {\n  app: DispatchMcpAccessibleApp;\n  token: string;\n  url: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<unknown> {\n  const serverId = \"target\";\n  for (let attempt = 1; ; attempt += 1) {\n    const manager = new McpClientManager({\n      servers: {\n        [serverId]: {\n          type: \"http\",\n          url: `${appBaseUrl(input.app)}/mcp`,\n          headers: {\n            Authorization: `Bearer ${input.token}`,\n          },\n        },\n      },\n    });\n    try {\n      await manager.start();\n      return await manager.callTool(\n        buildMcpToolName(serverId, \"create_embed_session\"),\n        {\n          url: input.url,\n          chrome: input.chrome ?? \"full\",\n        },\n      );\n    } catch (error) {\n      if (\n        attempt >= TARGET_EMBED_SESSION_ATTEMPTS ||\n        !isRetryableTargetMcpError(error)\n      ) {\n        throw error;\n      }\n      await sleep(targetMcpRetryDelay(attempt));\n    } finally {\n      await manager.stop().catch((stopError) => {\n        console.warn(\"[dispatch] Failed to stop target MCP client:\", stopError);\n      });\n    }\n  }\n}\n\nasync function resolveEmbedTarget(\n  input: {\n    app?: string;\n    url?: string;\n    path?: string;\n  },\n  options: {\n    resolveApp: (app: string) => Promise<DispatchMcpAccessibleApp>;\n    listApps: () => Promise<DispatchMcpAccessibleApp[]>;\n    urlError: string;\n  },\n): Promise<{ app: DispatchMcpAccessibleApp; path: string; url: string }> {\n  const explicitApp = input.app?.trim()\n    ? await options.resolveApp(input.app)\n    : null;\n  if (explicitApp && input.path) {\n    const path = safeAppPath(input.path);\n    if (!path) throw new Error(\"path must be a safe app-relative route\");\n    assertAppCanOpenPath(explicitApp, path);\n    return {\n      app: explicitApp,\n      path,\n      url: `${appBaseUrl(explicitApp)}${path}`,\n    };\n  }\n\n  if (!input.url) {\n    throw new Error(\"create_embed_session requires a url or app + path.\");\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(input.url);\n  } catch {\n    if (!explicitApp) {\n      throw new Error(\"Relative embed paths require an app id.\");\n    }\n    const path = safeAppPath(input.url);\n    if (!path) throw new Error(\"url must be a safe app route.\");\n    return {\n      app: explicitApp,\n      path,\n      url: `${appBaseUrl(explicitApp)}${path}`,\n    };\n  }\n\n  const apps = explicitApp ? [explicitApp] : await options.listApps();\n  const target = apps\n    .filter((app) => appMatchesUrlPath(app, parsed))\n    .sort((a, b) => appPathSpecificity(b) - appPathSpecificity(a))[0];\n  if (!target) {\n    throw new Error(options.urlError);\n  }\n  const path = safeAppPath(appRelativePath(target, parsed));\n  if (!path) throw new Error(\"Embed URL path is not safe.\");\n  assertAppCanOpenPath(target, path);\n  return { app: target, path, url: `${appBaseUrl(target)}${path}` };\n}\n\nasync function resolveDispatchEmbedTarget(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n}): Promise<{ app: DispatchMcpAccessibleApp; path: string; url: string }> {\n  return resolveEmbedTarget(input, {\n    resolveApp: resolveGrantedDispatchMcpApp,\n    listApps: listGrantedDispatchMcpApps,\n    urlError: \"Embed URL must belong to an app granted through Dispatch.\",\n  });\n}\n\nasync function resolveWorkspaceSsoEmbedTarget(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n}): Promise<{ app: DispatchMcpAccessibleApp; path: string; url: string }> {\n  return resolveEmbedTarget(input, {\n    resolveApp: resolveWorkspaceSsoApp,\n    listApps: listWorkspaceSsoApps,\n    urlError:\n      \"Embed URL must belong to an app registered for Dispatch workspace sign-in.\",\n  });\n}\n\nasync function createDispatchSelfEmbedSession(input: {\n  ownerEmail: string;\n  orgId?: string;\n  path: string;\n  baseUrl: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const ticket = await createEmbedSessionTicket({\n    ownerEmail: input.ownerEmail,\n    orgId: input.orgId,\n    targetPath: input.path,\n    scope: input.chrome ?? null,\n  });\n  const startPath = buildEmbedStartPath(ticket.ticket);\n  return {\n    startUrl: new URL(startPath, input.baseUrl).toString(),\n    targetPath: input.path,\n    expiresAt: ticket.expiresAt,\n    app: DISPATCH_APP_ID,\n  };\n}\n\nexport async function createGrantedDispatchMcpEmbedSession(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n  const target = await resolveDispatchEmbedTarget(input);\n\n  return createEmbedSessionForResolvedApp({\n    ownerEmail: userEmail,\n    orgId: getRequestOrgId(),\n    target,\n    chrome: input.chrome,\n  });\n}\n\nasync function createEmbedSessionForResolvedApp(input: {\n  ownerEmail: string;\n  orgId?: string;\n  target: { app: DispatchMcpAccessibleApp; path: string; url: string };\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const { ownerEmail, orgId, target, chrome } = input;\n\n  if (target.app.id === DISPATCH_APP_ID) {\n    return createDispatchSelfEmbedSession({\n      ownerEmail,\n      orgId,\n      path: target.path,\n      baseUrl: appBaseUrl(target.app),\n      chrome,\n    });\n  }\n\n  const [orgDomain, orgSecret] = orgId\n    ? await Promise.all([\n        getOrgDomain(orgId).catch(() => null),\n        getOrgA2ASecret(orgId).catch(() => null),\n      ])\n    : [null, null];\n  const usableOrgSecret =\n    typeof orgSecret === \"string\" && orgSecret.trim().length > 0;\n  const usableOrgDomain =\n    typeof orgDomain === \"string\" && orgDomain.trim().length > 0;\n  const useOrgSigning = usableOrgDomain && usableOrgSecret;\n  const signedOrgDomain = usableOrgDomain ? orgDomain.trim() : undefined;\n  const token = await signA2AToken(\n    ownerEmail,\n    signedOrgDomain,\n    useOrgSigning ? orgSecret.trim() : undefined,\n    {\n      expiresIn: \"5m\",\n      // Prefer the synced org A2A secret when present because first-party\n      // production apps do not have to share the same deployment env secret.\n      // Fall back to the global A2A_SECRET for orgs that have not synced yet.\n      preferGlobalSecret: !useOrgSigning,\n    },\n  );\n\n  const result = await callTargetCreateEmbedSession({\n    app: target.app,\n    token,\n    url: target.url,\n    chrome,\n  });\n  const parsed = parseMcpToolTextResult(result) as {\n    startUrl?: string;\n    targetPath?: string;\n    expiresAt?: number;\n  };\n  if (!parsed.startUrl) {\n    throw new Error(\"Target app did not return an embed start URL.\");\n  }\n  const output: {\n    startUrl: string;\n    targetPath?: string;\n    expiresAt?: number;\n    app: string;\n  } = {\n    startUrl: resolveGrantedAppEmbedStartUrl(target.app, parsed.startUrl),\n    app: target.app.id,\n  };\n  if (parsed.targetPath) output.targetPath = parsed.targetPath;\n  if (typeof parsed.expiresAt === \"number\") output.expiresAt = parsed.expiresAt;\n  return output;\n}\n\nexport async function createWorkspaceSsoEmbedSession(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const ownerEmail = getRequestUserEmail();\n  if (!ownerEmail) throw new Error(\"no authenticated user\");\n  const enabled = await isFeatureFlagEnabled(DISPATCH_WORKSPACE_SSO_FLAG, {\n    userEmail: ownerEmail,\n    userKey: ownerEmail,\n    orgId: getRequestOrgId(),\n  });\n  if (!enabled) {\n    throw new Error(\"Dispatch workspace sign-in is not enabled.\");\n  }\n\n  const target = await resolveWorkspaceSsoEmbedTarget(input);\n  return createEmbedSessionForResolvedApp({\n    ownerEmail,\n    orgId: getRequestOrgId(),\n    target,\n    chrome: input.chrome,\n  });\n}\n"]}
+{"version":3,"file":"mcp-gateway.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAa,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,GAEf,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EACL,mCAAmC,EACnC,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,oBAAoB,GACxB,kGAAkG,CAAC;AACrG,MAAM,cAAc,GAAG,SAAS,CAAC;AACjC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAC/C,MAAM,uCAAuC,GAAG,MAAM,CAAC;AACvD,MAAM,mCAAmC,GAAG,MAAM,CAAC;AACnD,MAAM,iCAAiC,GAAG,KAAK,CAAC;AAChD,MAAM,+BAA+B,GAAG,MAAM,CAAC;AAC/C,MAAM,uCAAuC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAU,CAAC;AAC3E,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAC/C,WAAW;IACX,QAAQ;IACR,UAAU;IACV,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,iCAAkC,SAAQ,KAAK;IACnD;QACE,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAWD,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAY;IAC/C,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9B,OAAO,uCAAuC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,uCAAuC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAU;IACxC,OAAO,gCAAgC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU;IAClC,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;QACxB,EAAE,MAAM,CACN,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CACvE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,IAAI,EAAE,CAChB,CAAC;AACJ,CAAC;AAyBD,SAAS,wBAAwB,CAC/B,GAAW,EACX,IAAU;IAEV,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG;QACX,GAAG;QACH,SAAS,EAAE,KAAc;QACzB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,MAAM;KACP,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,eAAe,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QACjD,OAAO;YACL,GAAG,IAAI;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,KAAK,EAAE,QAAQ,IAAI,gBAAgB,MAAM,GAAG;SAC7C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,aAAa,GACjB,QAAQ,IAAI,0DAA0D,CAAC;QACzE,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,aAAa;YACvB,aAAa;YACb,OAAO,EAAE,aAAa;SACvB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE,iCAAiC;QAC9C,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;SACpC;QACD,OAAO,EACL,oBAAoB,MAAM,6BAA6B;YACvD,WAAW,IAAI,CAAC,EAAE,mCAAmC;KACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAMtC;IAIC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,KAAK,EAAE,kBAA2B,EAAE,EAAE;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,EACf,EAAE,kBAAkB,EAAE,CACvB,CAAC;YACF,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,oEAAoE;QACtE,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE;QAAE,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,SAAS;QAAE,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAA4B;QACxC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,iBAAiB,EAAE,EAAE,aAAa;YACpC,CAAC,CAAC,EAAE,aAAa,EAAE,iBAAiB,EAAE,EAAE,aAAa,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,WAAW,GACf,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9D,OAAO;QACL,MAAM,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE;YACjD,gBAAgB,EACd,WAAW,IAAI,IAAI;gBACjB,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,+BAA+B,EAAE,WAAW,CAAC,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,oCAAoC,CAAC,GAAY;IACxD,OAAO,iCAAiC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACxD,CAAC;AAED,SAAS,iCAAiC,CACxC,GAAY;IAEZ,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,kCAAkC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,cAAc,CAAC;IACvE,IAAI,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IACE,0EAA0E,CAAC,IAAI,CAC7E,UAAU,CACX,EACD,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kCAAkC,CAAC,GAAY;IACtD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,UAAU,GAAI,GAAkC,CAAC,IAAI,CAAC;IAC5D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAI,GAAG,CAAC,KAA4B,CAAC,IAAI,CAAC;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,8BAA8B,CAAC,MAAc;IACpD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAChD,GAAW,EACX,MAAc,EACd,aAAgD,EAChD,QAAgB;IAEhB,OAAO;QACL,GAAG;QACH,SAAS,EAAE,KAAK;QAChB,MAAM;QACN,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,IAAI;QACf,aAAa;QACb,QAAQ;QACR,WAAW,EAAE,iCAAiC;QAC9C,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;SAC3B;QACD,OAAO,EACL,2EAA2E;YAC3E,mEAAmE;YACnE,wDAAwD;KAC3D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,SAA2B,EAC3B,QAAgB;IAEhB,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,IAAI,WAAW,IAAI,CAAC;QAAE,MAAM,IAAI,iCAAiC,EAAE,CAAC;IAEpE,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,SAAS,EAAE;YACX,IAAI,OAAO,CAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAClC,OAAO,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,iCAAiC,EAAE,CAAC,EACrD,WAAW,CACZ,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAiB,EACjB,IAAU,EACV,QAA4B;IAE5B,IAAI,QAAQ,IAAI,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACnC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CACR,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,SAAS,CAAC,CACvD,CACF,CAAC;QACF,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,OAAO,CAAC;QAC3C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,+BAA+B,CAC7C,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAC7B,QAAQ,CACT,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iCAAiC;gBAAE,OAAO,OAAO,CAAC;YACrE,IAAI,CAAC,oCAAoC,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC1D,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,OAAO,OAAO,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA8B;IACtD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;QAC5E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,aAAa,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3E,IAAI,aAAa;QAAE,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAEhE,MAAM,UAAU,GACd,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QACjC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,UAAU;QAAE,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC1C,CAAC,CAAC,mCAAmC;QACrC,CAAC,CAAC,uBAAuB,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CACtB,QAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,oBAAoB;QACjC,GAAG,EAAE,mBAAmB,EAAE;QAC1B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,uBAAuB,CAAC,eAAe,EAAE,QAAQ,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE7D,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACnD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,MAA6D;IAE7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAA6B;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAA6B;IAC/C,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,8BAA8B,CACrC,GAA6B,EAC7B,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,OAAO,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAA6B;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA6B,EAAE,GAAQ;IAChE,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA6B;IACvD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,GAA6B,EAAE,GAAQ;IAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjB,OAAO,GAAG,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAmB;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/C,OAAO,CACL,KAAK,KAAK,aAAa;QACvB,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;QAChC,KAAK,KAAK,QAAQ;QAClB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA6B,EAAE,IAAY;IACvE,IAAI,GAAG,CAAC,EAAE,KAAK,eAAe,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,oFAAoF,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAsB,EACtB,QAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAIvC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,+BAA+B,EAAE;QACjC,cAAc,CAAC,UAAU,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,IAAI,EAAE;YACJ,eAAe,CAAC,QAAQ,CAAC;YACzB,GAAG,MAAM;iBACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,eAAe,CAAC;iBAC/D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAG9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,IAAI,GAAG,MAAM,0BAA0B,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACrE,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,+DAA+D,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,CAAC,EAAE,oEAAoE,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qBAAqB,KAAK,CAAC,EAAE,wDAAwD,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,SAAS,GACb,mCAAmC,CACjC,KAAyD,CAC1D,CAAC;IACJ,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,MAAM,GAAG,iCAAiC,CAC9C,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAC3C,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACvD,OAAO,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,GAA6B;IAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC7C,4EAA4E;IAC5E,yEAAyE;IACzE,+CAA+C;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,gBAAgB,CAAC,MAAM,CAAC;QACtE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAClC,mCAAmC,EACnC,GAAG,CAAC,EAAE,CACP;QACH,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAmC,EACnC,OAA4B;IAE5B,IAAI,SAAS,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,SAAmC,EACnC,WAAkC;IAElC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,0BAA0B,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,YAAY,GAAG,wBAAwB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,YAAY,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,cAAc,GAAG,aAAa,CAAC;QACnC,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,oBAAoB;QACjC,GAAG,EAAE,mBAAmB,EAAE;QAC1B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,IAAI,cAAc,CAAC;IAC3E,IAAI,MAAM,KAAK,oBAAoB;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC9C,cAAc,CAAC,UAAU,CAAC;QAC1B,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,eAAe;YAAE,SAAS;QAC3D,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE;YAC3B,GAAG,eAAe,CAAC,KAAK,EAAE;gBACxB,IAAI,EAAE,UAAU;gBAChB,cAAc,EAAE,EAAE;aACnB,CAAC;YACF,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,qEAAqE;IACrE,0EAA0E;IAC1E,gEAAgE;IAChE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,SAAS;QACzC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;YACzB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,EAAgC,CAAC;IAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,MAAM,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO;QACL;YACE,EAAE,EAAE,eAAe;YACnB,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,oBAAoB;YACjC,GAAG,EAAE,mBAAmB,EAAE;YAC1B,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,IAAI;SACd;QACD,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,GAAW;IAEX,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACrE,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,4CAA4C,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,OAAe,EACf,OAAiD;IAEjD,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEjB,MAAM,YAAY,GAChB,OAAO,EAAE,KAAK,KAAK,IAAI;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1E,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,uBAAuB,CAAC;QACzD,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,SAAS;QACT,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAC5B;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;KAChD,EACD,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAC1B,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW,EACX,MAAc;IAEd,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,SAAS;QACT,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,SAAS,EAAE,SAAS,IAAI,SAAS;KAClC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,uCAAuC,CAAC,MAAM,GAAG,CAAC,CAAC;IACvE,KACE,IAAI,OAAO,GAAG,CAAC,EACf,OAAO,IAAI,uCAAuC,CAAC,MAAM,EACzD,OAAO,EAAE,EACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACjD,OAAO,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,uCAAuC,CAAC,OAAO,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,aAAa,IAAI,IAAI,CAAC;YACxC,MAAM,SAAS,GAAG,SAAS,IAAI,OAAO,IAAI,IAAI,CAAC;YAC/C,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,2CAA2C,EAAE;oBACxD,GAAG,EAAE,MAAM,CAAC,EAAE;oBACd,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,aAAa;oBACrB,UAAU,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,CAAC;oBACtD,OAAO,EAAE,OAAO,GAAG,CAAC;oBACpB,WAAW;oBACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACjC,aAAa;oBACb,SAAS,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG;oBACvD,SAAS,EAAE,kCAAkC,CAAC,GAAG,CAAC;oBAClD,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,MAAM,GAAG,CAAC;YAC1B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,yCAAyC,CAC9C,MAAM,CAAC,EAAE,EACT,aAAa,EACb,aAAa,EACb,WAAW,CACZ,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IAWC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,IAAI;QAAE,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI;QACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,aAAa,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,IAAI;YACJ,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACP,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAC7C,IAAI,YAAY,GAEL,IAAI,CAAC;IAChB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,oCAAoC,CAAC;gBACxD,GAAG,EAAE,MAAM,CAAC,EAAE;gBACd,GAAG;gBACH,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,uDAAuD,MAAM,CAAC,EAAE,GAAG,EACnE,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,EAAE;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG;QACH,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,YAAY,EAAE,UAAU;YAC1B,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,UAAU,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,YAAY,EAAE,SAAS,KAAK,QAAQ;YAC7C,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,SAAS,EAAE;YAC5C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,UAAU,GAAI,MAAc,CAAC,iBAAiB,CAAC;QACrD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC;YAClD,CAAC,CAAG,MAAc,CAAC,OAA0C;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CACrB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CACjE,EAAE,IAAI,CAAC;QACR,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,IAAK,MAAc,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,OAAO,GACX,KAAK,YAAY,KAAK;QACpB,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC5B,IACE,mEAAmE,CAAC,IAAI,CACtE,OAAO,CACR,EACD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,2HAA2H,CAAC,IAAI,CACrI,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,IAAI,GACR,kCAAkC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAK3C;IACC,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;YACnC,OAAO,EAAE;gBACP,CAAC,QAAQ,CAAC,EAAE;oBACV,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM;oBACnC,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;qBACvC;iBACF;aACF;SACF,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,MAAM,OAAO,CAAC,QAAQ,CAC3B,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAClD;gBACE,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;aAC/B,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,OAAO,IAAI,6BAA6B;gBACxC,CAAC,yBAAyB,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,KAAK,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;gBACvC,OAAO,CAAC,IAAI,CAAC,8CAA8C,EAAE,SAAS,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAIC,EACD,OAIC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACrE,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO;YACL,GAAG,EAAE,WAAW;YAChB,IAAI;YACJ,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5D,OAAO;YACL,GAAG,EAAE,WAAW;YAChB,IAAI;YACJ,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI;SAChB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAIzC;IACC,OAAO,kBAAkB,CAAC,KAAK,EAAE;QAC/B,UAAU,EAAE,4BAA4B;QACxC,QAAQ,EAAE,0BAA0B;QACpC,QAAQ,EAAE,2DAA2D;KACtE,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAI7C;IACC,OAAO,kBAAkB,CAAC,KAAK,EAAE;QAC/B,UAAU,EAAE,sBAAsB;QAClC,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EACN,4EAA4E;KAC/E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAM7C;IAMC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;QACtD,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,eAAe;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IAMC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAEvD,OAAO,gCAAgC,CAAC;QACtC,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,eAAe,EAAE;QACxB,MAAM;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAK/C;IAMC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAEpD,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,8BAA8B,CAAC;YACpC,UAAU;YACV,KAAK;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjB,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,eAAe,GACnB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,eAAe,IAAI,eAAe,CAAC;IACzD,MAAM,eAAe,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,UAAU,EACV,eAAe,EACf,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAC5C;QACE,SAAS,EAAE,IAAI;QACf,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,kBAAkB,EAAE,CAAC,aAAa;KACnC,CACF,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK;QACL,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM;KACP,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAI3C,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAKR;QACF,QAAQ,EAAE,8BAA8B,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC;QACrE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;KACnB,CAAC;IACF,IAAI,MAAM,CAAC,UAAU;QAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAC7D,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,KAKpD;IAMC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IACzC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,2BAA2B,EAAE;QACtE,SAAS,EAAE,UAAU;QACrB,OAAO,EAAE,UAAU;QACnB,KAAK,EAAE,eAAe,EAAE;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,gCAAgC,CAAC;QACtC,UAAU;QACV,KAAK,EAAE,eAAe,EAAE;QACxB,MAAM;QACN,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { A2AClient, signA2AToken, type Task } from \"@agent-native/core/a2a\";\nimport { isFeatureFlagEnabled } from \"@agent-native/core/feature-flags\";\nimport {\n  buildMcpToolName,\n  McpClientManager,\n} from \"@agent-native/core/mcp-client\";\nimport { getOrgA2ASecret, getOrgDomain } from \"@agent-native/core/org\";\nimport {\n  buildDeepLink,\n  buildEmbedStartPath,\n  createEmbedSessionTicket,\n  getRequestContext,\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport {\n  discoverAgents,\n  type DiscoveredAgent,\n} from \"@agent-native/core/server/agent-discovery\";\n\nimport {\n  CANONICAL_WORKSPACE_SSO_APP_ORIGINS,\n  DISPATCH_WORKSPACE_SSO_FLAG,\n  parseWorkspaceSsoAppRegistrations,\n} from \"../../shared/workspace-sso.js\";\nimport {\n  listWorkspaceApps,\n  type WorkspaceAppSummary,\n} from \"./app-creation-store.js\";\nimport {\n  getDispatchMcpAppAccessSettings,\n  isAppAllowedByMcpAccess,\n  type DispatchMcpAppAccessSettings,\n} from \"./mcp-access-store.js\";\n\nconst DISPATCH_APP_ID = \"dispatch\";\nconst DISPATCH_NAME = \"Dispatch\";\nconst DISPATCH_DESCRIPTION =\n  \"Workspace control plane for extensions, agents, vault, integrations, approvals, and app routing.\";\nconst DISPATCH_COLOR = \"#14B8A6\";\nconst TARGET_EMBED_SESSION_ATTEMPTS = 3;\nconst TARGET_EMBED_SESSION_RETRY_BASE_MS = 250;\nconst DISPATCH_ASK_APP_DEFAULT_INLINE_WAIT_MS = 20_000;\nconst DISPATCH_ASK_APP_MAX_INLINE_WAIT_MS = 25_000;\nconst DISPATCH_ASK_APP_POLL_INTERVAL_MS = 1_500;\nconst DISPATCH_A2A_REQUEST_TIMEOUT_MS = 10_000;\nconst DISPATCH_ASK_APP_STATUS_RETRY_DELAYS_MS = [250, 750, 1_500] as const;\nconst DISPATCH_ASK_APP_TERMINAL_STATES = new Set([\n  \"completed\",\n  \"failed\",\n  \"canceled\",\n  \"input-required\",\n]);\n\nclass DispatchAskAppInlineDeadlineError extends Error {\n  constructor() {\n    super(\"ask_app inline wait deadline reached\");\n    this.name = \"DispatchAskAppInlineDeadlineError\";\n  }\n}\n\nexport interface DispatchMcpAccessibleApp {\n  id: string;\n  name: string;\n  description: string;\n  url: string;\n  color: string;\n  granted: boolean;\n}\n\nfunction normalizeAppId(value: string): string {\n  return value.trim().toLowerCase();\n}\n\nfunction boundedDispatchAskAppWaitMs(raw: unknown): number {\n  if (raw == null || raw === \"\") {\n    return DISPATCH_ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  }\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed)) return DISPATCH_ASK_APP_DEFAULT_INLINE_WAIT_MS;\n  return Math.max(\n    0,\n    Math.min(DISPATCH_ASK_APP_MAX_INLINE_WAIT_MS, Math.trunc(parsed)),\n  );\n}\n\nfunction isTerminalDispatchTask(task: Task): boolean {\n  return DISPATCH_ASK_APP_TERMINAL_STATES.has(String(task.status.state));\n}\n\nfunction dispatchTaskText(task: Task): string {\n  return (\n    task.status.message?.parts\n      ?.filter(\n        (part): part is { type: \"text\"; text: string } => part.type === \"text\",\n      )\n      .map((part) => part.text)\n      .join(\"\\n\")\n      .trim() ?? \"\"\n  );\n}\n\ntype DispatchAskAppStatusErrorCategory =\n  | \"transport\"\n  | \"timeout\"\n  | \"upstream_5xx\"\n  | \"rate_limited\";\n\ntype DispatchAskAppTaskResult = {\n  app: string;\n  routedVia: \"a2a\";\n  taskId: string;\n  status: string;\n  response?: string;\n  error?: string;\n  inputRequired?: string;\n  statusRead?: \"unavailable\";\n  retryable?: true;\n  errorCategory?: DispatchAskAppStatusErrorCategory;\n  attempts?: number;\n  pollAfterMs?: number;\n  poll?: { tool: \"ask_app_status\"; arguments: { app: string; taskId: string } };\n  message?: string;\n};\n\nfunction dispatchAskAppTaskResult(\n  app: string,\n  task: Task,\n): DispatchAskAppTaskResult {\n  const status = String(task.status.state);\n  const response = dispatchTaskText(task);\n  const base = {\n    app,\n    routedVia: \"a2a\" as const,\n    taskId: task.id,\n    status,\n  };\n\n  if (status === \"completed\") {\n    return { ...base, response: response || \"(no response)\" };\n  }\n  if (status === \"failed\" || status === \"canceled\") {\n    return {\n      ...base,\n      ...(response ? { response } : {}),\n      error: response || `ask_app task ${status}.`,\n    };\n  }\n  if (status === \"input-required\") {\n    const inputRequired =\n      response || \"The agent needs additional input before it can continue.\";\n    return {\n      ...base,\n      response: inputRequired,\n      inputRequired,\n      message: inputRequired,\n    };\n  }\n  return {\n    ...base,\n    pollAfterMs: DISPATCH_ASK_APP_POLL_INTERVAL_MS,\n    poll: {\n      tool: \"ask_app_status\",\n      arguments: { app, taskId: task.id },\n    },\n    message:\n      `ask_app is still ${status}. Call ask_app_status with ` +\n      `taskId \"${task.id}\" to retrieve the final response.`,\n  };\n}\n\nasync function createDispatchA2AClient(input: {\n  targetUrl: string;\n  userEmail: string;\n  orgDomain?: string;\n  orgSecret?: string;\n  deadline?: number;\n}): Promise<{\n  client: A2AClient;\n  metadata: Record<string, unknown>;\n}> {\n  const apiKeys: string[] = [];\n  const addSignedToken = async (preferGlobalSecret: boolean) => {\n    try {\n      const token = await signA2AToken(\n        input.userEmail,\n        input.orgDomain,\n        input.orgSecret,\n        { preferGlobalSecret },\n      );\n      if (token && !apiKeys.includes(token)) apiKeys.push(token);\n    } catch {\n      // A2A can still be configured for local/dev unauthenticated calls. If\n      // signing is unavailable, let the target return its own auth error.\n    }\n  };\n\n  if (process.env.A2A_SECRET?.trim()) await addSignedToken(true);\n  if (input.orgSecret) await addSignedToken(false);\n\n  const metadata: Record<string, unknown> = {\n    userEmail: input.userEmail,\n    ...(input.orgDomain ? { orgDomain: input.orgDomain } : {}),\n    ...(getRequestContext()?.requestOrigin\n      ? { requestOrigin: getRequestContext()?.requestOrigin }\n      : {}),\n  };\n  const remainingMs =\n    input.deadline == null ? null : input.deadline - Date.now();\n  return {\n    client: new A2AClient(input.targetUrl, apiKeys[0], {\n      requestTimeoutMs:\n        remainingMs == null\n          ? DISPATCH_A2A_REQUEST_TIMEOUT_MS\n          : Math.max(1, Math.min(DISPATCH_A2A_REQUEST_TIMEOUT_MS, remainingMs)),\n      ...(apiKeys.length > 1 ? { fallbackApiKeys: apiKeys.slice(1) } : {}),\n    }),\n    metadata,\n  };\n}\n\nfunction isTransientDispatchAskAppStatusError(err: unknown): boolean {\n  return dispatchAskAppStatusErrorCategory(err) != null;\n}\n\nfunction dispatchAskAppStatusErrorCategory(\n  err: unknown,\n): DispatchAskAppStatusErrorCategory | null {\n  const message = err instanceof Error ? err.message : String(err ?? \"\");\n  const causeCode = dispatchAskAppStatusErrorCauseCode(err) ?? \"\";\n  const diagnostic = `${message} ${causeCode}`;\n  if (/A2A request failed \\(429\\)/i.test(message)) return \"rate_limited\";\n  if (/A2A request failed \\((?:500|502|503|504)\\)/i.test(message)) {\n    return \"upstream_5xx\";\n  }\n  if (/etimedout|timeout|aborted|aborterror/i.test(diagnostic)) {\n    return \"timeout\";\n  }\n  if (\n    /\\bfetch failed\\b|failed to fetch|networkerror|socket hang up|econnreset/i.test(\n      diagnostic,\n    )\n  ) {\n    return \"transport\";\n  }\n  return null;\n}\n\nfunction dispatchAskAppStatusErrorCauseCode(err: unknown): string | undefined {\n  if (!(err instanceof Error)) return undefined;\n  const directCode = (err as Error & { code?: unknown }).code;\n  if (typeof directCode === \"string\" && directCode.trim()) {\n    return directCode.trim();\n  }\n  if (!err.cause || typeof err.cause !== \"object\") return undefined;\n  const code = (err.cause as { code?: unknown }).code;\n  return typeof code === \"string\" && code.trim() ? code.trim() : undefined;\n}\n\nfunction dispatchAskAppStatusOriginHost(origin: string): string {\n  try {\n    return new URL(origin).host;\n  } catch {\n    return \"unknown\";\n  }\n}\n\nfunction dispatchAskAppStatusReadUnavailableResult(\n  app: string,\n  taskId: string,\n  errorCategory: DispatchAskAppStatusErrorCategory,\n  attempts: number,\n): DispatchAskAppTaskResult {\n  return {\n    app,\n    routedVia: \"a2a\",\n    taskId,\n    status: \"unknown\",\n    statusRead: \"unavailable\",\n    retryable: true,\n    errorCategory,\n    attempts,\n    pollAfterMs: DISPATCH_ASK_APP_POLL_INTERVAL_MS,\n    poll: {\n      tool: \"ask_app_status\",\n      arguments: { app, taskId },\n    },\n    message:\n      \"The durable ask_app task status could not be read after bounded retries. \" +\n      \"The task may still be running or completed. Retry ask_app_status \" +\n      \"with the same app and taskId; do not resubmit ask_app.\",\n  };\n}\n\nasync function runBeforeDispatchAskAppDeadline<T>(\n  operation: () => Promise<T>,\n  deadline: number,\n): Promise<T> {\n  const remainingMs = deadline - Date.now();\n  if (remainingMs <= 0) throw new DispatchAskAppInlineDeadlineError();\n\n  let timeout: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      operation(),\n      new Promise<T>((_resolve, reject) => {\n        timeout = setTimeout(\n          () => reject(new DispatchAskAppInlineDeadlineError()),\n          remainingMs,\n        );\n      }),\n    ]);\n  } finally {\n    if (timeout) clearTimeout(timeout);\n  }\n}\n\nasync function waitForDispatchA2ATask(\n  client: A2AClient,\n  task: Task,\n  deadline: number | undefined,\n): Promise<Task> {\n  if (deadline == null || isTerminalDispatchTask(task)) return task;\n  let current = task;\n  while (!isTerminalDispatchTask(current)) {\n    const remaining = deadline - Date.now();\n    if (remaining <= 0) return current;\n    await new Promise((resolve) =>\n      setTimeout(\n        resolve,\n        Math.min(DISPATCH_ASK_APP_POLL_INTERVAL_MS, remaining),\n      ),\n    );\n    if (Date.now() >= deadline) return current;\n    try {\n      current = await runBeforeDispatchAskAppDeadline(\n        () => client.getTask(task.id),\n        deadline,\n      );\n    } catch (err) {\n      if (err instanceof DispatchAskAppInlineDeadlineError) return current;\n      if (!isTransientDispatchAskAppStatusError(err)) throw err;\n      if (Date.now() >= deadline) return current;\n    }\n  }\n  return current;\n}\n\nfunction normalizeBaseUrl(raw: string | undefined | null): string | null {\n  const value = raw?.trim();\n  if (!value) return null;\n  try {\n    const url = new URL(value);\n    if (url.protocol !== \"http:\" && url.protocol !== \"https:\") return null;\n    return url.toString().replace(/\\/+$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeBasePath(value: string | undefined): string {\n  const trimmed = value?.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  const normalized = trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  return normalized ? `/${normalized}` : \"\";\n}\n\nfunction withConfiguredBasePath(baseUrl: string): string {\n  const basePath = normalizeBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n  if (!basePath) return baseUrl;\n  try {\n    const url = new URL(baseUrl);\n    const path = normalizeBasePath(url.pathname);\n    if (path === basePath || path.startsWith(`${basePath}/`)) {\n      return baseUrl;\n    }\n    url.pathname = path && path !== \"/\" ? `${basePath}${path}` : `${basePath}/`;\n    return url.toString().replace(/\\/+$/, \"\");\n  } catch {\n    return baseUrl;\n  }\n}\n\nfunction dispatchSelfBaseUrl(): string {\n  const requestOrigin = normalizeBaseUrl(getRequestContext()?.requestOrigin);\n  if (requestOrigin) return withConfiguredBasePath(requestOrigin);\n\n  const configured =\n    normalizeBaseUrl(process.env.WORKSPACE_GATEWAY_URL) ??\n    normalizeBaseUrl(process.env.APP_URL) ??\n    normalizeBaseUrl(process.env.URL) ??\n    normalizeBaseUrl(process.env.DEPLOY_URL) ??\n    normalizeBaseUrl(process.env.BETTER_AUTH_URL);\n  if (configured) return withConfiguredBasePath(configured);\n\n  return process.env.NODE_ENV === \"production\"\n    ? \"https://dispatch.agent-native.com\"\n    : \"http://localhost:8092\";\n}\n\nfunction dispatchSelfApp(\n  settings: DispatchMcpAppAccessSettings,\n): DispatchMcpAccessibleApp {\n  return {\n    id: DISPATCH_APP_ID,\n    name: DISPATCH_NAME,\n    description: DISPATCH_DESCRIPTION,\n    url: dispatchSelfBaseUrl(),\n    color: DISPATCH_COLOR,\n    granted: isAppAllowedByMcpAccess(DISPATCH_APP_ID, settings),\n  };\n}\n\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\n\nfunction safeAppPath(raw: unknown): string | null {\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\n  const value = raw.trim();\n  if (CONTROL_CHARS.test(value)) return null;\n  if (!value.startsWith(\"/\")) return null;\n  if (value.startsWith(\"//\") || value.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(value)) return null;\n  if (/%(?:2f|5c)/i.test(value)) return null;\n  const rawPath = value.split(/[?#]/, 1)[0] ?? value;\n  let parsed: URL;\n  try {\n    parsed = new URL(value, \"http://agent-native.invalid\");\n  } catch {\n    return null;\n  }\n  if (parsed.pathname !== rawPath) return null;\n  return value;\n}\n\nfunction appendParamsToPath(\n  path: string,\n  params: Record<string, string | number | boolean> | undefined,\n): string {\n  if (!params || Object.keys(params).length === 0) return path;\n  const url = new URL(path, \"http://agent-native.invalid\");\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, String(value));\n  }\n  return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction safeAppOrigin(app: DispatchMcpAccessibleApp): string | null {\n  try {\n    const url = new URL(app.url);\n    return url.protocol === \"http:\" || url.protocol === \"https:\"\n      ? url.origin\n      : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    const hostname = new URL(origin).hostname;\n    return [\"localhost\", \"127.0.0.1\", \"::1\"].includes(hostname);\n  } catch {\n    // coercion-ok: only a previously validated app origin reaches this helper;\n    // malformed values are ineligible for the loopback development exception.\n    return false;\n  }\n}\n\nfunction appBaseUrl(app: DispatchMcpAccessibleApp): string {\n  return app.url.replace(/\\/+$/, \"\");\n}\n\nfunction resolveGrantedAppEmbedStartUrl(\n  app: DispatchMcpAccessibleApp,\n  startUrl: string,\n): string {\n  try {\n    const baseUrl = appBaseUrl(app);\n    const resolved = new URL(startUrl, `${baseUrl}/`);\n    if (!appMatchesUrlPath(app, resolved)) {\n      throw new Error(\n        \"Target app returned an embed start URL outside the granted app.\",\n      );\n    }\n    return resolved.toString();\n  } catch {\n    throw new Error(\"Target app returned an invalid embed start URL.\");\n  }\n}\n\nfunction appBasePath(app: DispatchMcpAccessibleApp): string {\n  const pathname = new URL(appBaseUrl(app)).pathname.replace(/\\/+$/, \"\");\n  return pathname === \"/\" ? \"\" : pathname;\n}\n\nfunction appMatchesUrlPath(app: DispatchMcpAccessibleApp, url: URL): boolean {\n  const origin = safeAppOrigin(app);\n  if (!origin || url.origin !== origin) return false;\n  const basePath = appBasePath(app);\n  if (!basePath) return true;\n  return url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);\n}\n\nfunction appPathSpecificity(app: DispatchMcpAccessibleApp): number {\n  return appBasePath(app).length;\n}\n\nfunction appRelativePath(app: DispatchMcpAccessibleApp, url: URL): string {\n  const basePath = appBasePath(app);\n  const path = basePath\n    ? url.pathname === basePath\n      ? \"/\"\n      : url.pathname.slice(basePath.length)\n    : url.pathname;\n  return `${path || \"/\"}${url.search}${url.hash}`;\n}\n\nfunction isDispatchControlPath(path: string | null): boolean {\n  if (!path) return false;\n  const route = path.split(/[?#]/, 1)[0] ?? path;\n  return (\n    route === \"/extensions\" ||\n    route.startsWith(\"/extensions/\") ||\n    route === \"/tools\" ||\n    route.startsWith(\"/tools/\")\n  );\n}\n\nfunction assertAppCanOpenPath(app: DispatchMcpAccessibleApp, path: string) {\n  if (app.id !== DISPATCH_APP_ID && isDispatchControlPath(path)) {\n    throw new Error(\n      `Path \"${path}\" belongs to Dispatch. Use app: \"dispatch\" for Dispatch extension and tool routes.`,\n    );\n  }\n}\n\nfunction toAccessibleApp(\n  agent: DiscoveredAgent,\n  settings: DispatchMcpAppAccessSettings,\n): DispatchMcpAccessibleApp {\n  return {\n    id: agent.id,\n    name: agent.name,\n    description: agent.description,\n    url: agent.url,\n    color: agent.color,\n    granted: isAppAllowedByMcpAccess(agent.id, settings),\n  };\n}\n\nexport async function listDispatchMcpApps(): Promise<{\n  settings: DispatchMcpAppAccessSettings;\n  apps: DispatchMcpAccessibleApp[];\n}> {\n  const [settings, agents] = await Promise.all([\n    getDispatchMcpAppAccessSettings(),\n    discoverAgents(\"dispatch\"),\n  ]);\n  return {\n    settings,\n    apps: [\n      dispatchSelfApp(settings),\n      ...agents\n        .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)\n        .map((agent) => toAccessibleApp(agent, settings)),\n    ],\n  };\n}\n\nexport async function listGrantedDispatchMcpApps(): Promise<\n  DispatchMcpAccessibleApp[]\n> {\n  const { apps } = await listDispatchMcpApps();\n  return apps.filter((app) => app.granted && safeAppOrigin(app));\n}\n\nexport async function listGrantedDispatchMcpAppOrigins(): Promise<string[]> {\n  const apps = await listGrantedDispatchMcpApps();\n  return Array.from(new Set(apps.flatMap((app) => safeAppOrigin(app) ?? [])));\n}\n\nexport async function resolveGrantedDispatchMcpApp(\n  app: string,\n): Promise<DispatchMcpAccessibleApp> {\n  const target = normalizeAppId(app);\n  if (!target) throw new Error(\"app is required\");\n  const { apps } = await listDispatchMcpApps();\n  const match = apps.find(\n    (candidate) =>\n      candidate.id === target || candidate.name.toLowerCase() === target,\n  );\n  if (!match) {\n    throw new Error(\n      `Unknown app \"${app}\". Call list_apps to see apps available through Dispatch MCP.`,\n    );\n  }\n  if (!match.granted) {\n    throw new Error(\n      `Dispatch MCP access to \"${match.id}\" is not granted. Open Dispatch > Agents to change MCP app access.`,\n    );\n  }\n  if (!safeAppOrigin(match)) {\n    throw new Error(\n      `Dispatch MCP app \"${match.id}\" has an invalid URL and cannot be opened through MCP.`,\n    );\n  }\n  return match;\n}\n\nfunction workspaceSsoOriginForApp(appId: string): string | null {\n  const canonical =\n    CANONICAL_WORKSPACE_SSO_APP_ORIGINS[\n      appId as keyof typeof CANONICAL_WORKSPACE_SSO_APP_ORIGINS\n    ];\n  if (canonical) return canonical;\n  const custom = parseWorkspaceSsoAppRegistrations(\n    process.env.IDENTITY_SSO_APP_REGISTRY_JSON,\n  ).find((registration) => registration.appId === appId);\n  return custom?.origin ?? null;\n}\n\nfunction workspaceSsoGatewayOrigin(): string | null {\n  const configured = process.env.WORKSPACE_GATEWAY_URL?.trim();\n  if (!configured) return null;\n  try {\n    return new URL(configured).origin;\n  } catch {\n    // coercion-ok: malformed deployment configuration is not a trusted origin.\n    return null;\n  }\n}\n\nfunction isWorkspaceSsoCanonicalApp(app: DispatchMcpAccessibleApp): boolean {\n  const origin = safeAppOrigin(app);\n  if (!origin) return false;\n  const registeredOrigin = workspaceSsoOriginForApp(app.id);\n  if (origin === registeredOrigin) return true;\n  // The built-in discovery table intentionally points at local dev ports when\n  // running outside production. Keep local development usable without ever\n  // weakening the production exact-origin check.\n  return process.env.NODE_ENV !== \"production\" && isLoopbackOrigin(origin)\n    ? Object.prototype.hasOwnProperty.call(\n        CANONICAL_WORKSPACE_SSO_APP_ORIGINS,\n        app.id,\n      )\n    : false;\n}\n\nfunction sameWorkspaceApp(\n  candidate: DispatchMcpAccessibleApp,\n  mounted: WorkspaceAppSummary,\n): boolean {\n  if (candidate.id !== mounted.id || !mounted.url) return false;\n  return candidate.url.replace(/\\/+$/, \"\") === mounted.url.replace(/\\/+$/, \"\");\n}\n\nasync function isEligibleWorkspaceSsoApp(\n  candidate: DispatchMcpAccessibleApp,\n  mountedApps: WorkspaceAppSummary[],\n): Promise<boolean> {\n  const origin = safeAppOrigin(candidate);\n  if (!origin) return false;\n  if (isWorkspaceSsoCanonicalApp(candidate)) return true;\n\n  const customOrigin = workspaceSsoOriginForApp(candidate.id);\n  if (customOrigin === origin) return true;\n\n  const dispatchOrigin = safeAppOrigin({\n    id: DISPATCH_APP_ID,\n    name: DISPATCH_NAME,\n    description: DISPATCH_DESCRIPTION,\n    url: dispatchSelfBaseUrl(),\n    color: DISPATCH_COLOR,\n    granted: true,\n  });\n  const trustedMountedOrigin = workspaceSsoGatewayOrigin() ?? dispatchOrigin;\n  if (origin !== trustedMountedOrigin) return false;\n  return mountedApps.some((mounted) => sameWorkspaceApp(candidate, mounted));\n}\n\nasync function listWorkspaceSsoApps(): Promise<DispatchMcpAccessibleApp[]> {\n  const [agents, mountedApps] = await Promise.all([\n    discoverAgents(\"dispatch\"),\n    listWorkspaceApps({ includeAgentCards: false }),\n  ]);\n  const candidatesById = new Map<string, DispatchMcpAccessibleApp>();\n  for (const agent of agents) {\n    if (normalizeAppId(agent.id) === DISPATCH_APP_ID) continue;\n    candidatesById.set(agent.id, {\n      ...toAccessibleApp(agent, {\n        mode: \"all-apps\",\n        selectedAppIds: [],\n      }),\n      granted: true,\n    });\n  }\n  // The hosted Dispatch database is separate from the shared Workspace\n  // database. Overlay the live mounted registry so custom apps are eligible\n  // without copying a stale app list into Dispatch configuration.\n  for (const app of mountedApps) {\n    if (app.isDispatch || !app.url) continue;\n    candidatesById.set(app.id, {\n      id: app.id,\n      name: app.name,\n      description: app.description,\n      url: app.url,\n      color: DISPATCH_COLOR,\n      granted: true,\n    });\n  }\n  const candidates = [...candidatesById.values()];\n  const eligible = [] as DispatchMcpAccessibleApp[];\n  for (const candidate of candidates) {\n    if (await isEligibleWorkspaceSsoApp(candidate, mountedApps)) {\n      eligible.push(candidate);\n    }\n  }\n  return [\n    {\n      id: DISPATCH_APP_ID,\n      name: DISPATCH_NAME,\n      description: DISPATCH_DESCRIPTION,\n      url: dispatchSelfBaseUrl(),\n      color: DISPATCH_COLOR,\n      granted: true,\n    },\n    ...eligible,\n  ];\n}\n\nasync function resolveWorkspaceSsoApp(\n  app: string,\n): Promise<DispatchMcpAccessibleApp> {\n  const target = normalizeAppId(app);\n  if (!target) throw new Error(\"app is required\");\n  const apps = await listWorkspaceSsoApps();\n  const match = apps.find(\n    (candidate) =>\n      candidate.id === target || candidate.name.toLowerCase() === target,\n  );\n  if (!match) {\n    throw new Error(\n      `Workspace app \"${app}\" is not registered for workspace sign-in.`,\n    );\n  }\n  return match;\n}\n\nexport async function askGrantedDispatchMcpApp(\n  app: string,\n  message: string,\n  options?: { async?: boolean; maxWaitMs?: number },\n): Promise<ReturnType<typeof dispatchAskAppTaskResult>> {\n  const trimmedMessage = message.trim();\n  if (!trimmedMessage) throw new Error(\"message is required\");\n  const target = await resolveGrantedDispatchMcpApp(app);\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  const orgId = getRequestOrgId();\n  const [orgDomain, orgSecret] = orgId\n    ? await Promise.all([\n        getOrgDomain(orgId).catch(() => null),\n        getOrgA2ASecret(orgId).catch(() => null),\n      ])\n    : [null, null];\n\n  const inlineWaitMs =\n    options?.async === true\n      ? 0\n      : boundedDispatchAskAppWaitMs(options?.maxWaitMs);\n  const deadline = inlineWaitMs > 0 ? Date.now() + inlineWaitMs : undefined;\n\n  const { client, metadata } = await createDispatchA2AClient({\n    targetUrl: target.url,\n    userEmail,\n    orgDomain: orgDomain ?? undefined,\n    orgSecret: orgSecret ?? undefined,\n    deadline,\n  });\n  const task = await client.send(\n    {\n      role: \"user\",\n      parts: [{ type: \"text\", text: trimmedMessage }],\n    },\n    { async: true, metadata },\n  );\n  const finalOrRunning = await waitForDispatchA2ATask(client, task, deadline);\n  return dispatchAskAppTaskResult(target.id, finalOrRunning);\n}\n\nexport async function getGrantedDispatchMcpAppTask(\n  app: string,\n  taskId: string,\n): Promise<DispatchAskAppTaskResult> {\n  const trimmedTaskId = taskId.trim();\n  if (!trimmedTaskId) throw new Error(\"taskId is required\");\n  const target = await resolveGrantedDispatchMcpApp(app);\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  const orgId = getRequestOrgId();\n  const [orgDomain, orgSecret] = orgId\n    ? await Promise.all([\n        getOrgDomain(orgId).catch(() => null),\n        getOrgA2ASecret(orgId).catch(() => null),\n      ])\n    : [null, null];\n  const { client } = await createDispatchA2AClient({\n    targetUrl: target.url,\n    userEmail,\n    orgDomain: orgDomain ?? undefined,\n    orgSecret: orgSecret ?? undefined,\n  });\n  const maxAttempts = DISPATCH_ASK_APP_STATUS_RETRY_DELAYS_MS.length + 1;\n  for (\n    let attempt = 0;\n    attempt <= DISPATCH_ASK_APP_STATUS_RETRY_DELAYS_MS.length;\n    attempt++\n  ) {\n    const startedAt = Date.now();\n    try {\n      const task = await client.getTask(trimmedTaskId);\n      return dispatchAskAppTaskResult(target.id, task);\n    } catch (err) {\n      const delayMs = DISPATCH_ASK_APP_STATUS_RETRY_DELAYS_MS[attempt];\n      const errorCategory = dispatchAskAppStatusErrorCategory(err);\n      const retryable = errorCategory != null;\n      const willRetry = retryable && delayMs != null;\n      if (retryable) {\n        console.warn(\"[ask_app_status] tasks/get attempt failed\", {\n          app: target.id,\n          routedVia: \"a2a\",\n          taskId: trimmedTaskId,\n          originHost: dispatchAskAppStatusOriginHost(target.url),\n          attempt: attempt + 1,\n          maxAttempts,\n          elapsedMs: Date.now() - startedAt,\n          errorCategory,\n          errorName: err instanceof Error ? err.name : typeof err,\n          causeCode: dispatchAskAppStatusErrorCauseCode(err),\n          willRetry,\n        });\n      }\n      if (!retryable) throw err;\n      if (delayMs == null) {\n        return dispatchAskAppStatusReadUnavailableResult(\n          target.id,\n          trimmedTaskId,\n          errorCategory,\n          maxAttempts,\n        );\n      }\n      await new Promise((resolve) => setTimeout(resolve, delayMs));\n    }\n  }\n  throw new Error(\"ask_app_status retry loop exited unexpectedly.\");\n}\n\nexport async function openGrantedDispatchMcpApp(input: {\n  app: string;\n  view?: string;\n  path?: string;\n  params?: Record<string, string | number | boolean>;\n  embed?: boolean;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  app: string;\n  view?: string;\n  path?: string;\n  url: string;\n  embed?: boolean;\n  chrome?: \"full\" | \"minimal\";\n  embedStartUrl?: string;\n  embedTargetPath?: string;\n  embedExpiresAt?: number;\n}> {\n  const view = input.view?.trim() ?? \"\";\n  const hasPathInput = input.path != null;\n  const path = safeAppPath(input.path);\n  if (hasPathInput && !path) {\n    throw new Error(\"path must be a safe app-relative route\");\n  }\n  if (!view && !path) throw new Error(\"open_app requires view or path\");\n  const target = await resolveGrantedDispatchMcpApp(input.app);\n  if (path) assertAppCanOpenPath(target, path);\n  const relUrl = path\n    ? appendParamsToPath(path, input.params)\n    : buildDeepLink({\n        app: target.id,\n        view,\n        params: input.params,\n      });\n  const url = `${appBaseUrl(target)}${relUrl}`;\n  let embedSession: Awaited<\n    ReturnType<typeof createGrantedDispatchMcpEmbedSession>\n  > | null = null;\n  if (input.embed) {\n    try {\n      embedSession = await createGrantedDispatchMcpEmbedSession({\n        app: target.id,\n        url,\n        chrome: input.chrome,\n      });\n    } catch (error) {\n      console.warn(\n        `[dispatch] Could not pre-mint MCP embed session for ${target.id}:`,\n        error,\n      );\n    }\n  }\n  return {\n    app: target.id,\n    ...(view ? { view } : {}),\n    ...(path ? { path } : {}),\n    url,\n    ...(input.embed === true ? { embed: true } : {}),\n    ...(input.chrome ? { chrome: input.chrome } : {}),\n    ...(embedSession?.startUrl ? { embedStartUrl: embedSession.startUrl } : {}),\n    ...(embedSession?.targetPath\n      ? { embedTargetPath: embedSession.targetPath }\n      : {}),\n    ...(typeof embedSession?.expiresAt === \"number\"\n      ? { embedExpiresAt: embedSession.expiresAt }\n      : {}),\n  };\n}\n\nfunction parseMcpToolTextResult(result: unknown): Record<string, unknown> {\n  if (result && typeof result === \"object\") {\n    const structured = (result as any).structuredContent;\n    if (structured && typeof structured === \"object\") return structured;\n    const parts = Array.isArray((result as any).content)\n      ? ((result as any).content as Array<Record<string, unknown>>)\n      : [];\n    const text = parts.find(\n      (part) => part?.type === \"text\" && typeof part.text === \"string\",\n    )?.text;\n    if (typeof text === \"string\" && text.trim()) {\n      if ((result as any).isError) throw new Error(text.trim());\n      const parsed = JSON.parse(text);\n      if (parsed && typeof parsed === \"object\") return parsed;\n    }\n  }\n  throw new Error(\"Target app did not return an embed session.\");\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction isRetryableTargetMcpError(error: unknown): boolean {\n  const message =\n    error instanceof Error\n      ? error.message\n      : typeof error === \"string\"\n        ? error\n        : String(error ?? \"\");\n  if (\n    /rejected the request|unauthorized|forbidden|401|403|404|405|html/i.test(\n      message,\n    )\n  ) {\n    return false;\n  }\n  return /streamable http|handshake|failed to fetch|fetch failed|networkerror|econnrefused|enotfound|timed out|timeout|502|503|504/i.test(\n    message,\n  );\n}\n\nfunction targetMcpRetryDelay(attempt: number): number {\n  const base =\n    TARGET_EMBED_SESSION_RETRY_BASE_MS * Math.pow(2, Math.max(0, attempt - 1));\n  return base + Math.floor(Math.random() * 100);\n}\n\nasync function callTargetCreateEmbedSession(input: {\n  app: DispatchMcpAccessibleApp;\n  token: string;\n  url: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<unknown> {\n  const serverId = \"target\";\n  for (let attempt = 1; ; attempt += 1) {\n    const manager = new McpClientManager({\n      servers: {\n        [serverId]: {\n          type: \"http\",\n          url: `${appBaseUrl(input.app)}/mcp`,\n          headers: {\n            Authorization: `Bearer ${input.token}`,\n          },\n        },\n      },\n    });\n    try {\n      await manager.start();\n      return await manager.callTool(\n        buildMcpToolName(serverId, \"create_embed_session\"),\n        {\n          url: input.url,\n          chrome: input.chrome ?? \"full\",\n        },\n      );\n    } catch (error) {\n      if (\n        attempt >= TARGET_EMBED_SESSION_ATTEMPTS ||\n        !isRetryableTargetMcpError(error)\n      ) {\n        throw error;\n      }\n      await sleep(targetMcpRetryDelay(attempt));\n    } finally {\n      await manager.stop().catch((stopError) => {\n        console.warn(\"[dispatch] Failed to stop target MCP client:\", stopError);\n      });\n    }\n  }\n}\n\nasync function resolveEmbedTarget(\n  input: {\n    app?: string;\n    url?: string;\n    path?: string;\n  },\n  options: {\n    resolveApp: (app: string) => Promise<DispatchMcpAccessibleApp>;\n    listApps: () => Promise<DispatchMcpAccessibleApp[]>;\n    urlError: string;\n  },\n): Promise<{ app: DispatchMcpAccessibleApp; path: string; url: string }> {\n  const explicitApp = input.app?.trim()\n    ? await options.resolveApp(input.app)\n    : null;\n  if (explicitApp && input.path) {\n    const path = safeAppPath(input.path);\n    if (!path) throw new Error(\"path must be a safe app-relative route\");\n    assertAppCanOpenPath(explicitApp, path);\n    return {\n      app: explicitApp,\n      path,\n      url: `${appBaseUrl(explicitApp)}${path}`,\n    };\n  }\n\n  if (!input.url) {\n    throw new Error(\"create_embed_session requires a url or app + path.\");\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(input.url);\n  } catch {\n    if (!explicitApp) {\n      throw new Error(\"Relative embed paths require an app id.\");\n    }\n    const path = safeAppPath(input.url);\n    if (!path) throw new Error(\"url must be a safe app route.\");\n    return {\n      app: explicitApp,\n      path,\n      url: `${appBaseUrl(explicitApp)}${path}`,\n    };\n  }\n\n  const apps = explicitApp ? [explicitApp] : await options.listApps();\n  const target = apps\n    .filter((app) => appMatchesUrlPath(app, parsed))\n    .sort((a, b) => appPathSpecificity(b) - appPathSpecificity(a))[0];\n  if (!target) {\n    throw new Error(options.urlError);\n  }\n  const path = safeAppPath(appRelativePath(target, parsed));\n  if (!path) throw new Error(\"Embed URL path is not safe.\");\n  assertAppCanOpenPath(target, path);\n  return { app: target, path, url: `${appBaseUrl(target)}${path}` };\n}\n\nasync function resolveDispatchEmbedTarget(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n}): Promise<{ app: DispatchMcpAccessibleApp; path: string; url: string }> {\n  return resolveEmbedTarget(input, {\n    resolveApp: resolveGrantedDispatchMcpApp,\n    listApps: listGrantedDispatchMcpApps,\n    urlError: \"Embed URL must belong to an app granted through Dispatch.\",\n  });\n}\n\nasync function resolveWorkspaceSsoEmbedTarget(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n}): Promise<{ app: DispatchMcpAccessibleApp; path: string; url: string }> {\n  return resolveEmbedTarget(input, {\n    resolveApp: resolveWorkspaceSsoApp,\n    listApps: listWorkspaceSsoApps,\n    urlError:\n      \"Embed URL must belong to an app registered for Dispatch workspace sign-in.\",\n  });\n}\n\nasync function createDispatchSelfEmbedSession(input: {\n  ownerEmail: string;\n  orgId?: string;\n  path: string;\n  baseUrl: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const ticket = await createEmbedSessionTicket({\n    ownerEmail: input.ownerEmail,\n    orgId: input.orgId,\n    targetPath: input.path,\n    scope: input.chrome ?? null,\n  });\n  const startPath = buildEmbedStartPath(ticket.ticket);\n  return {\n    startUrl: new URL(startPath, input.baseUrl).toString(),\n    targetPath: input.path,\n    expiresAt: ticket.expiresAt,\n    app: DISPATCH_APP_ID,\n  };\n}\n\nexport async function createGrantedDispatchMcpEmbedSession(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n  const target = await resolveDispatchEmbedTarget(input);\n\n  return createEmbedSessionForResolvedApp({\n    ownerEmail: userEmail,\n    orgId: getRequestOrgId(),\n    target,\n    chrome: input.chrome,\n  });\n}\n\nasync function createEmbedSessionForResolvedApp(input: {\n  ownerEmail: string;\n  orgId?: string;\n  target: { app: DispatchMcpAccessibleApp; path: string; url: string };\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const { ownerEmail, orgId, target, chrome } = input;\n\n  if (target.app.id === DISPATCH_APP_ID) {\n    return createDispatchSelfEmbedSession({\n      ownerEmail,\n      orgId,\n      path: target.path,\n      baseUrl: appBaseUrl(target.app),\n      chrome,\n    });\n  }\n\n  const [orgDomain, orgSecret] = orgId\n    ? await Promise.all([\n        getOrgDomain(orgId).catch(() => null),\n        getOrgA2ASecret(orgId).catch(() => null),\n      ])\n    : [null, null];\n  const usableOrgSecret =\n    typeof orgSecret === \"string\" && orgSecret.trim().length > 0;\n  const usableOrgDomain =\n    typeof orgDomain === \"string\" && orgDomain.trim().length > 0;\n  const useOrgSigning = usableOrgDomain && usableOrgSecret;\n  const signedOrgDomain = usableOrgDomain ? orgDomain.trim() : undefined;\n  const token = await signA2AToken(\n    ownerEmail,\n    signedOrgDomain,\n    useOrgSigning ? orgSecret.trim() : undefined,\n    {\n      expiresIn: \"5m\",\n      // Prefer the synced org A2A secret when present because first-party\n      // production apps do not have to share the same deployment env secret.\n      // Fall back to the global A2A_SECRET for orgs that have not synced yet.\n      preferGlobalSecret: !useOrgSigning,\n    },\n  );\n\n  const result = await callTargetCreateEmbedSession({\n    app: target.app,\n    token,\n    url: target.url,\n    chrome,\n  });\n  const parsed = parseMcpToolTextResult(result) as {\n    startUrl?: string;\n    targetPath?: string;\n    expiresAt?: number;\n  };\n  if (!parsed.startUrl) {\n    throw new Error(\"Target app did not return an embed start URL.\");\n  }\n  const output: {\n    startUrl: string;\n    targetPath?: string;\n    expiresAt?: number;\n    app: string;\n  } = {\n    startUrl: resolveGrantedAppEmbedStartUrl(target.app, parsed.startUrl),\n    app: target.app.id,\n  };\n  if (parsed.targetPath) output.targetPath = parsed.targetPath;\n  if (typeof parsed.expiresAt === \"number\") output.expiresAt = parsed.expiresAt;\n  return output;\n}\n\nexport async function createWorkspaceSsoEmbedSession(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const ownerEmail = getRequestUserEmail();\n  if (!ownerEmail) throw new Error(\"no authenticated user\");\n  const enabled = await isFeatureFlagEnabled(DISPATCH_WORKSPACE_SSO_FLAG, {\n    userEmail: ownerEmail,\n    userKey: ownerEmail,\n    orgId: getRequestOrgId(),\n  });\n  if (!enabled) {\n    throw new Error(\"Dispatch workspace sign-in is not enabled.\");\n  }\n\n  const target = await resolveWorkspaceSsoEmbedTarget(input);\n  return createEmbedSessionForResolvedApp({\n    ownerEmail,\n    orgId: getRequestOrgId(),\n    target,\n    chrome: input.chrome,\n  });\n}\n"]}

package/dist/server/lib/workspace-app-action-auth.d.ts

@@ -0,0 +1,9 @@
+import type { ActionRouteAuthAdapter } from "@agent-native/core/server";
+export declare const WORKSPACE_APPS_ACTION_PATH = "/_agent-native/actions/list-workspace-apps";
+/**
+ * The hosted workspace registry is a read-only action that accepts a caller
+ * JWT from Dispatch. Keep this resolver path-scoped so the shared secret never
+ * becomes a bearer credential for unrelated Dispatch actions.
+ */
+export declare const workspaceAppActionRouteAuth: ActionRouteAuthAdapter;
+//# sourceMappingURL=workspace-app-action-auth.d.ts.map

package/dist/server/lib/workspace-app-action-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-app-action-auth.d.ts","sourceRoot":"","sources":["../../../src/server/lib/workspace-app-action-auth.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,0BAA0B,+CACO,CAAC;AAgC/C;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAwCzC,CAAC"}

package/dist/server/lib/workspace-app-action-auth.js

@@ -0,0 +1,71 @@
+import { verifyA2AToken } from "@agent-native/core/a2a";
+import { isOrgMember, resolveOrgByDomain, resolveOrgIdForEmail, } from "@agent-native/core/org";
+export const WORKSPACE_APPS_ACTION_PATH = "/_agent-native/actions/list-workspace-apps";
+function isWorkspaceAppsActionPath(event) {
+    const rawUrl = (typeof event?.context?._mountedPathname === "string" &&
+        event.context._mountedPathname) ||
+        (typeof event?.path === "string" && event.path) ||
+        (typeof event?.url?.pathname === "string" && event.url.pathname) ||
+        (typeof event?.node?.req?.url === "string" && event.node.req.url) ||
+        (typeof event?.req?.url === "string" && event.req.url) ||
+        "/";
+    const requestPath = String(rawUrl).split("?", 1)[0].replace(/\/+$/, "") || "/";
+    const appBasePath = process.env.APP_BASE_PATH?.trim().replace(/\/+$/, "");
+    return (requestPath === WORKSPACE_APPS_ACTION_PATH ||
+        Boolean(appBasePath &&
+            `${appBasePath}${WORKSPACE_APPS_ACTION_PATH}` === requestPath));
+}
+function readAuthorizationHeader(event) {
+    const headers = event?.node?.req?.headers ?? event?.req?.headers;
+    if (typeof headers?.get === "function") {
+        return headers.get("authorization") ?? undefined;
+    }
+    const value = headers?.authorization ?? headers?.Authorization;
+    return Array.isArray(value) ? value[0] : value;
+}
+/**
+ * The hosted workspace registry is a read-only action that accepts a caller
+ * JWT from Dispatch. Keep this resolver path-scoped so the shared secret never
+ * becomes a bearer credential for unrelated Dispatch actions.
+ */
+export const workspaceAppActionRouteAuth = {
+    resolveCaller: async (event) => {
+        if (!isWorkspaceAppsActionPath(event))
+            return null;
+        const authorization = readAuthorizationHeader(event);
+        if (!authorization)
+            return null;
+        if (!authorization.startsWith("Bearer ")) {
+            throw new Error("Invalid workspace registry authorization");
+        }
+        const token = authorization.slice("Bearer ".length).trim();
+        if (!token)
+            throw new Error("Invalid workspace registry authorization");
+        const identity = await verifyA2AToken(token, event);
+        if (!identity.email) {
+            throw new Error("Invalid workspace registry authorization");
+        }
+        const orgDomain = identity.orgDomain?.trim().toLowerCase();
+        let orgId;
+        if (orgDomain) {
+            // A verified domain claim identifies the caller's intended org. Resolve
+            // it locally instead of falling back to the receiver's active-org or
+            // first-membership selection, which can be wrong for multi-org users.
+            const org = await resolveOrgByDomain(orgDomain);
+            if (!org || !(await isOrgMember(org.orgId, identity.email))) {
+                throw new Error("Invalid workspace registry authorization");
+            }
+            orgId = org.orgId;
+        }
+        else {
+            // Preserve compatibility with legacy tokens that predate org_domain.
+            orgId = await resolveOrgIdForEmail(identity.email);
+        }
+        return {
+            owner: identity.email,
+            anonymous: false,
+            orgId,
+        };
+    },
+};
+//# sourceMappingURL=workspace-app-action-auth.js.map

package/dist/server/lib/workspace-app-action-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-app-action-auth.js","sourceRoot":"","sources":["../../../src/server/lib/workspace-app-action-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAMhC,MAAM,CAAC,MAAM,0BAA0B,GACrC,4CAA4C,CAAC;AAE/C,SAAS,yBAAyB,CAAC,KAAU;IAC3C,MAAM,MAAM,GACV,CAAC,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,KAAK,QAAQ;QACnD,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;QAC/C,CAAC,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChE,CAAC,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACjE,CAAC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QACtD,GAAG,CAAC;IACN,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,CACL,WAAW,KAAK,0BAA0B;QAC1C,OAAO,CACL,WAAW;YACX,GAAG,WAAW,GAAG,0BAA0B,EAAE,KAAK,WAAW,CAC9D,CACF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAU;IACzC,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;IACjE,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,aAAa,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,aAAa,EAAE,KAAK,EAAE,KAAK,EAA6C,EAAE;QACxE,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnD,MAAM,aAAa,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,KAAoB,CAAC;QACzB,IAAI,SAAS,EAAE,CAAC;YACd,wEAAwE;YACxE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,qEAAqE;YACrE,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAED,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,KAAK;YAChB,KAAK;SACN,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["import { verifyA2AToken } from \"@agent-native/core/a2a\";\nimport {\n  isOrgMember,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n} from \"@agent-native/core/org\";\nimport type {\n  ActionRouteAuthAdapter,\n  ActionRouteResolvedCaller,\n} from \"@agent-native/core/server\";\n\nexport const WORKSPACE_APPS_ACTION_PATH =\n  \"/_agent-native/actions/list-workspace-apps\";\n\nfunction isWorkspaceAppsActionPath(event: any): boolean {\n  const rawUrl =\n    (typeof event?.context?._mountedPathname === \"string\" &&\n      event.context._mountedPathname) ||\n    (typeof event?.path === \"string\" && event.path) ||\n    (typeof event?.url?.pathname === \"string\" && event.url.pathname) ||\n    (typeof event?.node?.req?.url === \"string\" && event.node.req.url) ||\n    (typeof event?.req?.url === \"string\" && event.req.url) ||\n    \"/\";\n  const requestPath =\n    String(rawUrl).split(\"?\", 1)[0].replace(/\\/+$/, \"\") || \"/\";\n  const appBasePath = process.env.APP_BASE_PATH?.trim().replace(/\\/+$/, \"\");\n  return (\n    requestPath === WORKSPACE_APPS_ACTION_PATH ||\n    Boolean(\n      appBasePath &&\n      `${appBasePath}${WORKSPACE_APPS_ACTION_PATH}` === requestPath,\n    )\n  );\n}\n\nfunction readAuthorizationHeader(event: any): string | undefined {\n  const headers = event?.node?.req?.headers ?? event?.req?.headers;\n  if (typeof headers?.get === \"function\") {\n    return headers.get(\"authorization\") ?? undefined;\n  }\n  const value = headers?.authorization ?? headers?.Authorization;\n  return Array.isArray(value) ? value[0] : value;\n}\n\n/**\n * The hosted workspace registry is a read-only action that accepts a caller\n * JWT from Dispatch. Keep this resolver path-scoped so the shared secret never\n * becomes a bearer credential for unrelated Dispatch actions.\n */\nexport const workspaceAppActionRouteAuth: ActionRouteAuthAdapter = {\n  resolveCaller: async (event): Promise<ActionRouteResolvedCaller | null> => {\n    if (!isWorkspaceAppsActionPath(event)) return null;\n\n    const authorization = readAuthorizationHeader(event);\n    if (!authorization) return null;\n    if (!authorization.startsWith(\"Bearer \")) {\n      throw new Error(\"Invalid workspace registry authorization\");\n    }\n\n    const token = authorization.slice(\"Bearer \".length).trim();\n    if (!token) throw new Error(\"Invalid workspace registry authorization\");\n\n    const identity = await verifyA2AToken(token, event);\n    if (!identity.email) {\n      throw new Error(\"Invalid workspace registry authorization\");\n    }\n\n    const orgDomain = identity.orgDomain?.trim().toLowerCase();\n    let orgId: string | null;\n    if (orgDomain) {\n      // A verified domain claim identifies the caller's intended org. Resolve\n      // it locally instead of falling back to the receiver's active-org or\n      // first-membership selection, which can be wrong for multi-org users.\n      const org = await resolveOrgByDomain(orgDomain);\n      if (!org || !(await isOrgMember(org.orgId, identity.email))) {\n        throw new Error(\"Invalid workspace registry authorization\");\n      }\n      orgId = org.orgId;\n    } else {\n      // Preserve compatibility with legacy tokens that predate org_domain.\n      orgId = await resolveOrgIdForEmail(identity.email);\n    }\n\n    return {\n      owner: identity.email,\n      anonymous: false,\n      orgId,\n    };\n  },\n};\n"]}

package/dist/server/plugins/agent-chat.js

@@ -1,6 +1,7 @@
 import { getOrgContext } from "@agent-native/core/org";
 import { createAgentChatPlugin } from "@agent-native/core/server";
 import { dispatchActions } from "../../actions/index.js";
+import { workspaceAppActionRouteAuth, WORKSPACE_APPS_ACTION_PATH, } from "../lib/workspace-app-action-auth.js";
 const INITIAL_TOOL_NAMES = [
     "view-screen",
     "list-workspace-apps",
@@ -50,6 +51,8 @@ export default createAgentChatPlugin({
     // a build-time-generated `.generated/actions-registry.ts` (the latter is a
     // template-only construct that the Vite plugin emits next to actions/).
     actions: dispatchActions,
+    actionRouteAuth: workspaceAppActionRouteAuth,
+    actionRoutePublicPaths: [WORKSPACE_APPS_ACTION_PATH],
     codeExecution: { production: "sandboxed" },
     systemPrompt: `You are the central dispatch for this workspace.
 

package/dist/server/plugins/agent-chat.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-chat.js","sourceRoot":"","sources":["../../../src/server/plugins/agent-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,qBAAqB;IACrB,+BAA+B;IAC/B,uBAAuB;IACvB,SAAS;IACT,UAAU;IACV,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,cAAc;IACd,mBAAmB;IACnB,iBAAiB;IACjB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,8BAA8B;IAC9B,oCAAoC;IACpC,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,UAAU;CACX,CAAC;AAEF,eAAe,qBAAqB,CAAC;IACnC,KAAK,EAAE,UAAU;IACjB,qBAAqB,EAAE,IAAI;IAC3B,gBAAgB,EAAE,kBAAkB;IACpC,GAAG,EAAE;QACH,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,8BAA8B;SAC/B;KACF;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,EAAE,eAAe;IACxB,aAAa,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;IAC1C,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4EAmC4D;CAC3E,CAAC,CAAC","sourcesContent":["import { getOrgContext } from \"@agent-native/core/org\";\nimport { createAgentChatPlugin } from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../../actions/index.js\";\n\nconst INITIAL_TOOL_NAMES = [\n  \"view-screen\",\n  \"list-workspace-apps\",\n  \"update-workspace-app-metadata\",\n  \"list-connected-agents\",\n  \"ask_app\",\n  \"open_app\",\n  \"list-workspace-resources\",\n  \"create-workspace-resource\",\n  \"update-workspace-resource\",\n  \"import-agent\",\n  \"import-agent-pack\",\n  \"list-agent-pack\",\n  \"connect-external-agent\",\n  \"list-vault-secrets\",\n  \"request-vault-secret\",\n  \"create-vault-secret\",\n  \"list-destinations\",\n  \"upsert-destination\",\n  \"list-dreams\",\n  \"start-workspace-app-creation\",\n  \"list-available-workspace-templates\",\n  \"provider-api-catalog\",\n  \"provider-api-docs\",\n  \"provider-api-request\",\n  \"query-staged-dataset\",\n  \"navigate\",\n];\n\nexport default createAgentChatPlugin({\n  appId: \"dispatch\",\n  durableBackgroundRuns: true,\n  initialToolNames: INITIAL_TOOL_NAMES,\n  mcp: {\n    connectorCatalog: [\n      \"resolve-integration-source-context\",\n      \"start-workspace-app-creation\",\n    ],\n  },\n  // Without this, AGENT_ORG_ID is never set on agent action calls and every\n  // row written through the frontend (vault secrets, destinations, workspace\n  // resources) lands with org_id=NULL — breaking data isolation across orgs.\n  resolveOrgId: async (event) => {\n    const ctx = await getOrgContext(event);\n    return ctx.orgId;\n  },\n  // Read actions directly from the package's own action map rather than from\n  // a build-time-generated `.generated/actions-registry.ts` (the latter is a\n  // template-only construct that the Vite plugin emits next to actions/).\n  actions: dispatchActions,\n  codeExecution: { production: \"sandboxed\" },\n  systemPrompt: `You are the central dispatch for this workspace.\n\nDefault posture:\n- Treat Slack and Telegram as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A when another app owns the job.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Prefer replying in the current external thread unless the user explicitly asks you to send to a saved destination.\n\nUse the standard workspace primitives:\n- Read and update resources like AGENTS.md, LEARNINGS.md, jobs/*.md, agents/*.md, and remote-agents/*.json when appropriate.\n- Use recurring jobs for scheduled behavior.\n- Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.\n- For a Claude-style Markdown or JSON agent setup, use import-agent so the\n  profile is normalized into agents/<slug>.md. Never import credentials, hooks,\n  shell commands, or local environment settings.\n- For a folder of agent instructions, references, or skills, use\n  import-agent-pack. It preserves the text files under agents/<slug>/ and\n  creates the normalized profile alongside them. Use list-agent-pack to inspect\n  the pack before editing or handing it off to an app.\n- For an existing HTTP/A2A endpoint, use connect-external-agent and let the\n  normal A2A/MCP connection flow handle authentication.\n- You receive a compact available-apps block with sibling workspace app names and descriptions. Use it to pick the right A2A target, and call list-connected-agents or tool-search only when you need fresh details.\n- Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.\n- When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.\n- When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.\n- When a user asks to rename an existing workspace app or change its Dispatch title/description, call update-workspace-app-metadata with the existing appId from list-workspace-apps. This is a metadata-only edit — never call start-workspace-app-creation, which creates a new app and Builder branch.\n- When an explicit app-creation request already includes a source brief or a concrete repeatable workflow, call start-workspace-app-creation without asking non-blocking product or UX questions. Choose recommended defaults, let the Builder handoff record assumptions, and ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow.\n- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible \"Chat\", \"Starter\", \"Blank app\", or \"New app\" UI behind.\n- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.\n- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.\n- For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.\n\nWhen a user asks for something like a digest, reminder, routing rule, or saved behavior:\n- First decide whether it should be a resource, a recurring job, a destination, or a delegated task.\n- Keep responses concise and operational.\n- Avoid inventing integrations or destinations that are not configured yet.`,\n});\n"]}
+{"version":3,"file":"agent-chat.js","sourceRoot":"","sources":["../../../src/server/plugins/agent-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,qBAAqB;IACrB,+BAA+B;IAC/B,uBAAuB;IACvB,SAAS;IACT,UAAU;IACV,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,cAAc;IACd,mBAAmB;IACnB,iBAAiB;IACjB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,8BAA8B;IAC9B,oCAAoC;IACpC,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,UAAU;CACX,CAAC;AAEF,eAAe,qBAAqB,CAAC;IACnC,KAAK,EAAE,UAAU;IACjB,qBAAqB,EAAE,IAAI;IAC3B,gBAAgB,EAAE,kBAAkB;IACpC,GAAG,EAAE;QACH,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,8BAA8B;SAC/B;KACF;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,EAAE,eAAe;IACxB,eAAe,EAAE,2BAA2B;IAC5C,sBAAsB,EAAE,CAAC,0BAA0B,CAAC;IACpD,aAAa,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;IAC1C,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4EAmC4D;CAC3E,CAAC,CAAC","sourcesContent":["import { getOrgContext } from \"@agent-native/core/org\";\nimport { createAgentChatPlugin } from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../../actions/index.js\";\nimport {\n  workspaceAppActionRouteAuth,\n  WORKSPACE_APPS_ACTION_PATH,\n} from \"../lib/workspace-app-action-auth.js\";\n\nconst INITIAL_TOOL_NAMES = [\n  \"view-screen\",\n  \"list-workspace-apps\",\n  \"update-workspace-app-metadata\",\n  \"list-connected-agents\",\n  \"ask_app\",\n  \"open_app\",\n  \"list-workspace-resources\",\n  \"create-workspace-resource\",\n  \"update-workspace-resource\",\n  \"import-agent\",\n  \"import-agent-pack\",\n  \"list-agent-pack\",\n  \"connect-external-agent\",\n  \"list-vault-secrets\",\n  \"request-vault-secret\",\n  \"create-vault-secret\",\n  \"list-destinations\",\n  \"upsert-destination\",\n  \"list-dreams\",\n  \"start-workspace-app-creation\",\n  \"list-available-workspace-templates\",\n  \"provider-api-catalog\",\n  \"provider-api-docs\",\n  \"provider-api-request\",\n  \"query-staged-dataset\",\n  \"navigate\",\n];\n\nexport default createAgentChatPlugin({\n  appId: \"dispatch\",\n  durableBackgroundRuns: true,\n  initialToolNames: INITIAL_TOOL_NAMES,\n  mcp: {\n    connectorCatalog: [\n      \"resolve-integration-source-context\",\n      \"start-workspace-app-creation\",\n    ],\n  },\n  // Without this, AGENT_ORG_ID is never set on agent action calls and every\n  // row written through the frontend (vault secrets, destinations, workspace\n  // resources) lands with org_id=NULL — breaking data isolation across orgs.\n  resolveOrgId: async (event) => {\n    const ctx = await getOrgContext(event);\n    return ctx.orgId;\n  },\n  // Read actions directly from the package's own action map rather than from\n  // a build-time-generated `.generated/actions-registry.ts` (the latter is a\n  // template-only construct that the Vite plugin emits next to actions/).\n  actions: dispatchActions,\n  actionRouteAuth: workspaceAppActionRouteAuth,\n  actionRoutePublicPaths: [WORKSPACE_APPS_ACTION_PATH],\n  codeExecution: { production: \"sandboxed\" },\n  systemPrompt: `You are the central dispatch for this workspace.\n\nDefault posture:\n- Treat Slack and Telegram as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A when another app owns the job.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Prefer replying in the current external thread unless the user explicitly asks you to send to a saved destination.\n\nUse the standard workspace primitives:\n- Read and update resources like AGENTS.md, LEARNINGS.md, jobs/*.md, agents/*.md, and remote-agents/*.json when appropriate.\n- Use recurring jobs for scheduled behavior.\n- Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.\n- For a Claude-style Markdown or JSON agent setup, use import-agent so the\n  profile is normalized into agents/<slug>.md. Never import credentials, hooks,\n  shell commands, or local environment settings.\n- For a folder of agent instructions, references, or skills, use\n  import-agent-pack. It preserves the text files under agents/<slug>/ and\n  creates the normalized profile alongside them. Use list-agent-pack to inspect\n  the pack before editing or handing it off to an app.\n- For an existing HTTP/A2A endpoint, use connect-external-agent and let the\n  normal A2A/MCP connection flow handle authentication.\n- You receive a compact available-apps block with sibling workspace app names and descriptions. Use it to pick the right A2A target, and call list-connected-agents or tool-search only when you need fresh details.\n- Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.\n- When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.\n- When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.\n- When a user asks to rename an existing workspace app or change its Dispatch title/description, call update-workspace-app-metadata with the existing appId from list-workspace-apps. This is a metadata-only edit — never call start-workspace-app-creation, which creates a new app and Builder branch.\n- When an explicit app-creation request already includes a source brief or a concrete repeatable workflow, call start-workspace-app-creation without asking non-blocking product or UX questions. Choose recommended defaults, let the Builder handoff record assumptions, and ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow.\n- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible \"Chat\", \"Starter\", \"Blank app\", or \"New app\" UI behind.\n- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.\n- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.\n- For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.\n\nWhen a user asks for something like a digest, reminder, routing rule, or saved behavior:\n- First decide whether it should be a resource, a recurring job, a destination, or a delegated task.\n- Keep responses concise and operational.\n- Avoid inventing integrations or destinations that are not configured yet.`,\n});\n"]}