@agent-native/dispatch 0.40.31 → 0.40.34

package/dist/server/lib/vault-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault-store.js","sourceRoot":"","sources":["../../../src/server/lib/vault-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EACL,eAAe,EACf,KAAK,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,cAAc,GAEf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAwBnE,MAAM,UAAU,eAAe;IAC7B,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CACf,KAAQ,EACR,GAAa;IAEb,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAClB,KAAQ,EACR,GAAa;IAEb,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS,CAAC,GAGlB;IACC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,QAAkB;IAC9D,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,SAAS,EAAE;IACT,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,GAAG;IACV,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI;QAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe;KAC5B,EAAE,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC1D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,IACE,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAA4C,KAAQ;IACvE,OAAO,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvD,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACvC,GAAG,EAAE;;;oBAGS;YACd,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,CAAC,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,qEAAqE;IACvE,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,qEAAqE,CACtE,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,oBAAoB,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5D,OAAO,EAAE,KAAK,EAAE,MAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,GAAG,GACP,KAAK,CAAC,KAAK,KAAK,KAAK;QACnB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;QAC/D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,+BAA+B;QACvC,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EACL,IAAI,CAAC,IAAI,KAAK,UAAU;YACtB,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,2CAA2C;QACjD,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAOtC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QAC3C,EAAE,EAAE,EAAE,EAAE;QACR,UAAU,EAAE,iBAAiB,EAAE;QAC/B,KAAK,EAAE,YAAY,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAK,GAAG,EAAE;IAC7C,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;SACzC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;SAC7C,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;SACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;QAC1B,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI;QAC9B,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;KAC7C,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;SACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAa;IAC7D,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAMC,EACD,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,EACpD,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;aAC3B,GAAG,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1C,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;QAEJ,MAAM,gBAAgB,CAAC;YACrB,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACxB,OAAO,EAAE,mBAAmB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;YAC5D,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC;YAChB,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACxB,OAAO,EAAE,yBAAyB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;SACnE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAE7B,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QAC1C,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa;QACb,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;QAC5D,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KACtD,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;KACnE,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,KAQK,EACL,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,SAAS;QAC/B,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;IAC7B,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC1E,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACxD,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC5E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,KAAK,SAAS;QAC7B,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI;QAC3B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAE3B,IAAI,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,EACpD,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,qBAAqB,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC3B,GAAG,CAAC;QACH,IAAI;QACJ,aAAa;QACb,KAAK;QACL,QAAQ;QACR,WAAW;QACX,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;IAEJ,MAAM,aAAa,GAAG;QACpB,IAAI;QACJ,YAAY,EAAE,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChE,aAAa;QACb,qBAAqB,EACnB,aAAa,KAAK,QAAQ,CAAC,aAAa;YACtC,CAAC,CAAC,QAAQ,CAAC,aAAa;YACxB,CAAC,CAAC,SAAS;QACf,QAAQ;QACR,gBAAgB,EACd,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAChE,WAAW;QACX,mBAAmB,EACjB,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACzE,YAAY,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC1D,CAAC;IAEF,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,IAAI,MAAM,aAAa,GAAG;QACtD,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,IAAI,MAAM,aAAa,GAAG;QAC5D,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,MAAM,mCAAmC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC7D,QAAQ,CAAC,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,mCAAmC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;IACJ,MAAM,mCAAmC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;QAC7D,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,aAAa,GAAG;KACzE,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,aAAa,GAAG;KAC/E,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAGhC;IACC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAQ,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAQ,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAClC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACzC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EACnC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;SAC3C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;aAC1B,GAAG,CAAC;YACH,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EACtC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF,CAAC;QAEJ,MAAM,gBAAgB,CAAC;YACrB,MAAM,EAAE,kBAAkB;YAC1B,QAAQ;YACR,KAAK;YACL,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,aAAa,SAAS,KAAK,EAAE;YAC7E,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC;YAChB,MAAM,EAAE,wBAAwB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,OAAO,EAAE,4BAA4B,MAAM,CAAC,IAAI,SAAS,KAAK,EAAE;SACjE,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,EAAE,CAAC;IAErB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QACzC,EAAE,EAAE,OAAO;QACX,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,QAAQ;QACR,KAAK;QACL,OAAO,EAAE,YAAY,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,aAAa,QAAQ,KAAK,EAAE;QACzE,QAAQ,EAAE,EAAE,OAAO,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,yBAAyB,MAAM,CAAC,IAAI,QAAQ,KAAK,EAAE;KAC7D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAmB,EACnB,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,eAAe;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CACzD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CACrC,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9C,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEpD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;SAC5C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAClC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF,CAAC;IAEJ,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,WAAW,MAAM,EAAE,aAAa,IAAI,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,KAAK,EAAE;QACjF,QAAQ,EAAE,EAAE,OAAO,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,yBAAyB,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,KAAK,EAAE;KACxF,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CACnC,MAA6B;IAE7B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAAa;IAI3D,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC3D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,GAAa;IAEb,MAAM,MAAM,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QACrD,MAAM,cAAc,CAAC;YACnB,GAAG,EAAE,MAAM,CAAC,aAAa;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,GAAG,6BAA6B,IAAI,MAAM,CAAC,IAAI,EAAE;SAC/D,CAAC,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,IAAsB,EACtB,UAA6C;IAE7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqD,CAAC;IAC5E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,SAAS;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,OAAO,GAGH,EAAE;IAON,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,YAAY,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAC1E;SACA,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SACpC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAEnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAErD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAEnD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAClE,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAClC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CACrC,CAAC;YACF,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CACV,+CAA+C,GAAG,CAAC,KAAK,IAAI,QAAQ,UAAU,GAAG,CAAC,UAAU,oBAAoB,QAAQ,EAAE,EAC1H,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY;QACZ,UAAU;QACV,UAAU,EACR,YAAY,GAAG,CAAC;YACd,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;YAChE,CAAC,CAAC,OAAO;gBACP,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;gBAC3B,CAAC,CAAC,IAAI;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,GAAa,EACb,aAAwB;IAExB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,aAAa;QACxB,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;aACzD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACjB,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,6BAA6B,CAAC,CAC9D;aACA,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,EAC1C,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,eAAe,CAAC;gBACpB,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,+BAA+B,CAAC,CAAC;IAE1E,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,CAAC;YACT,IAAI,EAAE,EAAE;YACR,gBAAgB,EAAE,EAAE;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CACxE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAC;IACF,MAAM,gBAAgB,GAIhB,EAAE,CAAC;IACT,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACzE,gBAAgB,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,mBAAmB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,aAAa;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC,CAAC;IACJ,IAAI,UAGoC,CAAC;IAEzC,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,UAAU,GAAG;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,8DAA8D;SACvE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,KAAK,CAAC,GAAG,yBAAyB,EACrC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;gBAC9B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAChC,UAAU,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;gBAC1D,UAAU,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG;gBACX,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IAExB,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;iBAC1B,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;iBAClD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,KAAK;QACL,OAAO,EAAE,UAAU,UAAU,CAAC,MAAM,iBAAiB,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtF,QAAQ,EAAE;YACR,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,gBAAgB;YAChB,OAAO,EAAE,UAAU;SACpB;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU;QAChB,gBAAgB;QAChB,OAAO,EAAE,UAAU;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA4B;IAC7D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG;QACjB,OAAO;YACL,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC;YACrC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;KACxD,CAAC;IACF,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAQ,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CACpC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,GAAa;IACjE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CACvC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAInC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAElC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QAC3C,EAAE,EAAE,SAAS;QACb,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,YAAY,EAAE;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,GAAG,KAAK,cAAc,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;QACvE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;KAC9C,CAAC,CAAC;IAEH,MAAM,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE9C,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,WAAmB,EACnB,UAAmB,EACnB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC;IAChC,MAAM,mBAAmB,GAAG,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEtD,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,2CAA2C;IAC3C,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;SAC5B,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,EACtC,EAAE,CACA,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,EAC1C,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,EAC3C,GAAG,CAAA,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,MAAM,mBAAmB,EAAE,CAChE,CACF,CACF,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAElC,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,UAAU,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,cAAc,CAAC,aAAa,CAAC,EACnE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAC1C,CACF,CAAC;QACJ,IAAI,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAExC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,YAAY,CACzB;gBACE,aAAa,EAAE,cAAc,CAAC,aAAa;gBAC3C,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,UAAU,IAAI,cAAc,CAAC,aAAa;aACjD,EACD,UAAU,CACX,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;aAC5B,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;aAC5C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,EACtC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAC5C,CACF,CAAC;QACJ,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;SAC5B,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,EACtC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAC5C,CACF,CAAC;IAEJ,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,cAAc,CAAC,KAAK;QAC3B,OAAO,EAAE,YAAY,cAAc,CAAC,aAAa,QAAQ,cAAc,CAAC,KAAK,kBAAkB,cAAc,CAAC,WAAW,GAAG;QAC5H,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;KAClC,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,MAAsB,EACtB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;SAC5B,GAAG,CAAC;QACH,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,EACtC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAC3C,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAElC,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,cAAc,CAAC,KAAK;QAC3B,OAAO,EAAE,UAAU,cAAc,CAAC,aAAa,QAAQ,cAAc,CAAC,KAAK,kBAAkB,cAAc,CAAC,WAAW,GAAG;QAC1H,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;KAC1C,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAE1C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,KAAK,CAAC,GAAG,2BAA2B,EACvC;gBACE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,KAAK,CAAC,EAAE;oBACf,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,YAAY,EAAE,EAAE;oBAChB,eAAe,EAAE,MAAM,CAAC,IAAI;oBAC5B,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAMV,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAEtB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CACrD,CAAC;YACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEnE,MAAM,YAAY,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7D,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChD,OAAO;oBACL,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EACV,CAAC,CAAC,cAAc;wBAChB,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;4BACzB,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBAC5C,aAAa,EAAE,cAAc,EAAE,EAAE;oBACjC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;iBAC3B,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,OAAO,EAAE,KAAK,CAAC,IAAI;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY;gBACZ,eAAe,EAAE,MAAM,CAAC,IAAI;gBAC5B,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,OAAO,EAAE,KAAK,CAAC,IAAI;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,EAAE;gBAChB,eAAe,EAAE,MAAM,CAAC,IAAI;gBAC5B,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,iBAAiB,EAAE;QACnB,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE;QACd,sBAAsB,EAAE;KACzB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAE5E,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,gBAAgB,EACd,MAAM,CAAC,IAAI,KAAK,UAAU;YACxB,CAAC,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC,OAAO;gBACP,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,CAAC;QACT,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAChD,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;KAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAiB,EACjB,KAAuE;IAEvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO;IAExC,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAC7C,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,kBAAkB,CACnC,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC,cAAc,CAC3C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpC,MAAM,IAAI,GAAG;QACX,mBAAmB,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;QAC3D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7C,iBAAiB,iBAAiB,EAAE,EAAE;QACtC,EAAE;QACF,mBAAmB,MAAM,QAAQ;KAClC;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,KAAK,CAAC,uCAAuC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1C,OAAO,EAAE,kBAAkB,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;iBACpE;aACF;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC9C,WAAW,EAAE,EAAE,SAAS,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport { getDbExec } from \"@agent-native/core/db\";\nimport { and, desc, eq, isNull, or, sql } from \"@agent-native/core/db/schema\";\nimport { ssrfSafeFetch } from \"@agent-native/core/extensions/url-safety\";\nimport {\n  deleteAppSecret,\n  last4,\n  listAppSecretsForScope,\n  VAULT_SYNC_DESCRIPTION_PREFIX,\n  writeAppSecret,\n  type SecretScope,\n} from \"@agent-native/core/secrets\";\nimport { discoverAgents } from \"@agent-native/core/server/agent-discovery\";\nimport {\n  getOrgSetting,\n  getUserSetting,\n  putOrgSetting,\n  putUserSetting,\n} from \"@agent-native/core/settings\";\nimport { asc, gt } from \"drizzle-orm\";\n\nimport { getDb, schema } from \"../../db/index.js\";\nimport {\n  currentOwnerEmail,\n  currentOrgId,\n  recordAudit,\n} from \"./dispatch-store.js\";\n\nconst VAULT_ACCESS_SETTINGS_KEY = \"dispatch-vault-access-settings\";\n\nexport type VaultAccessMode = \"all-apps\" | \"manual\";\n\nexport interface VaultAccessSettings {\n  mode: VaultAccessMode;\n  scope: \"org\" | \"user\";\n  scopeId: string;\n}\n\n/**\n * Caller-supplied access context for vault operations.\n *\n * Every getSecret / updateSecret / deleteSecret / createGrant call must\n * pass the ctx of the *current request* so the row is scoped to that\n * caller's tenant. Looking up a vault secret by id alone is unsafe — UUIDs\n * are not authorization. A row matches the ctx if either the caller owns\n * it or it lives in the caller's active org.\n */\nexport interface VaultCtx {\n  ownerEmail: string;\n  orgId: string | null;\n}\n\nexport function requireVaultCtx(): VaultCtx {\n  const ownerEmail = currentOwnerEmail();\n  if (!ownerEmail) {\n    throw new Error(\"Vault operation requires an authenticated user\");\n  }\n  return { ownerEmail, orgId: currentOrgId() };\n}\n\nfunction ctxScope<T extends { ownerEmail: any; orgId: any }>(\n  table: T,\n  ctx: VaultCtx,\n) {\n  if (!ctx.orgId) {\n    return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\n  }\n  return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));\n}\n\n/** Scope an approval operation to the active tenant, never just the owner email. */\nfunction tenantScope<T extends { ownerEmail: any; orgId: any }>(\n  table: T,\n  ctx: VaultCtx,\n) {\n  if (ctx.orgId) return eq(table.orgId, ctx.orgId);\n  return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\n}\n\nfunction ctxForRow(row: {\n  ownerEmail: string;\n  orgId: string | null;\n}): VaultCtx {\n  return { ownerEmail: row.ownerEmail, orgId: row.orgId };\n}\n\nfunction ctxForSecretRow(row: VaultSecretRow, fallback: VaultCtx): VaultCtx {\n  return row.ownerEmail ? ctxForRow(row) : fallback;\n}\n\nfunction id() {\n  return crypto.randomUUID();\n}\n\nfunction now() {\n  return Date.now();\n}\n\nfunction safeJson(value: unknown) {\n  return JSON.stringify(value ?? null);\n}\n\nfunction workspaceBaseOrigins(): Set<string> {\n  const out = new Set<string>();\n  for (const value of [\n    process.env.WORKSPACE_GATEWAY_URL,\n    process.env.APP_URL,\n    process.env.URL,\n    process.env.DEPLOY_URL,\n    process.env.BETTER_AUTH_URL,\n  ]) {\n    if (!value) continue;\n    try {\n      out.add(new URL(value).origin);\n    } catch {\n      // Ignore malformed deploy metadata.\n    }\n  }\n  return out;\n}\n\nexport function isTrustedEnvVarSyncAgentUrl(agentUrl: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(agentUrl);\n  } catch {\n    return false;\n  }\n  const hostname = parsed.hostname.toLowerCase();\n  if (\n    hostname === \"localhost\" ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"::1\" ||\n    hostname.endsWith(\".localhost\")\n  ) {\n    return true;\n  }\n  return workspaceBaseOrigins().has(parsed.origin);\n}\n\nfunction scopedFilter<T extends { ownerEmail: any; orgId: any }>(table: T) {\n  return ctxScope(table, requireVaultCtx());\n}\n\nexport async function assertCanManageVault(): Promise<void> {\n  const orgId = currentOrgId();\n  if (!orgId) return;\n\n  const email = currentOwnerEmail().trim().toLowerCase();\n  let role: unknown = null;\n  try {\n    const result = await getDbExec().execute({\n      sql: `SELECT role FROM org_members\n            WHERE org_id = ? AND LOWER(email) = ?\n              AND federation_removal_pending_at IS NULL\n            LIMIT 1`,\n      args: [orgId, email],\n    });\n    role = result.rows[0]?.role;\n  } catch {\n    // coercion-ok: unknown membership is treated as unauthorized below.\n    // A failed membership check must not become an authorization bypass.\n  }\n\n  if (role !== \"owner\" && role !== \"admin\") {\n    throw Object.assign(\n      new Error(\n        \"Only organization owners and admins can manage the workspace vault.\",\n      ),\n      { statusCode: 403 },\n    );\n  }\n}\n\nexport async function canManageVault(): Promise<boolean> {\n  try {\n    await assertCanManageVault();\n    return true;\n  } catch {\n    // coercion-ok: the UI must treat an authorization lookup failure as no access.\n    return false;\n  }\n}\n\nfunction normalizeCredentialKey(value: string) {\n  return value.trim();\n}\n\nfunction vaultAccessScope() {\n  const orgId = currentOrgId();\n  if (orgId) return { scope: \"org\" as const, scopeId: orgId };\n  return { scope: \"user\" as const, scopeId: currentOwnerEmail() };\n}\n\nfunction parseVaultAccessMode(value: unknown): VaultAccessMode {\n  return value === \"manual\" ? \"manual\" : \"all-apps\";\n}\n\nexport async function getVaultAccessSettings(): Promise<VaultAccessSettings> {\n  const scope = vaultAccessScope();\n  const raw =\n    scope.scope === \"org\"\n      ? await getOrgSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY)\n      : await getUserSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY);\n  return {\n    ...scope,\n    mode: parseVaultAccessMode(raw?.mode),\n  };\n}\n\nexport async function setVaultAccessSettings(input: {\n  mode: VaultAccessMode;\n}): Promise<VaultAccessSettings> {\n  await assertCanManageVault();\n  const scope = vaultAccessScope();\n  const next = { mode: parseVaultAccessMode(input.mode) };\n  if (scope.scope === \"org\") {\n    await putOrgSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY, next);\n  } else {\n    await putUserSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY, next);\n  }\n  await recordAudit({\n    action: \"vault.access-settings.updated\",\n    targetType: \"vault-settings\",\n    targetId: VAULT_ACCESS_SETTINGS_KEY,\n    summary:\n      next.mode === \"all-apps\"\n        ? \"Set vault access to all workspace apps\"\n        : \"Set vault access to manual per-app grants\",\n    metadata: next,\n  });\n  return getVaultAccessSettings();\n}\n\nexport async function recordVaultAudit(input: {\n  action: string;\n  secretId?: string | null;\n  appId?: string | null;\n  summary: string;\n  metadata?: unknown;\n  actor?: string;\n}) {\n  const db = getDb();\n  await db.insert(schema.vaultAuditLog).values({\n    id: id(),\n    ownerEmail: currentOwnerEmail(),\n    orgId: currentOrgId(),\n    secretId: input.secretId || null,\n    appId: input.appId || null,\n    action: input.action,\n    actor: input.actor || currentOwnerEmail(),\n    summary: input.summary,\n    metadata: input.metadata ? safeJson(input.metadata) : null,\n    createdAt: now(),\n  });\n}\n\nexport async function listVaultAudit(limit = 50) {\n  await assertCanManageVault();\n  const db = getDb();\n  return db\n    .select()\n    .from(schema.vaultAuditLog)\n    .where(scopedFilter(schema.vaultAuditLog))\n    .orderBy(desc(schema.vaultAuditLog.createdAt))\n    .limit(limit);\n}\n\nexport async function listSecrets() {\n  await assertCanManageVault();\n  const db = getDb();\n  return db\n    .select()\n    .from(schema.vaultSecrets)\n    .where(scopedFilter(schema.vaultSecrets))\n    .orderBy(desc(schema.vaultSecrets.updatedAt));\n}\n\nexport async function listSecretOptions() {\n  const db = getDb();\n  return db\n    .select({\n      id: schema.vaultSecrets.id,\n      name: schema.vaultSecrets.name,\n      credentialKey: schema.vaultSecrets.credentialKey,\n      provider: schema.vaultSecrets.provider,\n      description: schema.vaultSecrets.description,\n    })\n    .from(schema.vaultSecrets)\n    .where(scopedFilter(schema.vaultSecrets))\n    .orderBy(desc(schema.vaultSecrets.updatedAt));\n}\n\nexport async function getSecret(secretId: string, ctx: VaultCtx) {\n  await assertCanManageVault();\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.vaultSecrets)\n    .where(\n      and(\n        eq(schema.vaultSecrets.id, secretId),\n        ctxScope(schema.vaultSecrets, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nexport async function createSecret(\n  input: {\n    credentialKey: string;\n    value: string;\n    name: string;\n    provider?: string | null;\n    description?: string | null;\n  },\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const timestamp = now();\n  const credentialKey = normalizeCredentialKey(input.credentialKey);\n  if (!credentialKey) throw new Error(\"Credential key is required\");\n  const existing = await db\n    .select()\n    .from(schema.vaultSecrets)\n    .where(\n      and(\n        eq(schema.vaultSecrets.credentialKey, credentialKey),\n        ctxScope(schema.vaultSecrets, ctx),\n      ),\n    )\n    .orderBy(desc(schema.vaultSecrets.updatedAt))\n    .limit(1);\n\n  if (existing[0]) {\n    await db\n      .update(schema.vaultSecrets)\n      .set({\n        name: input.name,\n        credentialKey,\n        value: input.value,\n        provider: input.provider || null,\n        description: input.description || null,\n        updatedAt: timestamp,\n      })\n      .where(\n        and(\n          eq(schema.vaultSecrets.id, existing[0].id),\n          ctxScope(schema.vaultSecrets, ctx),\n        ),\n      );\n\n    await recordVaultAudit({\n      action: \"secret.updated\",\n      secretId: existing[0].id,\n      summary: `Updated secret \"${input.name}\" (${credentialKey})`,\n      metadata: { credentialKey, provider: input.provider },\n    });\n\n    await recordAudit({\n      action: \"vault.secret.updated\",\n      targetType: \"vault-secret\",\n      targetId: existing[0].id,\n      summary: `Updated vault secret \"${input.name}\" (${credentialKey})`,\n    });\n\n    const updated = await getSecret(existing[0].id, ctx);\n    if (updated) {\n      await syncSecretsToCredentialStore(\n        [updated],\n        ctxForSecretRow(updated, ctx),\n      );\n    }\n    return updated;\n  }\n\n  const secretId = id();\n  const actor = ctx.ownerEmail;\n\n  await db.insert(schema.vaultSecrets).values({\n    id: secretId,\n    ownerEmail: actor,\n    orgId: ctx.orgId,\n    name: input.name,\n    credentialKey,\n    value: input.value,\n    provider: input.provider || null,\n    description: input.description || null,\n    createdBy: actor,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n\n  await recordVaultAudit({\n    action: \"secret.created\",\n    secretId,\n    summary: `Created secret \"${input.name}\" (${credentialKey})`,\n    metadata: { credentialKey, provider: input.provider },\n  });\n\n  await recordAudit({\n    action: \"vault.secret.created\",\n    targetType: \"vault-secret\",\n    targetId: secretId,\n    summary: `Created vault secret \"${input.name}\" (${credentialKey})`,\n  });\n\n  const created = await getSecret(secretId, ctx);\n  if (created) {\n    await syncSecretsToCredentialStore(\n      [created],\n      ctxForSecretRow(created, ctx),\n    );\n  }\n  return created;\n}\n\nexport async function updateSecret(\n  secretId: string,\n  input:\n    | string\n    | {\n        credentialKey?: string;\n        value?: string;\n        name?: string;\n        provider?: string | null;\n        description?: string | null;\n      },\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const existing = await getSecret(secretId, ctx);\n  if (!existing) throw new Error(\"Secret not found\");\n  const patch = typeof input === \"string\" ? { value: input } : input;\n  const credentialKey =\n    patch.credentialKey !== undefined\n      ? normalizeCredentialKey(patch.credentialKey)\n      : existing.credentialKey;\n  if (!credentialKey) throw new Error(\"Credential key is required\");\n  const name = patch.name !== undefined ? patch.name.trim() : existing.name;\n  if (!name) throw new Error(\"Secret name is required\");\n  const value = patch.value !== undefined ? patch.value : existing.value;\n  if (!value) throw new Error(\"Secret value is required\");\n  const provider =\n    patch.provider !== undefined ? patch.provider || null : existing.provider;\n  const description =\n    patch.description !== undefined\n      ? patch.description || null\n      : existing.description;\n\n  if (credentialKey !== existing.credentialKey) {\n    const conflict = await db\n      .select({ id: schema.vaultSecrets.id })\n      .from(schema.vaultSecrets)\n      .where(\n        and(\n          eq(schema.vaultSecrets.credentialKey, credentialKey),\n          ctxScope(schema.vaultSecrets, ctx),\n        ),\n      )\n      .limit(1);\n    if (conflict[0] && conflict[0].id !== secretId) {\n      throw new Error(`Credential key \"${credentialKey}\" is already in use`);\n    }\n  }\n\n  await db\n    .update(schema.vaultSecrets)\n    .set({\n      name,\n      credentialKey,\n      value,\n      provider,\n      description,\n      updatedAt: now(),\n    })\n    .where(\n      and(\n        eq(schema.vaultSecrets.id, secretId),\n        ctxScope(schema.vaultSecrets, ctx),\n      ),\n    );\n\n  const auditMetadata = {\n    name,\n    previousName: name !== existing.name ? existing.name : undefined,\n    credentialKey,\n    previousCredentialKey:\n      credentialKey !== existing.credentialKey\n        ? existing.credentialKey\n        : undefined,\n    provider,\n    previousProvider:\n      provider !== existing.provider ? existing.provider : undefined,\n    description,\n    previousDescription:\n      description !== existing.description ? existing.description : undefined,\n    valueChanged: value !== existing.value ? true : undefined,\n  };\n\n  await recordVaultAudit({\n    action: \"secret.updated\",\n    secretId,\n    summary: `Updated secret \"${name}\" (${credentialKey})`,\n    metadata: auditMetadata,\n  });\n\n  await recordAudit({\n    action: \"vault.secret.updated\",\n    targetType: \"vault-secret\",\n    targetId: secretId,\n    summary: `Updated vault secret \"${name}\" (${credentialKey})`,\n    metadata: auditMetadata,\n  });\n\n  const updated = await getSecret(secretId, ctx);\n  if (updated) {\n    await syncSecretsToCredentialStore(\n      [updated],\n      ctxForSecretRow(updated, ctx),\n    );\n  }\n  if (updated && credentialKey !== existing.credentialKey) {\n    await cleanupSyncedCredentialKeysIfUnused(ctxForRow(existing), [\n      existing.credentialKey,\n    ]);\n  } else if (updated && patch.credentialKey !== undefined) {\n    await cleanupSyncedCredentialKeysIfUnused(ctxForSecretRow(updated, ctx));\n  }\n  return updated;\n}\n\nexport async function deleteSecret(\n  secretId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const existing = await getSecret(secretId, ctx);\n  if (!existing) throw new Error(\"Secret not found\");\n\n  const grants = await listGrants({ secretId });\n  for (const grant of grants) {\n    if (grant.status === \"active\") {\n      await revokeGrant(grant.id, ctx);\n    }\n  }\n\n  await db\n    .delete(schema.vaultSecrets)\n    .where(\n      and(\n        eq(schema.vaultSecrets.id, secretId),\n        ctxScope(schema.vaultSecrets, ctx),\n      ),\n    );\n  await cleanupSyncedCredentialKeysIfUnused(ctxForRow(existing), [\n    existing.credentialKey,\n  ]);\n\n  await recordVaultAudit({\n    action: \"secret.deleted\",\n    secretId,\n    summary: `Deleted secret \"${existing.name}\" (${existing.credentialKey})`,\n  });\n\n  await recordAudit({\n    action: \"vault.secret.deleted\",\n    targetType: \"vault-secret\",\n    targetId: secretId,\n    summary: `Deleted vault secret \"${existing.name}\" (${existing.credentialKey})`,\n  });\n\n  return existing;\n}\n\nexport async function listGrants(filter?: {\n  secretId?: string;\n  appId?: string;\n}) {\n  await assertCanManageVault();\n  const db = getDb();\n  const conditions = [scopedFilter(schema.vaultGrants)];\n  if (filter?.secretId) {\n    conditions.push(eq(schema.vaultGrants.secretId, filter.secretId) as any);\n  }\n  if (filter?.appId) {\n    conditions.push(eq(schema.vaultGrants.appId, filter.appId) as any);\n  }\n  return db\n    .select()\n    .from(schema.vaultGrants)\n    .where(and(...conditions))\n    .orderBy(desc(schema.vaultGrants.updatedAt));\n}\n\nexport async function getGrant(\n  grantId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.vaultGrants)\n    .where(\n      and(\n        eq(schema.vaultGrants.id, grantId),\n        ctxScope(schema.vaultGrants, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nexport async function createGrant(\n  secretId: string,\n  appId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const secret = await getSecret(secretId, ctx);\n  if (!secret) throw new Error(\"Secret not found\");\n\n  const timestamp = now();\n  const actor = ctx.ownerEmail;\n  const [existing] = await db\n    .select()\n    .from(schema.vaultGrants)\n    .where(\n      and(\n        eq(schema.vaultGrants.secretId, secretId),\n        eq(schema.vaultGrants.appId, appId),\n        ctxScope(schema.vaultGrants, ctx),\n      ),\n    )\n    .orderBy(desc(schema.vaultGrants.updatedAt))\n    .limit(1);\n\n  if (existing?.status === \"active\") {\n    return existing;\n  }\n\n  if (existing) {\n    await db\n      .update(schema.vaultGrants)\n      .set({\n        grantedBy: actor,\n        status: \"active\",\n        syncedAt: null,\n        updatedAt: timestamp,\n      })\n      .where(\n        and(\n          eq(schema.vaultGrants.id, existing.id),\n          ctxScope(schema.vaultGrants, ctx),\n        ),\n      );\n\n    await recordVaultAudit({\n      action: \"grant.reinstated\",\n      secretId,\n      appId,\n      summary: `Reinstated \"${secret.name}\" (${secret.credentialKey}) for ${appId}`,\n      metadata: { grantId: existing.id },\n    });\n\n    await recordAudit({\n      action: \"vault.grant.reinstated\",\n      targetType: \"vault-grant\",\n      targetId: existing.id,\n      summary: `Reinstated vault secret \"${secret.name}\" for ${appId}`,\n    });\n\n    return getGrant(existing.id, ctx);\n  }\n\n  const grantId = id();\n\n  await db.insert(schema.vaultGrants).values({\n    id: grantId,\n    ownerEmail: actor,\n    orgId: ctx.orgId,\n    secretId,\n    appId,\n    grantedBy: actor,\n    status: \"active\",\n    syncedAt: null,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n\n  await recordVaultAudit({\n    action: \"grant.created\",\n    secretId,\n    appId,\n    summary: `Granted \"${secret.name}\" (${secret.credentialKey}) to ${appId}`,\n    metadata: { grantId },\n  });\n\n  await recordAudit({\n    action: \"vault.grant.created\",\n    targetType: \"vault-grant\",\n    targetId: grantId,\n    summary: `Granted vault secret \"${secret.name}\" to ${appId}`,\n  });\n\n  return getGrant(grantId);\n}\n\nexport async function grantSecretsToApp(\n  secretIds: string[],\n  appId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const access = await getVaultAccessSettings();\n  const uniqueSecretIds = Array.from(new Set(secretIds));\n  if (access.mode === \"all-apps\") {\n    return {\n      appId,\n      accessMode: access.mode,\n      created: [],\n      skipped: uniqueSecretIds,\n    };\n  }\n  const existingActive = (await listGrants({ appId })).filter(\n    (grant) => grant.status === \"active\",\n  );\n  const existingSecretIds = new Set(\n    existingActive.map((grant) => grant.secretId),\n  );\n  const created = [];\n  const skipped: string[] = [];\n\n  for (const secretId of uniqueSecretIds) {\n    if (existingSecretIds.has(secretId)) {\n      skipped.push(secretId);\n      continue;\n    }\n    const grant = await createGrant(secretId, appId, ctx);\n    if (grant) {\n      created.push(grant);\n      existingSecretIds.add(secretId);\n    }\n  }\n\n  return { appId, accessMode: access.mode, created, skipped };\n}\n\nexport async function revokeGrant(\n  grantId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const grant = await getGrant(grantId, ctx);\n  if (!grant) throw new Error(\"Grant not found\");\n\n  const secret = await getSecret(grant.secretId, ctx);\n\n  await db\n    .update(schema.vaultGrants)\n    .set({ status: \"revoked\", updatedAt: now() })\n    .where(\n      and(\n        eq(schema.vaultGrants.id, grantId),\n        ctxScope(schema.vaultGrants, ctx),\n      ),\n    );\n\n  await recordVaultAudit({\n    action: \"grant.revoked\",\n    secretId: grant.secretId,\n    appId: grant.appId,\n    summary: `Revoked ${secret?.credentialKey || grant.secretId} from ${grant.appId}`,\n    metadata: { grantId },\n  });\n\n  await recordAudit({\n    action: \"vault.grant.revoked\",\n    targetType: \"vault-grant\",\n    targetId: grantId,\n    summary: `Revoked vault secret \"${secret?.name || grant.secretId}\" from ${grant.appId}`,\n  });\n\n  return getGrant(grantId, ctx);\n}\n\ntype VaultSecretRow = typeof schema.vaultSecrets.$inferSelect;\n\nexport interface VaultSecretMetadata {\n  id: string;\n  name: string;\n  credentialKey: string;\n  last4: string;\n  provider: string | null;\n  description: string | null;\n  createdBy: string;\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport function toVaultSecretMetadata(\n  secret: VaultSecretRow | null,\n): VaultSecretMetadata | null {\n  if (!secret) return null;\n  return {\n    id: secret.id,\n    name: secret.name,\n    credentialKey: secret.credentialKey,\n    last4: last4(secret.value),\n    provider: secret.provider,\n    description: secret.description,\n    createdBy: secret.createdBy,\n    createdAt: secret.createdAt,\n    updatedAt: secret.updatedAt,\n  };\n}\n\nexport function credentialStoreScopeForVaultCtx(ctx: VaultCtx): {\n  scope: Extract<SecretScope, \"org\" | \"workspace\">;\n  scopeId: string;\n} {\n  if (ctx.orgId) return { scope: \"org\", scopeId: ctx.orgId };\n  return { scope: \"workspace\", scopeId: `solo:${ctx.ownerEmail}` };\n}\n\nexport async function syncSecretsToCredentialStore(\n  secrets: VaultSecretRow[],\n  ctx: VaultCtx,\n) {\n  const target = credentialStoreScopeForVaultCtx(ctx);\n  const syncedKeys: string[] = [];\n\n  for (const secret of secrets) {\n    if (!secret.credentialKey || !secret.value) continue;\n    await writeAppSecret({\n      key: secret.credentialKey,\n      value: secret.value,\n      scope: target.scope,\n      scopeId: target.scopeId,\n      description: `${VAULT_SYNC_DESCRIPTION_PREFIX} ${secret.name}`,\n    });\n    syncedKeys.push(secret.credentialKey);\n  }\n\n  return { ...target, keys: syncedKeys };\n}\n\n/**\n * Group secrets by the tenant their credential-store rows must land in.\n *\n * Every sync path must write a secret under the org that *owns the row*, not\n * under whoever happens to be syncing: `writeAppSecret` upserts, so syncing\n * with the caller's ctx copies credential material into the caller's org\n * instead of moving it, and it accumulates there permanently.\n */\nfunction groupSecretsByTenant(\n  rows: VaultSecretRow[],\n  resolveCtx: (row: VaultSecretRow) => VaultCtx,\n): { ctx: VaultCtx; rows: VaultSecretRow[] }[] {\n  const groups = new Map<string, { ctx: VaultCtx; rows: VaultSecretRow[] }>();\n  for (const row of rows) {\n    if (!row.credentialKey || !row.value) continue;\n    const ctx = resolveCtx(row);\n    const groupKey = `${ctx.orgId ?? \"\"}\\u0000${ctx.ownerEmail}`;\n    const group = groups.get(groupKey);\n    if (group) {\n      group.rows.push(row);\n    } else {\n      groups.set(groupKey, { ctx, rows: [row] });\n    }\n  }\n  return [...groups.values()];\n}\n\n/**\n * Re-sync one bounded page of vault secrets across tenants into the shared\n * credential store. Continue with `nextCursor` only from an explicit\n * maintenance caller; this must not run automatically during process startup.\n *\n * `syncSecretsToCredentialStore` normally only runs on `createSecret` /\n * `updateSecret`, so it only re-encrypts the rows a user happens to touch.\n * When the shared `app_secrets` encryption format changes underneath it\n * (e.g. a new dual-write format, or a change to how key material is\n * derived), existing rows are stuck on the old format until someone\n * manually re-saves each vault secret. This reads a keyset page directly —\n * bypassing the ctx-scoped `listSecrets()` — groups the rows by their\n * (orgId, ownerEmail) tenant, and re-runs the sync per group.\n *\n * A failure syncing one tenant's group is caught and logged (key NAMES\n * only, never values) so it can't block the rest of the resync. If a group\n * fails, `nextCursor` rewinds to before its first row so the next pass retries\n * it; check `failedGroups` before treating a null cursor as completion.\n */\nexport async function resyncVaultSecretsToCredentialStorePage(\n  options: {\n    afterId?: string;\n    limit?: number;\n  } = {},\n): Promise<{\n  groups: number;\n  failedGroups: number;\n  syncedKeys: number;\n  nextCursor: string | null;\n}> {\n  const requestedLimit = options.limit ?? 100;\n  const limit = Number.isFinite(requestedLimit)\n    ? Math.min(500, Math.max(1, Math.floor(requestedLimit)))\n    : 100;\n  const db = getDb();\n  const rowsWithNext = await db\n    .select()\n    .from(schema.vaultSecrets)\n    .where(\n      options.afterId ? gt(schema.vaultSecrets.id, options.afterId) : undefined,\n    )\n    .orderBy(asc(schema.vaultSecrets.id))\n    .limit(limit + 1);\n  const hasMore = rowsWithNext.length > limit;\n  const rows = hasMore ? rowsWithNext.slice(0, limit) : rowsWithNext;\n\n  const groups = groupSecretsByTenant(rows, ctxForRow);\n\n  let failedGroups = 0;\n  let syncedKeys = 0;\n  let firstFailedRowIndex = Number.POSITIVE_INFINITY;\n\n  for (const { ctx, rows: groupRows } of groups) {\n    try {\n      const result = await syncSecretsToCredentialStore(groupRows, ctx);\n      syncedKeys += result.keys.length;\n    } catch (error) {\n      failedGroups++;\n      const firstRowIndex = rows.findIndex(\n        (row) => row.id === groupRows[0]?.id,\n      );\n      firstFailedRowIndex = Math.min(firstFailedRowIndex, firstRowIndex);\n      const keyNames = groupRows.map((row) => row.credentialKey).join(\", \");\n      console.warn(\n        `[dispatch] vault boot resync failed for org=${ctx.orgId ?? \"(solo)\"} owner=${ctx.ownerEmail}; affected keys: ${keyNames}`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return {\n    groups: groups.length,\n    failedGroups,\n    syncedKeys,\n    nextCursor:\n      failedGroups > 0\n        ? (rows[firstFailedRowIndex - 1]?.id ?? options.afterId ?? null)\n        : hasMore\n          ? (rows.at(-1)?.id ?? null)\n          : null,\n  };\n}\n\nexport async function cleanupSyncedCredentialKeysIfUnused(\n  ctx: VaultCtx,\n  candidateKeys?: string[],\n) {\n  const db = getDb();\n  const target = credentialStoreScopeForVaultCtx(ctx);\n  const keys = candidateKeys\n    ? candidateKeys\n    : (await listAppSecretsForScope(target.scope, target.scopeId))\n        .filter((secret) =>\n          secret.description?.startsWith(VAULT_SYNC_DESCRIPTION_PREFIX),\n        )\n        .map((secret) => secret.key);\n\n  for (const key of new Set(keys.filter(Boolean))) {\n    const stillUsesKey = await db\n      .select({ id: schema.vaultSecrets.id })\n      .from(schema.vaultSecrets)\n      .where(\n        and(\n          eq(schema.vaultSecrets.credentialKey, key),\n          ctxScope(schema.vaultSecrets, ctx),\n        ),\n      )\n      .limit(1);\n    if (!stillUsesKey[0]) {\n      await deleteAppSecret({\n        key,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      });\n    }\n  }\n}\n\nexport async function syncGrantsToApp(\n  appId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const access = await getVaultAccessSettings();\n  const agents = await discoverAgents(\"dispatch\");\n  const agent = agents.find((a) => a.id === appId);\n  if (!agent) throw new Error(`App \"${appId}\" not found in agent registry`);\n\n  const secretsToSync: VaultSecretRow[] = [];\n  const activeGrants =\n    access.mode === \"manual\"\n      ? (await listGrants({ appId })).filter((g) => g.status === \"active\")\n      : [];\n\n  if (access.mode === \"all-apps\") {\n    const secrets = await listSecrets();\n    for (const secret of secrets) {\n      secretsToSync.push(secret);\n    }\n  } else {\n    for (const grant of activeGrants) {\n      const secret = await getSecret(grant.secretId, ctx);\n      if (secret) {\n        secretsToSync.push(secret);\n      }\n    }\n  }\n\n  if (secretsToSync.length === 0) {\n    return {\n      appId,\n      accessMode: access.mode,\n      synced: 0,\n      keys: [],\n      credentialStores: [],\n    };\n  }\n\n  const credentialStoreGroups = groupSecretsByTenant(secretsToSync, (row) =>\n    ctxForSecretRow(row, ctx),\n  );\n  const credentialStores: {\n    scope: ReturnType<typeof credentialStoreScopeForVaultCtx>[\"scope\"];\n    scopeId: string;\n    synced: number;\n  }[] = [];\n  const credentialStoreKeys: string[] = [];\n  for (const group of credentialStoreGroups) {\n    const result = await syncSecretsToCredentialStore(group.rows, group.ctx);\n    credentialStores.push({\n      scope: result.scope,\n      scopeId: result.scopeId,\n      synced: result.keys.length,\n    });\n    credentialStoreKeys.push(...result.keys);\n  }\n\n  const vars = secretsToSync.map((secret) => ({\n    key: secret.credentialKey,\n    value: secret.value,\n  }));\n  let envVarSync:\n    | { status: \"synced\"; keys: string[] }\n    | { status: \"skipped\"; reason: string }\n    | { status: \"failed\"; reason: string };\n\n  if (!isTrustedEnvVarSyncAgentUrl(agent.url)) {\n    envVarSync = {\n      status: \"skipped\",\n      reason: \"env-var sync is limited to localhost or workspace-owned apps\",\n    };\n  } else {\n    try {\n      const res = await ssrfSafeFetch(\n        `${agent.url}/_agent-native/env-vars`,\n        {\n          method: \"POST\",\n          headers: { \"Content-Type\": \"application/json\" },\n          body: JSON.stringify({ vars }),\n          signal: AbortSignal.timeout(10_000),\n        },\n        { maxRedirects: 3 },\n      );\n\n      if (res.ok) {\n        const result = await res.json();\n        envVarSync = { status: \"synced\", keys: result.saved || [] };\n      } else {\n        const err = await res.text().catch(() => \"Unknown error\");\n        envVarSync = { status: \"skipped\", reason: err };\n      }\n    } catch (err) {\n      envVarSync = {\n        status: \"failed\",\n        reason: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  const syncedKeys = credentialStoreKeys;\n  const timestamp = now();\n\n  for (const grant of activeGrants) {\n    const secret = await getSecret(grant.secretId, ctx);\n    if (secret && syncedKeys.includes(secret.credentialKey)) {\n      await db\n        .update(schema.vaultGrants)\n        .set({ syncedAt: timestamp, updatedAt: timestamp })\n        .where(eq(schema.vaultGrants.id, grant.id));\n    }\n  }\n\n  await recordVaultAudit({\n    action: \"secret.synced\",\n    appId,\n    summary: `Synced ${syncedKeys.length} secret(s) to ${appId}: ${syncedKeys.join(\", \")}`,\n    metadata: {\n      syncedKeys,\n      accessMode: access.mode,\n      credentialStores,\n      envVars: envVarSync,\n    },\n  });\n\n  return {\n    appId,\n    accessMode: access.mode,\n    synced: syncedKeys.length,\n    keys: syncedKeys,\n    credentialStores,\n    envVars: envVarSync,\n  };\n}\n\nexport async function listRequests(filter?: { status?: string }) {\n  const db = getDb();\n  const ctx = requireVaultCtx();\n  const isAdmin = await canManageVault();\n  const conditions = [\n    isAdmin\n      ? ctxScope(schema.vaultRequests, ctx)\n      : eq(schema.vaultRequests.ownerEmail, ctx.ownerEmail),\n  ];\n  if (filter?.status) {\n    conditions.push(eq(schema.vaultRequests.status, filter.status) as any);\n  }\n  return db\n    .select()\n    .from(schema.vaultRequests)\n    .where(and(...conditions))\n    .orderBy(desc(schema.vaultRequests.updatedAt));\n}\n\nexport async function getRequest(\n  requestId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.vaultRequests)\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        ctxScope(schema.vaultRequests, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nasync function getRequestForTenant(requestId: string, ctx: VaultCtx) {\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.vaultRequests)\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        tenantScope(schema.vaultRequests, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nexport async function createRequest(input: {\n  credentialKey: string;\n  appId: string;\n  reason?: string | null;\n}) {\n  const db = getDb();\n  const timestamp = now();\n  const requestId = id();\n  const actor = currentOwnerEmail();\n\n  await db.insert(schema.vaultRequests).values({\n    id: requestId,\n    ownerEmail: actor,\n    orgId: currentOrgId(),\n    credentialKey: input.credentialKey,\n    appId: input.appId,\n    reason: input.reason || null,\n    requestedBy: actor,\n    status: \"pending\",\n    reviewedBy: null,\n    reviewedAt: null,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n\n  await recordVaultAudit({\n    action: \"request.created\",\n    appId: input.appId,\n    summary: `${actor} requested ${input.credentialKey} for ${input.appId}`,\n    metadata: { requestId, reason: input.reason },\n  });\n\n  await notifyAdminsOfRequest(requestId, input);\n\n  return getRequest(requestId);\n}\n\nexport async function approveRequest(\n  requestId: string,\n  secretValue: string,\n  secretName?: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const request = await getRequestForTenant(requestId, ctx);\n  if (!request) throw new Error(\"Request not found\");\n\n  const timestamp = now();\n  const reviewer = ctx.ownerEmail;\n  const staleApplyingBefore = timestamp - 5 * 60 * 1000;\n\n  // Fence the transition on the current status — scoped to caller's tenant —\n  // so a concurrent approve can't both win: only the caller that flips\n  // pending -> applying proceeds to create the secret/grant. A crashed worker\n  // leaves an applying row behind, so a later reviewer may reclaim a lease\n  // that has been idle for five minutes. See\n  // claimAgentTeamRun in packages/core/src/server/agent-teams-run-queue.ts\n  // for the same pattern.\n  const claimed = await db\n    .update(schema.vaultRequests)\n    .set({\n      status: \"applying\",\n      updatedAt: timestamp,\n    })\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        tenantScope(schema.vaultRequests, ctx),\n        or(\n          eq(schema.vaultRequests.status, \"pending\"),\n          and(\n            eq(schema.vaultRequests.status, \"applying\"),\n            sql`${schema.vaultRequests.updatedAt} < ${staleApplyingBefore}`,\n          ),\n        ),\n      ),\n    )\n    .returning();\n\n  if (claimed.length === 0) {\n    const current = await getRequestForTenant(requestId, ctx);\n    if (current?.status === \"applying\") {\n      throw new Error(\"Vault request is already being applied\");\n    }\n    return current;\n  }\n\n  const claimedRequest = claimed[0];\n\n  // Secret + grant must land in the REQUEST's tenant, not the approver's\n  // (the approver may be acting on behalf of another user in the same org).\n  const requestCtx = ctxForRow(claimedRequest);\n\n  try {\n    const existingSecrets = await db\n      .select()\n      .from(schema.vaultSecrets)\n      .where(\n        and(\n          eq(schema.vaultSecrets.credentialKey, claimedRequest.credentialKey),\n          ctxScope(schema.vaultSecrets, requestCtx),\n        ),\n      );\n    let secret = existingSecrets[0] ?? null;\n\n    if (!secret) {\n      secret = await createSecret(\n        {\n          credentialKey: claimedRequest.credentialKey,\n          value: secretValue,\n          name: secretName || claimedRequest.credentialKey,\n        },\n        requestCtx,\n      );\n    }\n\n    if (secret) {\n      await createGrant(secret.id, claimedRequest.appId, requestCtx);\n    }\n  } catch (error) {\n    await db\n      .update(schema.vaultRequests)\n      .set({ status: \"pending\", updatedAt: now() })\n      .where(\n        and(\n          eq(schema.vaultRequests.id, requestId),\n          tenantScope(schema.vaultRequests, ctx),\n          eq(schema.vaultRequests.status, \"applying\"),\n        ),\n      );\n    throw error;\n  }\n\n  await db\n    .update(schema.vaultRequests)\n    .set({\n      status: \"approved\",\n      reviewedBy: reviewer,\n      reviewedAt: timestamp,\n      updatedAt: now(),\n    })\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        tenantScope(schema.vaultRequests, ctx),\n        eq(schema.vaultRequests.status, \"applying\"),\n      ),\n    );\n\n  await recordVaultAudit({\n    action: \"request.approved\",\n    appId: claimedRequest.appId,\n    summary: `Approved ${claimedRequest.credentialKey} for ${claimedRequest.appId} (requested by ${claimedRequest.requestedBy})`,\n    metadata: { requestId, reviewer },\n  });\n\n  return getRequestForTenant(requestId, ctx);\n}\n\nexport async function denyRequest(\n  requestId: string,\n  reason?: string | null,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const request = await getRequestForTenant(requestId, ctx);\n  if (!request) throw new Error(\"Request not found\");\n\n  const timestamp = now();\n  const reviewer = ctx.ownerEmail;\n\n  const claimed = await db\n    .update(schema.vaultRequests)\n    .set({\n      status: \"denied\",\n      reviewedBy: reviewer,\n      reviewedAt: timestamp,\n      updatedAt: timestamp,\n    })\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        tenantScope(schema.vaultRequests, ctx),\n        eq(schema.vaultRequests.status, \"pending\"),\n      ),\n    )\n    .returning();\n\n  if (claimed.length === 0) {\n    return getRequestForTenant(requestId, ctx);\n  }\n\n  const claimedRequest = claimed[0];\n\n  await recordVaultAudit({\n    action: \"request.denied\",\n    appId: claimedRequest.appId,\n    summary: `Denied ${claimedRequest.credentialKey} for ${claimedRequest.appId} (requested by ${claimedRequest.requestedBy})`,\n    metadata: { requestId, reviewer, reason },\n  });\n\n  return getRequestForTenant(requestId, ctx);\n}\n\nexport interface IntegrationEntry {\n  key: string;\n  label: string;\n  required: boolean;\n  configured: boolean;\n  vaultGranted: boolean;\n  vaultSecretId?: string;\n  secret: boolean;\n}\n\nexport interface AppIntegrations {\n  appId: string;\n  appName: string;\n  url: string;\n  color: string;\n  integrations: IntegrationEntry[];\n  vaultAccessMode: VaultAccessMode;\n  reachable: boolean;\n}\n\nexport async function listIntegrationsCatalog(): Promise<AppIntegrations[]> {\n  const access = await getVaultAccessSettings();\n  const agents = await discoverAgents(\"dispatch\");\n  const grants = (await canManageVault()) ? await listGrants() : [];\n  const secrets = await listSecretOptions();\n\n  const secretByKey = new Map(secrets.map((s) => [s.credentialKey, s]));\n\n  const results: AppIntegrations[] = [];\n\n  for (const agent of agents) {\n    try {\n      const res = await ssrfSafeFetch(\n        `${agent.url}/_agent-native/env-status`,\n        {\n          signal: AbortSignal.timeout(3000),\n        },\n        { maxRedirects: 3 },\n      );\n      if (!res.ok) {\n        results.push({\n          appId: agent.id,\n          appName: agent.name,\n          url: agent.url,\n          color: agent.color,\n          integrations: [],\n          vaultAccessMode: access.mode,\n          reachable: false,\n        });\n        continue;\n      }\n\n      const envStatus: Array<{\n        key: string;\n        label: string;\n        required: boolean;\n        configured: boolean;\n        secret?: boolean;\n      }> = await res.json();\n\n      const appGrants = grants.filter(\n        (g) => g.appId === agent.id && g.status === \"active\",\n      );\n      const grantedSecretIds = new Set(appGrants.map((g) => g.secretId));\n\n      const integrations: IntegrationEntry[] = envStatus.map((env) => {\n        const matchingSecret = secretByKey.get(env.key);\n        return {\n          key: env.key,\n          label: env.label,\n          required: env.required,\n          configured: env.configured,\n          vaultGranted:\n            !!matchingSecret &&\n            (access.mode === \"all-apps\" ||\n              grantedSecretIds.has(matchingSecret.id)),\n          vaultSecretId: matchingSecret?.id,\n          secret: env.secret ?? true,\n        };\n      });\n\n      results.push({\n        appId: agent.id,\n        appName: agent.name,\n        url: agent.url,\n        color: agent.color,\n        integrations,\n        vaultAccessMode: access.mode,\n        reachable: true,\n      });\n    } catch {\n      results.push({\n        appId: agent.id,\n        appName: agent.name,\n        url: agent.url,\n        color: agent.color,\n        integrations: [],\n        vaultAccessMode: access.mode,\n        reachable: false,\n      });\n    }\n  }\n\n  return results;\n}\n\nexport async function listVaultOverview() {\n  const isAdmin = await canManageVault();\n  const [secrets, grants, requests, access] = await Promise.all([\n    listSecretOptions(),\n    isAdmin ? listGrants() : Promise.resolve([]),\n    listRequests(),\n    getVaultAccessSettings(),\n  ]);\n  const manualGrantCount = grants.filter((g) => g.status === \"active\").length;\n\n  return {\n    accessMode: access.mode,\n    secretCount: secrets.length,\n    activeGrantCount:\n      access.mode === \"all-apps\"\n        ? secrets.length\n        : isAdmin\n          ? manualGrantCount\n          : 0,\n    manualGrantCount: isAdmin ? manualGrantCount : 0,\n    pendingRequestCount: requests.filter((r) => r.status === \"pending\").length,\n  };\n}\n\nasync function notifyAdminsOfRequest(\n  requestId: string,\n  input: { credentialKey: string; appId: string; reason?: string | null },\n) {\n  const apiKey = process.env.SENDGRID_API_KEY;\n  const from = process.env.SENDGRID_FROM_EMAIL;\n  const appUrl = process.env.APP_URL;\n  if (!apiKey || !from || !appUrl) return;\n\n  const { approverRecipients, getApprovalPolicy } =\n    await import(\"./dispatch-store.js\");\n  const recipients = approverRecipients(\n    (await getApprovalPolicy()).approverEmails,\n  );\n  if (recipients.length === 0) return;\n\n  const body = [\n    `Secret request: ${input.credentialKey} for ${input.appId}`,\n    input.reason ? `Reason: ${input.reason}` : \"\",\n    `Requested by: ${currentOwnerEmail()}`,\n    \"\",\n    `Review it here: ${appUrl}/vault`,\n  ]\n    .filter(Boolean)\n    .join(\"\\n\");\n\n  await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      personalizations: [\n        {\n          to: recipients.map((email) => ({ email })),\n          subject: `Vault request: ${input.credentialKey} for ${input.appId}`,\n        },\n      ],\n      from: { email: from },\n      content: [{ type: \"text/plain\", value: body }],\n      custom_args: { requestId },\n    }),\n  }).catch(() => {});\n}\n"]}
+{"version":3,"file":"vault-store.js","sourceRoot":"","sources":["../../../src/server/lib/vault-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACzE,OAAO,EACL,eAAe,EACf,KAAK,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,cAAc,GAEf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,MAAM,yBAAyB,GAAG,gCAAgC,CAAC;AAwBnE,MAAM,UAAU,eAAe;IAC7B,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CACf,KAAQ,EACR,GAAa;IAEb,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAClB,KAAQ,EACR,GAAa;IAEb,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS,CAAC,GAGlB;IACC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,GAAmB,EAAE,QAAkB;IAC9D,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,SAAS,EAAE;IACT,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,GAAG;IACV,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI;QAClB,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe;KAC5B,EAAE,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAgB;IAC1D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,IACE,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC/B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAA4C,KAAQ;IACvE,OAAO,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvD,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,qEAAqE;IACvE,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,qEAAqE,CACtE,EACD,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,oBAAoB,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5D,OAAO,EAAE,KAAK,EAAE,MAAe,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,GAAG,GACP,KAAK,CAAC,KAAK,KAAK,KAAK;QACnB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC;QAC/D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,KAAK;QACR,IAAI,EAAE,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,+BAA+B;QACvC,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EACL,IAAI,CAAC,IAAI,KAAK,UAAU;YACtB,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,2CAA2C;QACjD,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAOtC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QAC3C,EAAE,EAAE,EAAE,EAAE;QACR,UAAU,EAAE,iBAAiB,EAAE;QAC/B,KAAK,EAAE,YAAY,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QAC1D,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAK,GAAG,EAAE;IAC7C,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;SACzC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;SAC7C,KAAK,CAAC,KAAK,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;SACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,OAAO,EAAE;SACN,MAAM,CAAC;QACN,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;QAC1B,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI;QAC9B,aAAa,EAAE,MAAM,CAAC,YAAY,CAAC,aAAa;QAChD,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ;QACtC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,WAAW;KAC7C,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;SACxC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAa;IAC7D,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAMC,EACD,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,aAAa,GAAG,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,EACpD,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;SAC5C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;aAC3B,GAAG,CAAC;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,aAAa;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1C,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;QAEJ,MAAM,gBAAgB,CAAC;YACrB,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACxB,OAAO,EAAE,mBAAmB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;YAC5D,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC;YAChB,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACxB,OAAO,EAAE,yBAAyB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;SACnE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAE7B,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QAC1C,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa;QACb,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;QAC5D,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;KACtD,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,KAAK,CAAC,IAAI,MAAM,aAAa,GAAG;KACnE,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,KAQK,EACL,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACnE,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,SAAS;QAC/B,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;IAC7B,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC1E,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACxD,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC5E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,KAAK,SAAS;QAC7B,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI;QAC3B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAE3B,IAAI,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,aAAa,CAAC,EACpD,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,qBAAqB,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC3B,GAAG,CAAC;QACH,IAAI;QACJ,aAAa;QACb,KAAK;QACL,QAAQ;QACR,WAAW;QACX,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;IAEJ,MAAM,aAAa,GAAG;QACpB,IAAI;QACJ,YAAY,EAAE,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChE,aAAa;QACb,qBAAqB,EACnB,aAAa,KAAK,QAAQ,CAAC,aAAa;YACtC,CAAC,CAAC,QAAQ,CAAC,aAAa;YACxB,CAAC,CAAC,SAAS;QACf,QAAQ;QACR,gBAAgB,EACd,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAChE,WAAW;QACX,mBAAmB,EACjB,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACzE,YAAY,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC1D,CAAC;IAEF,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,IAAI,MAAM,aAAa,GAAG;QACtD,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,IAAI,MAAM,aAAa,GAAG;QAC5D,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,4BAA4B,CAChC,CAAC,OAAO,CAAC,EACT,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAC9B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,aAAa,KAAK,QAAQ,CAAC,aAAa,EAAE,CAAC;QACxD,MAAM,mCAAmC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC7D,QAAQ,CAAC,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxD,MAAM,mCAAmC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;SAC3B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,EACpC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF,CAAC;IACJ,MAAM,mCAAmC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;QAC7D,QAAQ,CAAC,aAAa;KACvB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,OAAO,EAAE,mBAAmB,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,aAAa,GAAG;KACzE,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yBAAyB,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,aAAa,GAAG;KAC/E,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAGhC;IACC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;QACrB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAQ,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAQ,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAe,EACf,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAClC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACzC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EACnC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF;SACA,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;SAC3C,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,QAAQ,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;aAC1B,GAAG,CAAC;YACH,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,SAAS;SACrB,CAAC;aACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,EACtC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF,CAAC;QAEJ,MAAM,gBAAgB,CAAC;YACrB,MAAM,EAAE,kBAAkB;YAC1B,QAAQ;YACR,KAAK;YACL,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,aAAa,SAAS,KAAK,EAAE;YAC7E,QAAQ,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,WAAW,CAAC;YAChB,MAAM,EAAE,wBAAwB;YAChC,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,OAAO,EAAE,4BAA4B,MAAM,CAAC,IAAI,SAAS,KAAK,EAAE;SACjE,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,EAAE,CAAC;IAErB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QACzC,EAAE,EAAE,OAAO;QACX,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ;QACR,KAAK;QACL,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,QAAQ;QACR,KAAK;QACL,OAAO,EAAE,YAAY,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,aAAa,QAAQ,KAAK,EAAE;QACzE,QAAQ,EAAE,EAAE,OAAO,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,yBAAyB,MAAM,CAAC,IAAI,QAAQ,KAAK,EAAE;KAC7D,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAmB,EACnB,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,eAAe;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CACzD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CACrC,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC9C,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;QACvC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEpD,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;SAC5C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,EAClC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAClC,CACF,CAAC;IAEJ,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,WAAW,MAAM,EAAE,aAAa,IAAI,KAAK,CAAC,QAAQ,SAAS,KAAK,CAAC,KAAK,EAAE;QACjF,QAAQ,EAAE,EAAE,OAAO,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,qBAAqB;QAC7B,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,yBAAyB,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,QAAQ,UAAU,KAAK,CAAC,KAAK,EAAE;KACxF,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAgBD,MAAM,UAAU,qBAAqB,CACnC,MAA6B;IAE7B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAAa;IAI3D,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;IAC3D,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,GAAa;IAEb,MAAM,MAAM,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,SAAS;QACrD,MAAM,cAAc,CAAC;YACnB,GAAG,EAAE,MAAM,CAAC,aAAa;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,GAAG,6BAA6B,IAAI,MAAM,CAAC,IAAI,EAAE;SAC/D,CAAC,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,IAAsB,EACtB,UAA6C;IAE7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqD,CAAC;IAC5E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,SAAS;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,OAAO,GAGH,EAAE;IAON,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,YAAY,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;SACzB,KAAK,CACJ,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAC1E;SACA,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SACpC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAEnE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAErD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,mBAAmB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAEnD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAClE,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAClC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CACrC,CAAC;YACF,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CACV,+CAA+C,GAAG,CAAC,KAAK,IAAI,QAAQ,UAAU,GAAG,CAAC,UAAU,oBAAoB,QAAQ,EAAE,EAC1H,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY;QACZ,UAAU;QACV,UAAU,EACR,YAAY,GAAG,CAAC;YACd,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;YAChE,CAAC,CAAC,OAAO;gBACP,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;gBAC3B,CAAC,CAAC,IAAI;KACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,GAAa,EACb,aAAwB;IAExB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,aAAa;QACxB,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;aACzD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACjB,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,6BAA6B,CAAC,CAC9D;aACA,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,EAC1C,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,eAAe,CAAC;gBACpB,GAAG;gBACH,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,+BAA+B,CAAC,CAAC;IAE1E,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACX,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,CAAC;YACT,IAAI,EAAE,EAAE;YACR,gBAAgB,EAAE,EAAE;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,qBAAqB,GAAG,oBAAoB,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CACxE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAC1B,CAAC;IACF,MAAM,gBAAgB,GAIhB,EAAE,CAAC;IACT,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACzE,gBAAgB,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,mBAAmB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,GAAG,EAAE,MAAM,CAAC,aAAa;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC,CAAC;IACJ,IAAI,UAGoC,CAAC;IAEzC,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,UAAU,GAAG;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,8DAA8D;SACvE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,KAAK,CAAC,GAAG,yBAAyB,EACrC;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;gBAC9B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YAEF,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAChC,UAAU,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;gBAC1D,UAAU,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG;gBACX,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IAExB,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,MAAM,EAAE;iBACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;iBAC1B,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;iBAClD,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,KAAK;QACL,OAAO,EAAE,UAAU,UAAU,CAAC,MAAM,iBAAiB,KAAK,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtF,QAAQ,EAAE;YACR,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,gBAAgB;YAChB,OAAO,EAAE,UAAU;SACpB;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;QACL,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU;QAChB,gBAAgB;QAChB,OAAO,EAAE,UAAU;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAA4B;IAC7D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG;QACjB,OAAO;YACL,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC;YACrC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;KACxD,CAAC;IACF,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAQ,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CACpC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,GAAa;IACjE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;SAC1B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CACvC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAInC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,EAAE,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAElC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QAC3C,EAAE,EAAE,SAAS;QACb,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,YAAY,EAAE;QACrB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,GAAG,KAAK,cAAc,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;QACvE,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;KAC9C,CAAC,CAAC;IAEH,MAAM,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAE9C,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,WAAmB,EACnB,UAAmB,EACnB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC;IAChC,MAAM,mBAAmB,GAAG,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAEtD,2EAA2E;IAC3E,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,2CAA2C;IAC3C,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;SAC5B,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,EACtC,EAAE,CACA,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,EAC1C,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,EAC3C,GAAG,CAAA,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,MAAM,mBAAmB,EAAE,CAChE,CACF,CACF,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAElC,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,UAAU,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,MAAM,EAAE;aAC7B,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,cAAc,CAAC,aAAa,CAAC,EACnE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAC1C,CACF,CAAC;QACJ,IAAI,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAExC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,YAAY,CACzB;gBACE,aAAa,EAAE,cAAc,CAAC,aAAa;gBAC3C,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,UAAU,IAAI,cAAc,CAAC,aAAa;aACjD,EACD,UAAU,CACX,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;aAC5B,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;aAC5C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,EACtC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAC5C,CACF,CAAC;QACJ,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;SAC5B,GAAG,CAAC;QACH,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,GAAG,EAAE;KACjB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,EACtC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAC5C,CACF,CAAC;IAEJ,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,kBAAkB;QAC1B,KAAK,EAAE,cAAc,CAAC,KAAK;QAC3B,OAAO,EAAE,YAAY,cAAc,CAAC,aAAa,QAAQ,cAAc,CAAC,KAAK,kBAAkB,cAAc,CAAC,WAAW,GAAG;QAC5H,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;KAClC,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,MAAsB,EACtB,GAAG,GAAa,eAAe,EAAE;IAEjC,MAAM,oBAAoB,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;SAC5B,GAAG,CAAC;QACH,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,SAAS;KACrB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,EACtC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,EACtC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAC3C,CACF;SACA,SAAS,EAAE,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAElC,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,cAAc,CAAC,KAAK;QAC3B,OAAO,EAAE,UAAU,cAAc,CAAC,aAAa,QAAQ,cAAc,CAAC,KAAK,kBAAkB,cAAc,CAAC,WAAW,GAAG;QAC1H,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE;KAC1C,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,MAAM,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAE1C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,KAAK,CAAC,GAAG,2BAA2B,EACvC;gBACE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,KAAK,CAAC,EAAE;oBACf,OAAO,EAAE,KAAK,CAAC,IAAI;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,YAAY,EAAE,EAAE;oBAChB,eAAe,EAAE,MAAM,CAAC,IAAI;oBAC5B,SAAS,EAAE,KAAK;iBACjB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,SAAS,GAMV,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAEtB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CACrD,CAAC;YACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEnE,MAAM,YAAY,GAAuB,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC7D,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChD,OAAO;oBACL,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,YAAY,EACV,CAAC,CAAC,cAAc;wBAChB,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;4BACzB,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBAC5C,aAAa,EAAE,cAAc,EAAE,EAAE;oBACjC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;iBAC3B,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,OAAO,EAAE,KAAK,CAAC,IAAI;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY;gBACZ,eAAe,EAAE,MAAM,CAAC,IAAI;gBAC5B,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,OAAO,EAAE,KAAK,CAAC,IAAI;gBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,EAAE;gBAChB,eAAe,EAAE,MAAM,CAAC,IAAI;gBAC5B,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,iBAAiB,EAAE;QACnB,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE;QACd,sBAAsB,EAAE;KACzB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAE5E,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,gBAAgB,EACd,MAAM,CAAC,IAAI,KAAK,UAAU;YACxB,CAAC,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC,OAAO;gBACP,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,CAAC;QACT,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAChD,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM;KAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,SAAiB,EACjB,KAAuE;IAEvE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO;IAExC,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAC7C,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,kBAAkB,CACnC,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC,cAAc,CAC3C,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpC,MAAM,IAAI,GAAG;QACX,mBAAmB,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;QAC3D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QAC7C,iBAAiB,iBAAiB,EAAE,EAAE;QACtC,EAAE;QACF,mBAAmB,MAAM,QAAQ;KAClC;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,KAAK,CAAC,uCAAuC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,gBAAgB,EAAE;gBAChB;oBACE,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1C,OAAO,EAAE,kBAAkB,KAAK,CAAC,aAAa,QAAQ,KAAK,CAAC,KAAK,EAAE;iBACpE;aACF;YACD,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;YACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC9C,WAAW,EAAE,EAAE,SAAS,EAAE;SAC3B,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport { and, desc, eq, isNull, or, sql } from \"@agent-native/core/db/schema\";\nimport { ssrfSafeFetch } from \"@agent-native/core/extensions/url-safety\";\nimport {\n  deleteAppSecret,\n  last4,\n  listAppSecretsForScope,\n  VAULT_SYNC_DESCRIPTION_PREFIX,\n  writeAppSecret,\n  type SecretScope,\n} from \"@agent-native/core/secrets\";\nimport { readOrgMemberRole } from \"@agent-native/core/server\";\nimport { discoverAgents } from \"@agent-native/core/server/agent-discovery\";\nimport {\n  getOrgSetting,\n  getUserSetting,\n  putOrgSetting,\n  putUserSetting,\n} from \"@agent-native/core/settings\";\nimport { asc, gt } from \"drizzle-orm\";\n\nimport { getDb, schema } from \"../../db/index.js\";\nimport {\n  currentOwnerEmail,\n  currentOrgId,\n  recordAudit,\n} from \"./dispatch-store.js\";\n\nconst VAULT_ACCESS_SETTINGS_KEY = \"dispatch-vault-access-settings\";\n\nexport type VaultAccessMode = \"all-apps\" | \"manual\";\n\nexport interface VaultAccessSettings {\n  mode: VaultAccessMode;\n  scope: \"org\" | \"user\";\n  scopeId: string;\n}\n\n/**\n * Caller-supplied access context for vault operations.\n *\n * Every getSecret / updateSecret / deleteSecret / createGrant call must\n * pass the ctx of the *current request* so the row is scoped to that\n * caller's tenant. Looking up a vault secret by id alone is unsafe — UUIDs\n * are not authorization. A row matches the ctx if either the caller owns\n * it or it lives in the caller's active org.\n */\nexport interface VaultCtx {\n  ownerEmail: string;\n  orgId: string | null;\n}\n\nexport function requireVaultCtx(): VaultCtx {\n  const ownerEmail = currentOwnerEmail();\n  if (!ownerEmail) {\n    throw new Error(\"Vault operation requires an authenticated user\");\n  }\n  return { ownerEmail, orgId: currentOrgId() };\n}\n\nfunction ctxScope<T extends { ownerEmail: any; orgId: any }>(\n  table: T,\n  ctx: VaultCtx,\n) {\n  if (!ctx.orgId) {\n    return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\n  }\n  return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));\n}\n\n/** Scope an approval operation to the active tenant, never just the owner email. */\nfunction tenantScope<T extends { ownerEmail: any; orgId: any }>(\n  table: T,\n  ctx: VaultCtx,\n) {\n  if (ctx.orgId) return eq(table.orgId, ctx.orgId);\n  return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));\n}\n\nfunction ctxForRow(row: {\n  ownerEmail: string;\n  orgId: string | null;\n}): VaultCtx {\n  return { ownerEmail: row.ownerEmail, orgId: row.orgId };\n}\n\nfunction ctxForSecretRow(row: VaultSecretRow, fallback: VaultCtx): VaultCtx {\n  return row.ownerEmail ? ctxForRow(row) : fallback;\n}\n\nfunction id() {\n  return crypto.randomUUID();\n}\n\nfunction now() {\n  return Date.now();\n}\n\nfunction safeJson(value: unknown) {\n  return JSON.stringify(value ?? null);\n}\n\nfunction workspaceBaseOrigins(): Set<string> {\n  const out = new Set<string>();\n  for (const value of [\n    process.env.WORKSPACE_GATEWAY_URL,\n    process.env.APP_URL,\n    process.env.URL,\n    process.env.DEPLOY_URL,\n    process.env.BETTER_AUTH_URL,\n  ]) {\n    if (!value) continue;\n    try {\n      out.add(new URL(value).origin);\n    } catch {\n      // Ignore malformed deploy metadata.\n    }\n  }\n  return out;\n}\n\nexport function isTrustedEnvVarSyncAgentUrl(agentUrl: string): boolean {\n  let parsed: URL;\n  try {\n    parsed = new URL(agentUrl);\n  } catch {\n    return false;\n  }\n  const hostname = parsed.hostname.toLowerCase();\n  if (\n    hostname === \"localhost\" ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"::1\" ||\n    hostname.endsWith(\".localhost\")\n  ) {\n    return true;\n  }\n  return workspaceBaseOrigins().has(parsed.origin);\n}\n\nfunction scopedFilter<T extends { ownerEmail: any; orgId: any }>(table: T) {\n  return ctxScope(table, requireVaultCtx());\n}\n\nexport async function assertCanManageVault(): Promise<void> {\n  const orgId = currentOrgId();\n  if (!orgId) return;\n\n  const email = currentOwnerEmail().trim().toLowerCase();\n  let role: string | null = null;\n  try {\n    role = await readOrgMemberRole(orgId, email);\n  } catch {\n    // coercion-ok: unknown membership is treated as unauthorized below.\n    // A failed membership check must not become an authorization bypass.\n  }\n\n  if (role !== \"owner\" && role !== \"admin\") {\n    throw Object.assign(\n      new Error(\n        \"Only organization owners and admins can manage the workspace vault.\",\n      ),\n      { statusCode: 403 },\n    );\n  }\n}\n\nexport async function canManageVault(): Promise<boolean> {\n  try {\n    await assertCanManageVault();\n    return true;\n  } catch {\n    // coercion-ok: the UI must treat an authorization lookup failure as no access.\n    return false;\n  }\n}\n\nfunction normalizeCredentialKey(value: string) {\n  return value.trim();\n}\n\nfunction vaultAccessScope() {\n  const orgId = currentOrgId();\n  if (orgId) return { scope: \"org\" as const, scopeId: orgId };\n  return { scope: \"user\" as const, scopeId: currentOwnerEmail() };\n}\n\nfunction parseVaultAccessMode(value: unknown): VaultAccessMode {\n  return value === \"manual\" ? \"manual\" : \"all-apps\";\n}\n\nexport async function getVaultAccessSettings(): Promise<VaultAccessSettings> {\n  const scope = vaultAccessScope();\n  const raw =\n    scope.scope === \"org\"\n      ? await getOrgSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY)\n      : await getUserSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY);\n  return {\n    ...scope,\n    mode: parseVaultAccessMode(raw?.mode),\n  };\n}\n\nexport async function setVaultAccessSettings(input: {\n  mode: VaultAccessMode;\n}): Promise<VaultAccessSettings> {\n  await assertCanManageVault();\n  const scope = vaultAccessScope();\n  const next = { mode: parseVaultAccessMode(input.mode) };\n  if (scope.scope === \"org\") {\n    await putOrgSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY, next);\n  } else {\n    await putUserSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY, next);\n  }\n  await recordAudit({\n    action: \"vault.access-settings.updated\",\n    targetType: \"vault-settings\",\n    targetId: VAULT_ACCESS_SETTINGS_KEY,\n    summary:\n      next.mode === \"all-apps\"\n        ? \"Set vault access to all workspace apps\"\n        : \"Set vault access to manual per-app grants\",\n    metadata: next,\n  });\n  return getVaultAccessSettings();\n}\n\nexport async function recordVaultAudit(input: {\n  action: string;\n  secretId?: string | null;\n  appId?: string | null;\n  summary: string;\n  metadata?: unknown;\n  actor?: string;\n}) {\n  const db = getDb();\n  await db.insert(schema.vaultAuditLog).values({\n    id: id(),\n    ownerEmail: currentOwnerEmail(),\n    orgId: currentOrgId(),\n    secretId: input.secretId || null,\n    appId: input.appId || null,\n    action: input.action,\n    actor: input.actor || currentOwnerEmail(),\n    summary: input.summary,\n    metadata: input.metadata ? safeJson(input.metadata) : null,\n    createdAt: now(),\n  });\n}\n\nexport async function listVaultAudit(limit = 50) {\n  await assertCanManageVault();\n  const db = getDb();\n  return db\n    .select()\n    .from(schema.vaultAuditLog)\n    .where(scopedFilter(schema.vaultAuditLog))\n    .orderBy(desc(schema.vaultAuditLog.createdAt))\n    .limit(limit);\n}\n\nexport async function listSecrets() {\n  await assertCanManageVault();\n  const db = getDb();\n  return db\n    .select()\n    .from(schema.vaultSecrets)\n    .where(scopedFilter(schema.vaultSecrets))\n    .orderBy(desc(schema.vaultSecrets.updatedAt));\n}\n\nexport async function listSecretOptions() {\n  const db = getDb();\n  return db\n    .select({\n      id: schema.vaultSecrets.id,\n      name: schema.vaultSecrets.name,\n      credentialKey: schema.vaultSecrets.credentialKey,\n      provider: schema.vaultSecrets.provider,\n      description: schema.vaultSecrets.description,\n    })\n    .from(schema.vaultSecrets)\n    .where(scopedFilter(schema.vaultSecrets))\n    .orderBy(desc(schema.vaultSecrets.updatedAt));\n}\n\nexport async function getSecret(secretId: string, ctx: VaultCtx) {\n  await assertCanManageVault();\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.vaultSecrets)\n    .where(\n      and(\n        eq(schema.vaultSecrets.id, secretId),\n        ctxScope(schema.vaultSecrets, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nexport async function createSecret(\n  input: {\n    credentialKey: string;\n    value: string;\n    name: string;\n    provider?: string | null;\n    description?: string | null;\n  },\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const timestamp = now();\n  const credentialKey = normalizeCredentialKey(input.credentialKey);\n  if (!credentialKey) throw new Error(\"Credential key is required\");\n  const existing = await db\n    .select()\n    .from(schema.vaultSecrets)\n    .where(\n      and(\n        eq(schema.vaultSecrets.credentialKey, credentialKey),\n        ctxScope(schema.vaultSecrets, ctx),\n      ),\n    )\n    .orderBy(desc(schema.vaultSecrets.updatedAt))\n    .limit(1);\n\n  if (existing[0]) {\n    await db\n      .update(schema.vaultSecrets)\n      .set({\n        name: input.name,\n        credentialKey,\n        value: input.value,\n        provider: input.provider || null,\n        description: input.description || null,\n        updatedAt: timestamp,\n      })\n      .where(\n        and(\n          eq(schema.vaultSecrets.id, existing[0].id),\n          ctxScope(schema.vaultSecrets, ctx),\n        ),\n      );\n\n    await recordVaultAudit({\n      action: \"secret.updated\",\n      secretId: existing[0].id,\n      summary: `Updated secret \"${input.name}\" (${credentialKey})`,\n      metadata: { credentialKey, provider: input.provider },\n    });\n\n    await recordAudit({\n      action: \"vault.secret.updated\",\n      targetType: \"vault-secret\",\n      targetId: existing[0].id,\n      summary: `Updated vault secret \"${input.name}\" (${credentialKey})`,\n    });\n\n    const updated = await getSecret(existing[0].id, ctx);\n    if (updated) {\n      await syncSecretsToCredentialStore(\n        [updated],\n        ctxForSecretRow(updated, ctx),\n      );\n    }\n    return updated;\n  }\n\n  const secretId = id();\n  const actor = ctx.ownerEmail;\n\n  await db.insert(schema.vaultSecrets).values({\n    id: secretId,\n    ownerEmail: actor,\n    orgId: ctx.orgId,\n    name: input.name,\n    credentialKey,\n    value: input.value,\n    provider: input.provider || null,\n    description: input.description || null,\n    createdBy: actor,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n\n  await recordVaultAudit({\n    action: \"secret.created\",\n    secretId,\n    summary: `Created secret \"${input.name}\" (${credentialKey})`,\n    metadata: { credentialKey, provider: input.provider },\n  });\n\n  await recordAudit({\n    action: \"vault.secret.created\",\n    targetType: \"vault-secret\",\n    targetId: secretId,\n    summary: `Created vault secret \"${input.name}\" (${credentialKey})`,\n  });\n\n  const created = await getSecret(secretId, ctx);\n  if (created) {\n    await syncSecretsToCredentialStore(\n      [created],\n      ctxForSecretRow(created, ctx),\n    );\n  }\n  return created;\n}\n\nexport async function updateSecret(\n  secretId: string,\n  input:\n    | string\n    | {\n        credentialKey?: string;\n        value?: string;\n        name?: string;\n        provider?: string | null;\n        description?: string | null;\n      },\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const existing = await getSecret(secretId, ctx);\n  if (!existing) throw new Error(\"Secret not found\");\n  const patch = typeof input === \"string\" ? { value: input } : input;\n  const credentialKey =\n    patch.credentialKey !== undefined\n      ? normalizeCredentialKey(patch.credentialKey)\n      : existing.credentialKey;\n  if (!credentialKey) throw new Error(\"Credential key is required\");\n  const name = patch.name !== undefined ? patch.name.trim() : existing.name;\n  if (!name) throw new Error(\"Secret name is required\");\n  const value = patch.value !== undefined ? patch.value : existing.value;\n  if (!value) throw new Error(\"Secret value is required\");\n  const provider =\n    patch.provider !== undefined ? patch.provider || null : existing.provider;\n  const description =\n    patch.description !== undefined\n      ? patch.description || null\n      : existing.description;\n\n  if (credentialKey !== existing.credentialKey) {\n    const conflict = await db\n      .select({ id: schema.vaultSecrets.id })\n      .from(schema.vaultSecrets)\n      .where(\n        and(\n          eq(schema.vaultSecrets.credentialKey, credentialKey),\n          ctxScope(schema.vaultSecrets, ctx),\n        ),\n      )\n      .limit(1);\n    if (conflict[0] && conflict[0].id !== secretId) {\n      throw new Error(`Credential key \"${credentialKey}\" is already in use`);\n    }\n  }\n\n  await db\n    .update(schema.vaultSecrets)\n    .set({\n      name,\n      credentialKey,\n      value,\n      provider,\n      description,\n      updatedAt: now(),\n    })\n    .where(\n      and(\n        eq(schema.vaultSecrets.id, secretId),\n        ctxScope(schema.vaultSecrets, ctx),\n      ),\n    );\n\n  const auditMetadata = {\n    name,\n    previousName: name !== existing.name ? existing.name : undefined,\n    credentialKey,\n    previousCredentialKey:\n      credentialKey !== existing.credentialKey\n        ? existing.credentialKey\n        : undefined,\n    provider,\n    previousProvider:\n      provider !== existing.provider ? existing.provider : undefined,\n    description,\n    previousDescription:\n      description !== existing.description ? existing.description : undefined,\n    valueChanged: value !== existing.value ? true : undefined,\n  };\n\n  await recordVaultAudit({\n    action: \"secret.updated\",\n    secretId,\n    summary: `Updated secret \"${name}\" (${credentialKey})`,\n    metadata: auditMetadata,\n  });\n\n  await recordAudit({\n    action: \"vault.secret.updated\",\n    targetType: \"vault-secret\",\n    targetId: secretId,\n    summary: `Updated vault secret \"${name}\" (${credentialKey})`,\n    metadata: auditMetadata,\n  });\n\n  const updated = await getSecret(secretId, ctx);\n  if (updated) {\n    await syncSecretsToCredentialStore(\n      [updated],\n      ctxForSecretRow(updated, ctx),\n    );\n  }\n  if (updated && credentialKey !== existing.credentialKey) {\n    await cleanupSyncedCredentialKeysIfUnused(ctxForRow(existing), [\n      existing.credentialKey,\n    ]);\n  } else if (updated && patch.credentialKey !== undefined) {\n    await cleanupSyncedCredentialKeysIfUnused(ctxForSecretRow(updated, ctx));\n  }\n  return updated;\n}\n\nexport async function deleteSecret(\n  secretId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const existing = await getSecret(secretId, ctx);\n  if (!existing) throw new Error(\"Secret not found\");\n\n  const grants = await listGrants({ secretId });\n  for (const grant of grants) {\n    if (grant.status === \"active\") {\n      await revokeGrant(grant.id, ctx);\n    }\n  }\n\n  await db\n    .delete(schema.vaultSecrets)\n    .where(\n      and(\n        eq(schema.vaultSecrets.id, secretId),\n        ctxScope(schema.vaultSecrets, ctx),\n      ),\n    );\n  await cleanupSyncedCredentialKeysIfUnused(ctxForRow(existing), [\n    existing.credentialKey,\n  ]);\n\n  await recordVaultAudit({\n    action: \"secret.deleted\",\n    secretId,\n    summary: `Deleted secret \"${existing.name}\" (${existing.credentialKey})`,\n  });\n\n  await recordAudit({\n    action: \"vault.secret.deleted\",\n    targetType: \"vault-secret\",\n    targetId: secretId,\n    summary: `Deleted vault secret \"${existing.name}\" (${existing.credentialKey})`,\n  });\n\n  return existing;\n}\n\nexport async function listGrants(filter?: {\n  secretId?: string;\n  appId?: string;\n}) {\n  await assertCanManageVault();\n  const db = getDb();\n  const conditions = [scopedFilter(schema.vaultGrants)];\n  if (filter?.secretId) {\n    conditions.push(eq(schema.vaultGrants.secretId, filter.secretId) as any);\n  }\n  if (filter?.appId) {\n    conditions.push(eq(schema.vaultGrants.appId, filter.appId) as any);\n  }\n  return db\n    .select()\n    .from(schema.vaultGrants)\n    .where(and(...conditions))\n    .orderBy(desc(schema.vaultGrants.updatedAt));\n}\n\nexport async function getGrant(\n  grantId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.vaultGrants)\n    .where(\n      and(\n        eq(schema.vaultGrants.id, grantId),\n        ctxScope(schema.vaultGrants, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nexport async function createGrant(\n  secretId: string,\n  appId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const secret = await getSecret(secretId, ctx);\n  if (!secret) throw new Error(\"Secret not found\");\n\n  const timestamp = now();\n  const actor = ctx.ownerEmail;\n  const [existing] = await db\n    .select()\n    .from(schema.vaultGrants)\n    .where(\n      and(\n        eq(schema.vaultGrants.secretId, secretId),\n        eq(schema.vaultGrants.appId, appId),\n        ctxScope(schema.vaultGrants, ctx),\n      ),\n    )\n    .orderBy(desc(schema.vaultGrants.updatedAt))\n    .limit(1);\n\n  if (existing?.status === \"active\") {\n    return existing;\n  }\n\n  if (existing) {\n    await db\n      .update(schema.vaultGrants)\n      .set({\n        grantedBy: actor,\n        status: \"active\",\n        syncedAt: null,\n        updatedAt: timestamp,\n      })\n      .where(\n        and(\n          eq(schema.vaultGrants.id, existing.id),\n          ctxScope(schema.vaultGrants, ctx),\n        ),\n      );\n\n    await recordVaultAudit({\n      action: \"grant.reinstated\",\n      secretId,\n      appId,\n      summary: `Reinstated \"${secret.name}\" (${secret.credentialKey}) for ${appId}`,\n      metadata: { grantId: existing.id },\n    });\n\n    await recordAudit({\n      action: \"vault.grant.reinstated\",\n      targetType: \"vault-grant\",\n      targetId: existing.id,\n      summary: `Reinstated vault secret \"${secret.name}\" for ${appId}`,\n    });\n\n    return getGrant(existing.id, ctx);\n  }\n\n  const grantId = id();\n\n  await db.insert(schema.vaultGrants).values({\n    id: grantId,\n    ownerEmail: actor,\n    orgId: ctx.orgId,\n    secretId,\n    appId,\n    grantedBy: actor,\n    status: \"active\",\n    syncedAt: null,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n\n  await recordVaultAudit({\n    action: \"grant.created\",\n    secretId,\n    appId,\n    summary: `Granted \"${secret.name}\" (${secret.credentialKey}) to ${appId}`,\n    metadata: { grantId },\n  });\n\n  await recordAudit({\n    action: \"vault.grant.created\",\n    targetType: \"vault-grant\",\n    targetId: grantId,\n    summary: `Granted vault secret \"${secret.name}\" to ${appId}`,\n  });\n\n  return getGrant(grantId);\n}\n\nexport async function grantSecretsToApp(\n  secretIds: string[],\n  appId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const access = await getVaultAccessSettings();\n  const uniqueSecretIds = Array.from(new Set(secretIds));\n  if (access.mode === \"all-apps\") {\n    return {\n      appId,\n      accessMode: access.mode,\n      created: [],\n      skipped: uniqueSecretIds,\n    };\n  }\n  const existingActive = (await listGrants({ appId })).filter(\n    (grant) => grant.status === \"active\",\n  );\n  const existingSecretIds = new Set(\n    existingActive.map((grant) => grant.secretId),\n  );\n  const created = [];\n  const skipped: string[] = [];\n\n  for (const secretId of uniqueSecretIds) {\n    if (existingSecretIds.has(secretId)) {\n      skipped.push(secretId);\n      continue;\n    }\n    const grant = await createGrant(secretId, appId, ctx);\n    if (grant) {\n      created.push(grant);\n      existingSecretIds.add(secretId);\n    }\n  }\n\n  return { appId, accessMode: access.mode, created, skipped };\n}\n\nexport async function revokeGrant(\n  grantId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const grant = await getGrant(grantId, ctx);\n  if (!grant) throw new Error(\"Grant not found\");\n\n  const secret = await getSecret(grant.secretId, ctx);\n\n  await db\n    .update(schema.vaultGrants)\n    .set({ status: \"revoked\", updatedAt: now() })\n    .where(\n      and(\n        eq(schema.vaultGrants.id, grantId),\n        ctxScope(schema.vaultGrants, ctx),\n      ),\n    );\n\n  await recordVaultAudit({\n    action: \"grant.revoked\",\n    secretId: grant.secretId,\n    appId: grant.appId,\n    summary: `Revoked ${secret?.credentialKey || grant.secretId} from ${grant.appId}`,\n    metadata: { grantId },\n  });\n\n  await recordAudit({\n    action: \"vault.grant.revoked\",\n    targetType: \"vault-grant\",\n    targetId: grantId,\n    summary: `Revoked vault secret \"${secret?.name || grant.secretId}\" from ${grant.appId}`,\n  });\n\n  return getGrant(grantId, ctx);\n}\n\ntype VaultSecretRow = typeof schema.vaultSecrets.$inferSelect;\n\nexport interface VaultSecretMetadata {\n  id: string;\n  name: string;\n  credentialKey: string;\n  last4: string;\n  provider: string | null;\n  description: string | null;\n  createdBy: string;\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport function toVaultSecretMetadata(\n  secret: VaultSecretRow | null,\n): VaultSecretMetadata | null {\n  if (!secret) return null;\n  return {\n    id: secret.id,\n    name: secret.name,\n    credentialKey: secret.credentialKey,\n    last4: last4(secret.value),\n    provider: secret.provider,\n    description: secret.description,\n    createdBy: secret.createdBy,\n    createdAt: secret.createdAt,\n    updatedAt: secret.updatedAt,\n  };\n}\n\nexport function credentialStoreScopeForVaultCtx(ctx: VaultCtx): {\n  scope: Extract<SecretScope, \"org\" | \"workspace\">;\n  scopeId: string;\n} {\n  if (ctx.orgId) return { scope: \"org\", scopeId: ctx.orgId };\n  return { scope: \"workspace\", scopeId: `solo:${ctx.ownerEmail}` };\n}\n\nexport async function syncSecretsToCredentialStore(\n  secrets: VaultSecretRow[],\n  ctx: VaultCtx,\n) {\n  const target = credentialStoreScopeForVaultCtx(ctx);\n  const syncedKeys: string[] = [];\n\n  for (const secret of secrets) {\n    if (!secret.credentialKey || !secret.value) continue;\n    await writeAppSecret({\n      key: secret.credentialKey,\n      value: secret.value,\n      scope: target.scope,\n      scopeId: target.scopeId,\n      description: `${VAULT_SYNC_DESCRIPTION_PREFIX} ${secret.name}`,\n    });\n    syncedKeys.push(secret.credentialKey);\n  }\n\n  return { ...target, keys: syncedKeys };\n}\n\n/**\n * Group secrets by the tenant their credential-store rows must land in.\n *\n * Every sync path must write a secret under the org that *owns the row*, not\n * under whoever happens to be syncing: `writeAppSecret` upserts, so syncing\n * with the caller's ctx copies credential material into the caller's org\n * instead of moving it, and it accumulates there permanently.\n */\nfunction groupSecretsByTenant(\n  rows: VaultSecretRow[],\n  resolveCtx: (row: VaultSecretRow) => VaultCtx,\n): { ctx: VaultCtx; rows: VaultSecretRow[] }[] {\n  const groups = new Map<string, { ctx: VaultCtx; rows: VaultSecretRow[] }>();\n  for (const row of rows) {\n    if (!row.credentialKey || !row.value) continue;\n    const ctx = resolveCtx(row);\n    const groupKey = `${ctx.orgId ?? \"\"}\\u0000${ctx.ownerEmail}`;\n    const group = groups.get(groupKey);\n    if (group) {\n      group.rows.push(row);\n    } else {\n      groups.set(groupKey, { ctx, rows: [row] });\n    }\n  }\n  return [...groups.values()];\n}\n\n/**\n * Re-sync one bounded page of vault secrets across tenants into the shared\n * credential store. Continue with `nextCursor` only from an explicit\n * maintenance caller; this must not run automatically during process startup.\n *\n * `syncSecretsToCredentialStore` normally only runs on `createSecret` /\n * `updateSecret`, so it only re-encrypts the rows a user happens to touch.\n * When the shared `app_secrets` encryption format changes underneath it\n * (e.g. a new dual-write format, or a change to how key material is\n * derived), existing rows are stuck on the old format until someone\n * manually re-saves each vault secret. This reads a keyset page directly —\n * bypassing the ctx-scoped `listSecrets()` — groups the rows by their\n * (orgId, ownerEmail) tenant, and re-runs the sync per group.\n *\n * A failure syncing one tenant's group is caught and logged (key NAMES\n * only, never values) so it can't block the rest of the resync. If a group\n * fails, `nextCursor` rewinds to before its first row so the next pass retries\n * it; check `failedGroups` before treating a null cursor as completion.\n */\nexport async function resyncVaultSecretsToCredentialStorePage(\n  options: {\n    afterId?: string;\n    limit?: number;\n  } = {},\n): Promise<{\n  groups: number;\n  failedGroups: number;\n  syncedKeys: number;\n  nextCursor: string | null;\n}> {\n  const requestedLimit = options.limit ?? 100;\n  const limit = Number.isFinite(requestedLimit)\n    ? Math.min(500, Math.max(1, Math.floor(requestedLimit)))\n    : 100;\n  const db = getDb();\n  const rowsWithNext = await db\n    .select()\n    .from(schema.vaultSecrets)\n    .where(\n      options.afterId ? gt(schema.vaultSecrets.id, options.afterId) : undefined,\n    )\n    .orderBy(asc(schema.vaultSecrets.id))\n    .limit(limit + 1);\n  const hasMore = rowsWithNext.length > limit;\n  const rows = hasMore ? rowsWithNext.slice(0, limit) : rowsWithNext;\n\n  const groups = groupSecretsByTenant(rows, ctxForRow);\n\n  let failedGroups = 0;\n  let syncedKeys = 0;\n  let firstFailedRowIndex = Number.POSITIVE_INFINITY;\n\n  for (const { ctx, rows: groupRows } of groups) {\n    try {\n      const result = await syncSecretsToCredentialStore(groupRows, ctx);\n      syncedKeys += result.keys.length;\n    } catch (error) {\n      failedGroups++;\n      const firstRowIndex = rows.findIndex(\n        (row) => row.id === groupRows[0]?.id,\n      );\n      firstFailedRowIndex = Math.min(firstFailedRowIndex, firstRowIndex);\n      const keyNames = groupRows.map((row) => row.credentialKey).join(\", \");\n      console.warn(\n        `[dispatch] vault boot resync failed for org=${ctx.orgId ?? \"(solo)\"} owner=${ctx.ownerEmail}; affected keys: ${keyNames}`,\n        error instanceof Error ? error.message : error,\n      );\n    }\n  }\n\n  return {\n    groups: groups.length,\n    failedGroups,\n    syncedKeys,\n    nextCursor:\n      failedGroups > 0\n        ? (rows[firstFailedRowIndex - 1]?.id ?? options.afterId ?? null)\n        : hasMore\n          ? (rows.at(-1)?.id ?? null)\n          : null,\n  };\n}\n\nexport async function cleanupSyncedCredentialKeysIfUnused(\n  ctx: VaultCtx,\n  candidateKeys?: string[],\n) {\n  const db = getDb();\n  const target = credentialStoreScopeForVaultCtx(ctx);\n  const keys = candidateKeys\n    ? candidateKeys\n    : (await listAppSecretsForScope(target.scope, target.scopeId))\n        .filter((secret) =>\n          secret.description?.startsWith(VAULT_SYNC_DESCRIPTION_PREFIX),\n        )\n        .map((secret) => secret.key);\n\n  for (const key of new Set(keys.filter(Boolean))) {\n    const stillUsesKey = await db\n      .select({ id: schema.vaultSecrets.id })\n      .from(schema.vaultSecrets)\n      .where(\n        and(\n          eq(schema.vaultSecrets.credentialKey, key),\n          ctxScope(schema.vaultSecrets, ctx),\n        ),\n      )\n      .limit(1);\n    if (!stillUsesKey[0]) {\n      await deleteAppSecret({\n        key,\n        scope: target.scope,\n        scopeId: target.scopeId,\n      });\n    }\n  }\n}\n\nexport async function syncGrantsToApp(\n  appId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const access = await getVaultAccessSettings();\n  const agents = await discoverAgents(\"dispatch\");\n  const agent = agents.find((a) => a.id === appId);\n  if (!agent) throw new Error(`App \"${appId}\" not found in agent registry`);\n\n  const secretsToSync: VaultSecretRow[] = [];\n  const activeGrants =\n    access.mode === \"manual\"\n      ? (await listGrants({ appId })).filter((g) => g.status === \"active\")\n      : [];\n\n  if (access.mode === \"all-apps\") {\n    const secrets = await listSecrets();\n    for (const secret of secrets) {\n      secretsToSync.push(secret);\n    }\n  } else {\n    for (const grant of activeGrants) {\n      const secret = await getSecret(grant.secretId, ctx);\n      if (secret) {\n        secretsToSync.push(secret);\n      }\n    }\n  }\n\n  if (secretsToSync.length === 0) {\n    return {\n      appId,\n      accessMode: access.mode,\n      synced: 0,\n      keys: [],\n      credentialStores: [],\n    };\n  }\n\n  const credentialStoreGroups = groupSecretsByTenant(secretsToSync, (row) =>\n    ctxForSecretRow(row, ctx),\n  );\n  const credentialStores: {\n    scope: ReturnType<typeof credentialStoreScopeForVaultCtx>[\"scope\"];\n    scopeId: string;\n    synced: number;\n  }[] = [];\n  const credentialStoreKeys: string[] = [];\n  for (const group of credentialStoreGroups) {\n    const result = await syncSecretsToCredentialStore(group.rows, group.ctx);\n    credentialStores.push({\n      scope: result.scope,\n      scopeId: result.scopeId,\n      synced: result.keys.length,\n    });\n    credentialStoreKeys.push(...result.keys);\n  }\n\n  const vars = secretsToSync.map((secret) => ({\n    key: secret.credentialKey,\n    value: secret.value,\n  }));\n  let envVarSync:\n    | { status: \"synced\"; keys: string[] }\n    | { status: \"skipped\"; reason: string }\n    | { status: \"failed\"; reason: string };\n\n  if (!isTrustedEnvVarSyncAgentUrl(agent.url)) {\n    envVarSync = {\n      status: \"skipped\",\n      reason: \"env-var sync is limited to localhost or workspace-owned apps\",\n    };\n  } else {\n    try {\n      const res = await ssrfSafeFetch(\n        `${agent.url}/_agent-native/env-vars`,\n        {\n          method: \"POST\",\n          headers: { \"Content-Type\": \"application/json\" },\n          body: JSON.stringify({ vars }),\n          signal: AbortSignal.timeout(10_000),\n        },\n        { maxRedirects: 3 },\n      );\n\n      if (res.ok) {\n        const result = await res.json();\n        envVarSync = { status: \"synced\", keys: result.saved || [] };\n      } else {\n        const err = await res.text().catch(() => \"Unknown error\");\n        envVarSync = { status: \"skipped\", reason: err };\n      }\n    } catch (err) {\n      envVarSync = {\n        status: \"failed\",\n        reason: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  const syncedKeys = credentialStoreKeys;\n  const timestamp = now();\n\n  for (const grant of activeGrants) {\n    const secret = await getSecret(grant.secretId, ctx);\n    if (secret && syncedKeys.includes(secret.credentialKey)) {\n      await db\n        .update(schema.vaultGrants)\n        .set({ syncedAt: timestamp, updatedAt: timestamp })\n        .where(eq(schema.vaultGrants.id, grant.id));\n    }\n  }\n\n  await recordVaultAudit({\n    action: \"secret.synced\",\n    appId,\n    summary: `Synced ${syncedKeys.length} secret(s) to ${appId}: ${syncedKeys.join(\", \")}`,\n    metadata: {\n      syncedKeys,\n      accessMode: access.mode,\n      credentialStores,\n      envVars: envVarSync,\n    },\n  });\n\n  return {\n    appId,\n    accessMode: access.mode,\n    synced: syncedKeys.length,\n    keys: syncedKeys,\n    credentialStores,\n    envVars: envVarSync,\n  };\n}\n\nexport async function listRequests(filter?: { status?: string }) {\n  const db = getDb();\n  const ctx = requireVaultCtx();\n  const isAdmin = await canManageVault();\n  const conditions = [\n    isAdmin\n      ? ctxScope(schema.vaultRequests, ctx)\n      : eq(schema.vaultRequests.ownerEmail, ctx.ownerEmail),\n  ];\n  if (filter?.status) {\n    conditions.push(eq(schema.vaultRequests.status, filter.status) as any);\n  }\n  return db\n    .select()\n    .from(schema.vaultRequests)\n    .where(and(...conditions))\n    .orderBy(desc(schema.vaultRequests.updatedAt));\n}\n\nexport async function getRequest(\n  requestId: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.vaultRequests)\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        ctxScope(schema.vaultRequests, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nasync function getRequestForTenant(requestId: string, ctx: VaultCtx) {\n  const db = getDb();\n  const [row] = await db\n    .select()\n    .from(schema.vaultRequests)\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        tenantScope(schema.vaultRequests, ctx),\n      ),\n    )\n    .limit(1);\n  return row ?? null;\n}\n\nexport async function createRequest(input: {\n  credentialKey: string;\n  appId: string;\n  reason?: string | null;\n}) {\n  const db = getDb();\n  const timestamp = now();\n  const requestId = id();\n  const actor = currentOwnerEmail();\n\n  await db.insert(schema.vaultRequests).values({\n    id: requestId,\n    ownerEmail: actor,\n    orgId: currentOrgId(),\n    credentialKey: input.credentialKey,\n    appId: input.appId,\n    reason: input.reason || null,\n    requestedBy: actor,\n    status: \"pending\",\n    reviewedBy: null,\n    reviewedAt: null,\n    createdAt: timestamp,\n    updatedAt: timestamp,\n  });\n\n  await recordVaultAudit({\n    action: \"request.created\",\n    appId: input.appId,\n    summary: `${actor} requested ${input.credentialKey} for ${input.appId}`,\n    metadata: { requestId, reason: input.reason },\n  });\n\n  await notifyAdminsOfRequest(requestId, input);\n\n  return getRequest(requestId);\n}\n\nexport async function approveRequest(\n  requestId: string,\n  secretValue: string,\n  secretName?: string,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const request = await getRequestForTenant(requestId, ctx);\n  if (!request) throw new Error(\"Request not found\");\n\n  const timestamp = now();\n  const reviewer = ctx.ownerEmail;\n  const staleApplyingBefore = timestamp - 5 * 60 * 1000;\n\n  // Fence the transition on the current status — scoped to caller's tenant —\n  // so a concurrent approve can't both win: only the caller that flips\n  // pending -> applying proceeds to create the secret/grant. A crashed worker\n  // leaves an applying row behind, so a later reviewer may reclaim a lease\n  // that has been idle for five minutes. See\n  // claimAgentTeamRun in packages/core/src/server/agent-teams-run-queue.ts\n  // for the same pattern.\n  const claimed = await db\n    .update(schema.vaultRequests)\n    .set({\n      status: \"applying\",\n      updatedAt: timestamp,\n    })\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        tenantScope(schema.vaultRequests, ctx),\n        or(\n          eq(schema.vaultRequests.status, \"pending\"),\n          and(\n            eq(schema.vaultRequests.status, \"applying\"),\n            sql`${schema.vaultRequests.updatedAt} < ${staleApplyingBefore}`,\n          ),\n        ),\n      ),\n    )\n    .returning();\n\n  if (claimed.length === 0) {\n    const current = await getRequestForTenant(requestId, ctx);\n    if (current?.status === \"applying\") {\n      throw new Error(\"Vault request is already being applied\");\n    }\n    return current;\n  }\n\n  const claimedRequest = claimed[0];\n\n  // Secret + grant must land in the REQUEST's tenant, not the approver's\n  // (the approver may be acting on behalf of another user in the same org).\n  const requestCtx = ctxForRow(claimedRequest);\n\n  try {\n    const existingSecrets = await db\n      .select()\n      .from(schema.vaultSecrets)\n      .where(\n        and(\n          eq(schema.vaultSecrets.credentialKey, claimedRequest.credentialKey),\n          ctxScope(schema.vaultSecrets, requestCtx),\n        ),\n      );\n    let secret = existingSecrets[0] ?? null;\n\n    if (!secret) {\n      secret = await createSecret(\n        {\n          credentialKey: claimedRequest.credentialKey,\n          value: secretValue,\n          name: secretName || claimedRequest.credentialKey,\n        },\n        requestCtx,\n      );\n    }\n\n    if (secret) {\n      await createGrant(secret.id, claimedRequest.appId, requestCtx);\n    }\n  } catch (error) {\n    await db\n      .update(schema.vaultRequests)\n      .set({ status: \"pending\", updatedAt: now() })\n      .where(\n        and(\n          eq(schema.vaultRequests.id, requestId),\n          tenantScope(schema.vaultRequests, ctx),\n          eq(schema.vaultRequests.status, \"applying\"),\n        ),\n      );\n    throw error;\n  }\n\n  await db\n    .update(schema.vaultRequests)\n    .set({\n      status: \"approved\",\n      reviewedBy: reviewer,\n      reviewedAt: timestamp,\n      updatedAt: now(),\n    })\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        tenantScope(schema.vaultRequests, ctx),\n        eq(schema.vaultRequests.status, \"applying\"),\n      ),\n    );\n\n  await recordVaultAudit({\n    action: \"request.approved\",\n    appId: claimedRequest.appId,\n    summary: `Approved ${claimedRequest.credentialKey} for ${claimedRequest.appId} (requested by ${claimedRequest.requestedBy})`,\n    metadata: { requestId, reviewer },\n  });\n\n  return getRequestForTenant(requestId, ctx);\n}\n\nexport async function denyRequest(\n  requestId: string,\n  reason?: string | null,\n  ctx: VaultCtx = requireVaultCtx(),\n) {\n  await assertCanManageVault();\n  const db = getDb();\n  const request = await getRequestForTenant(requestId, ctx);\n  if (!request) throw new Error(\"Request not found\");\n\n  const timestamp = now();\n  const reviewer = ctx.ownerEmail;\n\n  const claimed = await db\n    .update(schema.vaultRequests)\n    .set({\n      status: \"denied\",\n      reviewedBy: reviewer,\n      reviewedAt: timestamp,\n      updatedAt: timestamp,\n    })\n    .where(\n      and(\n        eq(schema.vaultRequests.id, requestId),\n        tenantScope(schema.vaultRequests, ctx),\n        eq(schema.vaultRequests.status, \"pending\"),\n      ),\n    )\n    .returning();\n\n  if (claimed.length === 0) {\n    return getRequestForTenant(requestId, ctx);\n  }\n\n  const claimedRequest = claimed[0];\n\n  await recordVaultAudit({\n    action: \"request.denied\",\n    appId: claimedRequest.appId,\n    summary: `Denied ${claimedRequest.credentialKey} for ${claimedRequest.appId} (requested by ${claimedRequest.requestedBy})`,\n    metadata: { requestId, reviewer, reason },\n  });\n\n  return getRequestForTenant(requestId, ctx);\n}\n\nexport interface IntegrationEntry {\n  key: string;\n  label: string;\n  required: boolean;\n  configured: boolean;\n  vaultGranted: boolean;\n  vaultSecretId?: string;\n  secret: boolean;\n}\n\nexport interface AppIntegrations {\n  appId: string;\n  appName: string;\n  url: string;\n  color: string;\n  integrations: IntegrationEntry[];\n  vaultAccessMode: VaultAccessMode;\n  reachable: boolean;\n}\n\nexport async function listIntegrationsCatalog(): Promise<AppIntegrations[]> {\n  const access = await getVaultAccessSettings();\n  const agents = await discoverAgents(\"dispatch\");\n  const grants = (await canManageVault()) ? await listGrants() : [];\n  const secrets = await listSecretOptions();\n\n  const secretByKey = new Map(secrets.map((s) => [s.credentialKey, s]));\n\n  const results: AppIntegrations[] = [];\n\n  for (const agent of agents) {\n    try {\n      const res = await ssrfSafeFetch(\n        `${agent.url}/_agent-native/env-status`,\n        {\n          signal: AbortSignal.timeout(3000),\n        },\n        { maxRedirects: 3 },\n      );\n      if (!res.ok) {\n        results.push({\n          appId: agent.id,\n          appName: agent.name,\n          url: agent.url,\n          color: agent.color,\n          integrations: [],\n          vaultAccessMode: access.mode,\n          reachable: false,\n        });\n        continue;\n      }\n\n      const envStatus: Array<{\n        key: string;\n        label: string;\n        required: boolean;\n        configured: boolean;\n        secret?: boolean;\n      }> = await res.json();\n\n      const appGrants = grants.filter(\n        (g) => g.appId === agent.id && g.status === \"active\",\n      );\n      const grantedSecretIds = new Set(appGrants.map((g) => g.secretId));\n\n      const integrations: IntegrationEntry[] = envStatus.map((env) => {\n        const matchingSecret = secretByKey.get(env.key);\n        return {\n          key: env.key,\n          label: env.label,\n          required: env.required,\n          configured: env.configured,\n          vaultGranted:\n            !!matchingSecret &&\n            (access.mode === \"all-apps\" ||\n              grantedSecretIds.has(matchingSecret.id)),\n          vaultSecretId: matchingSecret?.id,\n          secret: env.secret ?? true,\n        };\n      });\n\n      results.push({\n        appId: agent.id,\n        appName: agent.name,\n        url: agent.url,\n        color: agent.color,\n        integrations,\n        vaultAccessMode: access.mode,\n        reachable: true,\n      });\n    } catch {\n      results.push({\n        appId: agent.id,\n        appName: agent.name,\n        url: agent.url,\n        color: agent.color,\n        integrations: [],\n        vaultAccessMode: access.mode,\n        reachable: false,\n      });\n    }\n  }\n\n  return results;\n}\n\nexport async function listVaultOverview() {\n  const isAdmin = await canManageVault();\n  const [secrets, grants, requests, access] = await Promise.all([\n    listSecretOptions(),\n    isAdmin ? listGrants() : Promise.resolve([]),\n    listRequests(),\n    getVaultAccessSettings(),\n  ]);\n  const manualGrantCount = grants.filter((g) => g.status === \"active\").length;\n\n  return {\n    accessMode: access.mode,\n    secretCount: secrets.length,\n    activeGrantCount:\n      access.mode === \"all-apps\"\n        ? secrets.length\n        : isAdmin\n          ? manualGrantCount\n          : 0,\n    manualGrantCount: isAdmin ? manualGrantCount : 0,\n    pendingRequestCount: requests.filter((r) => r.status === \"pending\").length,\n  };\n}\n\nasync function notifyAdminsOfRequest(\n  requestId: string,\n  input: { credentialKey: string; appId: string; reason?: string | null },\n) {\n  const apiKey = process.env.SENDGRID_API_KEY;\n  const from = process.env.SENDGRID_FROM_EMAIL;\n  const appUrl = process.env.APP_URL;\n  if (!apiKey || !from || !appUrl) return;\n\n  const { approverRecipients, getApprovalPolicy } =\n    await import(\"./dispatch-store.js\");\n  const recipients = approverRecipients(\n    (await getApprovalPolicy()).approverEmails,\n  );\n  if (recipients.length === 0) return;\n\n  const body = [\n    `Secret request: ${input.credentialKey} for ${input.appId}`,\n    input.reason ? `Reason: ${input.reason}` : \"\",\n    `Requested by: ${currentOwnerEmail()}`,\n    \"\",\n    `Review it here: ${appUrl}/vault`,\n  ]\n    .filter(Boolean)\n    .join(\"\\n\");\n\n  await fetch(\"https://api.sendgrid.com/v3/mail/send\", {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${apiKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      personalizations: [\n        {\n          to: recipients.map((email) => ({ email })),\n          subject: `Vault request: ${input.credentialKey} for ${input.appId}`,\n        },\n      ],\n      from: { email: from },\n      content: [{ type: \"text/plain\", value: body }],\n      custom_args: { requestId },\n    }),\n  }).catch(() => {});\n}\n"]}

package/dist/server/lib/workspace-app-action-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-app-action-auth.d.ts","sourceRoot":"","sources":["../../../src/server/lib/workspace-app-action-auth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,2BAA2B,CAAC;AAGnC,eAAO,MAAM,0BAA0B,+CACO,CAAC;AAC/C,eAAO,MAAM,+BAA+B,4DACe,CAAC;AAgD5D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAuEzC,CAAC"}
+{"version":3,"file":"workspace-app-action-auth.d.ts","sourceRoot":"","sources":["../../../src/server/lib/workspace-app-action-auth.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,2BAA2B,CAAC;AAGnC,eAAO,MAAM,0BAA0B,+CACO,CAAC;AAC/C,eAAO,MAAM,+BAA+B,4DACe,CAAC;AAgD5D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAiFzC,CAAC"}

package/dist/server/lib/workspace-app-action-auth.js

@@ -88,7 +88,9 @@ export const workspaceAppActionRouteAuth = {
                     refuseRegistryCaller("org-mismatch");
                 }
             }
-            if (!(await isOrgMember(claimedOrgId, identity.email))) {
+            if (!(await isOrgMember(claimedOrgId, identity.email, {
+                requestEvent: event,
+            }))) {
                 refuseRegistryCaller("not-org-member");
             }
             orgId = claimedOrgId;
@@ -97,7 +99,9 @@ export const workspaceAppActionRouteAuth = {
             const org = await resolveOrgByDomain(orgDomain);
             if (!org)
                 refuseRegistryCaller("org-unknown");
-            if (!(await isOrgMember(org.orgId, identity.email))) {
+            if (!(await isOrgMember(org.orgId, identity.email, {
+                requestEvent: event,
+            }))) {
                 refuseRegistryCaller("not-org-member");
             }
             orgId = org.orgId;
@@ -109,6 +113,7 @@ export const workspaceAppActionRouteAuth = {
             owner: identity.email,
             anonymous: false,
             orgId,
+            identityAssurance: identity.identityAssurance === "org-member" ? "org-member" : "user",
         };
     },
 };

package/dist/server/lib/workspace-app-action-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-app-action-auth.js","sourceRoot":"","sources":["../../../src/server/lib/workspace-app-action-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,MAAM,CAAC,MAAM,0BAA0B,GACrC,4CAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,+BAA+B,GAC1C,yDAAyD,CAAC;AAE5D,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AAEzE,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE3C,2EAA2E;AAC3E,2EAA2E;AAC3E,6DAA6D;AAC7D,SAAS,oBAAoB,CAAC,MAAc,EAAE,KAAc;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAU;IAC3C,MAAM,MAAM,GACV,CAAC,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,KAAK,QAAQ;QACnD,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;QAC/C,CAAC,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChE,CAAC,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACjE,CAAC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QACtD,GAAG,CAAC;IACN,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,0BAA0B,EAAE,+BAA+B,CAAC,CAAC,IAAI,CACvE,CAAC,UAAU,EAAE,EAAE,CACb,WAAW,KAAK,UAAU;QAC1B,OAAO,CAAC,WAAW,IAAI,GAAG,WAAW,GAAG,UAAU,EAAE,KAAK,WAAW,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAU;IACzC,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;IACjE,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,aAAa,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,aAAa,EAAE,KAAK,EAAE,KAAK,EAA6C,EAAE;QACxE,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnD,MAAM,aAAa,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,aAAa,GACjB,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;YACzC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;YACnC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QACjC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,KAAK;gBAChB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,wEAAwE;YACxE,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,QAAQ,CAAC,iBAAiB,KAAK,cAAc,EAAE,CAAC;gBAClD,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;YAC7C,CAAC;YACD,oBAAoB,CAClB,oBAAoB,EACpB,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAC5C,IAAI,KAAoB,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBAChD,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;oBACtC,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvD,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,GAAG,YAAY,CAAC;QACvB,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG;gBAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpD,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAED,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,KAAK;YAChB,KAAK;SACN,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["import {\n  diagnoseA2ATokenFailure,\n  verifyA2AToken,\n} from \"@agent-native/core/a2a\";\nimport {\n  isOrgMember,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n} from \"@agent-native/core/org\";\nimport type {\n  ActionRouteAuthAdapter,\n  ActionRouteResolvedCaller,\n} from \"@agent-native/core/server\";\nimport { getSession } from \"@agent-native/core/server\";\n\nexport const WORKSPACE_APPS_ACTION_PATH =\n  \"/_agent-native/actions/list-workspace-apps\";\nexport const WORKSPACE_APP_CLAIM_ACTION_PATH =\n  \"/_agent-native/actions/claim-workspace-app-organization\";\n\nconst REGISTRY_AUTH_REFUSED = \"Invalid workspace registry authorization\";\n\n// The registry is re-asked on every request of every guarded app, so a single\n// misconfigured workspace would otherwise log the same refusal per request.\nconst reportedRefusals = new Set<string>();\n\n// The caller always gets the same bare 401, whatever refused it: any finer\n// answer would tell an unauthenticated caller whether a guessed secret was\n// right. The reason and cause exist for the server log only.\nfunction refuseRegistryCaller(reason: string, cause?: string): never {\n  const key = cause ? `${reason}:${cause}` : reason;\n  if (!reportedRefusals.has(key)) {\n    reportedRefusals.add(key);\n    console.warn(\"[workspace-registry-auth] refused caller\", { reason, cause });\n  }\n  throw new Error(REGISTRY_AUTH_REFUSED);\n}\n\nfunction isWorkspaceAppsActionPath(event: any): boolean {\n  const rawUrl =\n    (typeof event?.context?._mountedPathname === \"string\" &&\n      event.context._mountedPathname) ||\n    (typeof event?.path === \"string\" && event.path) ||\n    (typeof event?.url?.pathname === \"string\" && event.url.pathname) ||\n    (typeof event?.node?.req?.url === \"string\" && event.node.req.url) ||\n    (typeof event?.req?.url === \"string\" && event.req.url) ||\n    \"/\";\n  const requestPath =\n    String(rawUrl).split(\"?\", 1)[0].replace(/\\/+$/, \"\") || \"/\";\n  const appBasePath = process.env.APP_BASE_PATH?.trim().replace(/\\/+$/, \"\");\n  return [WORKSPACE_APPS_ACTION_PATH, WORKSPACE_APP_CLAIM_ACTION_PATH].some(\n    (actionPath) =>\n      requestPath === actionPath ||\n      Boolean(appBasePath && `${appBasePath}${actionPath}` === requestPath),\n  );\n}\n\nfunction readAuthorizationHeader(event: any): string | undefined {\n  const headers = event?.node?.req?.headers ?? event?.req?.headers;\n  if (typeof headers?.get === \"function\") {\n    return headers.get(\"authorization\") ?? undefined;\n  }\n  const value = headers?.authorization ?? headers?.Authorization;\n  return Array.isArray(value) ? value[0] : value;\n}\n\n/**\n * The hosted workspace registry actions accept a caller JWT from Dispatch.\n * Keep this resolver path-scoped so the shared secret never becomes a bearer\n * credential for unrelated Dispatch actions.\n */\nexport const workspaceAppActionRouteAuth: ActionRouteAuthAdapter = {\n  resolveCaller: async (event): Promise<ActionRouteResolvedCaller | null> => {\n    if (!isWorkspaceAppsActionPath(event)) return null;\n\n    const authorization = readAuthorizationHeader(event);\n    if (!authorization) return null;\n    if (!authorization.startsWith(\"Bearer \")) {\n      refuseRegistryCaller(\"malformed-authorization\");\n    }\n\n    const hasRequestUrl =\n      typeof event?.node?.req?.url === \"string\" ||\n      typeof event?.req?.url === \"string\" ||\n      typeof event?.url === \"string\";\n    const session = hasRequestUrl ? await getSession(event) : null;\n    if (session?.email) {\n      return {\n        owner: session.email,\n        anonymous: false,\n        ...(session.orgId ? { orgId: session.orgId } : {}),\n      };\n    }\n\n    const token = authorization.slice(\"Bearer \".length).trim();\n    if (!token) refuseRegistryCaller(\"malformed-authorization\");\n\n    const identity = await verifyA2AToken(token, event);\n    if (!identity.email) {\n      // An organization principal is a token that verified but may not name a\n      // user: its org secret equals the deploy secret, or only the org secret\n      // verified it. Anything else failed outright.\n      if (identity.identityAssurance === \"organization\") {\n        refuseRegistryCaller(\"token-without-user\");\n      }\n      refuseRegistryCaller(\n        \"token-not-verified\",\n        await diagnoseA2ATokenFailure(token, event),\n      );\n    }\n\n    const orgDomain = identity.orgDomain?.trim().toLowerCase();\n    const claimedOrgId = identity.orgId?.trim();\n    let orgId: string | null;\n    if (claimedOrgId) {\n      if (orgDomain) {\n        const org = await resolveOrgByDomain(orgDomain);\n        if (org && org.orgId !== claimedOrgId) {\n          refuseRegistryCaller(\"org-mismatch\");\n        }\n      }\n      if (!(await isOrgMember(claimedOrgId, identity.email))) {\n        refuseRegistryCaller(\"not-org-member\");\n      }\n      orgId = claimedOrgId;\n    } else if (orgDomain) {\n      const org = await resolveOrgByDomain(orgDomain);\n      if (!org) refuseRegistryCaller(\"org-unknown\");\n      if (!(await isOrgMember(org.orgId, identity.email))) {\n        refuseRegistryCaller(\"not-org-member\");\n      }\n      orgId = org.orgId;\n    } else {\n      orgId = await resolveOrgIdForEmail(identity.email);\n    }\n\n    return {\n      owner: identity.email,\n      anonymous: false,\n      orgId,\n    };\n  },\n};\n"]}
+{"version":3,"file":"workspace-app-action-auth.js","sourceRoot":"","sources":["../../../src/server/lib/workspace-app-action-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,cAAc,GACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,MAAM,CAAC,MAAM,0BAA0B,GACrC,4CAA4C,CAAC;AAC/C,MAAM,CAAC,MAAM,+BAA+B,GAC1C,yDAAyD,CAAC;AAE5D,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AAEzE,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE3C,2EAA2E;AAC3E,2EAA2E;AAC3E,6DAA6D;AAC7D,SAAS,oBAAoB,CAAC,MAAc,EAAE,KAAc;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAU;IAC3C,MAAM,MAAM,GACV,CAAC,OAAO,KAAK,EAAE,OAAO,EAAE,gBAAgB,KAAK,QAAQ;QACnD,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;QAC/C,CAAC,OAAO,KAAK,EAAE,GAAG,EAAE,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChE,CAAC,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACjE,CAAC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;QACtD,GAAG,CAAC;IACN,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,OAAO,CAAC,0BAA0B,EAAE,+BAA+B,CAAC,CAAC,IAAI,CACvE,CAAC,UAAU,EAAE,EAAE,CACb,WAAW,KAAK,UAAU;QAC1B,OAAO,CAAC,WAAW,IAAI,GAAG,WAAW,GAAG,UAAU,EAAE,KAAK,WAAW,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAU;IACzC,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;IACjE,IAAI,OAAO,OAAO,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,aAAa,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,aAAa,EAAE,KAAK,EAAE,KAAK,EAA6C,EAAE;QACxE,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnD,MAAM,aAAa,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,aAAa,GACjB,OAAO,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;YACzC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;YACnC,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QACjC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,KAAK;gBAChB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,wEAAwE;YACxE,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,QAAQ,CAAC,iBAAiB,KAAK,cAAc,EAAE,CAAC;gBAClD,oBAAoB,CAAC,oBAAoB,CAAC,CAAC;YAC7C,CAAC;YACD,oBAAoB,CAClB,oBAAoB,EACpB,MAAM,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QAC5C,IAAI,KAAoB,CAAC;QACzB,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBAChD,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;oBACtC,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,KAAK,EAAE;gBAChD,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC,EACH,CAAC;gBACD,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,GAAG,YAAY,CAAC;QACvB,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG;gBAAE,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC9C,IACE,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;gBAC7C,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC,EACH,CAAC;gBACD,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAED,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,KAAK;YAChB,KAAK;YACL,iBAAiB,EACf,QAAQ,CAAC,iBAAiB,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;SACtE,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["import {\n  diagnoseA2ATokenFailure,\n  verifyA2AToken,\n} from \"@agent-native/core/a2a\";\nimport {\n  isOrgMember,\n  resolveOrgByDomain,\n  resolveOrgIdForEmail,\n} from \"@agent-native/core/org\";\nimport type {\n  ActionRouteAuthAdapter,\n  ActionRouteResolvedCaller,\n} from \"@agent-native/core/server\";\nimport { getSession } from \"@agent-native/core/server\";\n\nexport const WORKSPACE_APPS_ACTION_PATH =\n  \"/_agent-native/actions/list-workspace-apps\";\nexport const WORKSPACE_APP_CLAIM_ACTION_PATH =\n  \"/_agent-native/actions/claim-workspace-app-organization\";\n\nconst REGISTRY_AUTH_REFUSED = \"Invalid workspace registry authorization\";\n\n// The registry is re-asked on every request of every guarded app, so a single\n// misconfigured workspace would otherwise log the same refusal per request.\nconst reportedRefusals = new Set<string>();\n\n// The caller always gets the same bare 401, whatever refused it: any finer\n// answer would tell an unauthenticated caller whether a guessed secret was\n// right. The reason and cause exist for the server log only.\nfunction refuseRegistryCaller(reason: string, cause?: string): never {\n  const key = cause ? `${reason}:${cause}` : reason;\n  if (!reportedRefusals.has(key)) {\n    reportedRefusals.add(key);\n    console.warn(\"[workspace-registry-auth] refused caller\", { reason, cause });\n  }\n  throw new Error(REGISTRY_AUTH_REFUSED);\n}\n\nfunction isWorkspaceAppsActionPath(event: any): boolean {\n  const rawUrl =\n    (typeof event?.context?._mountedPathname === \"string\" &&\n      event.context._mountedPathname) ||\n    (typeof event?.path === \"string\" && event.path) ||\n    (typeof event?.url?.pathname === \"string\" && event.url.pathname) ||\n    (typeof event?.node?.req?.url === \"string\" && event.node.req.url) ||\n    (typeof event?.req?.url === \"string\" && event.req.url) ||\n    \"/\";\n  const requestPath =\n    String(rawUrl).split(\"?\", 1)[0].replace(/\\/+$/, \"\") || \"/\";\n  const appBasePath = process.env.APP_BASE_PATH?.trim().replace(/\\/+$/, \"\");\n  return [WORKSPACE_APPS_ACTION_PATH, WORKSPACE_APP_CLAIM_ACTION_PATH].some(\n    (actionPath) =>\n      requestPath === actionPath ||\n      Boolean(appBasePath && `${appBasePath}${actionPath}` === requestPath),\n  );\n}\n\nfunction readAuthorizationHeader(event: any): string | undefined {\n  const headers = event?.node?.req?.headers ?? event?.req?.headers;\n  if (typeof headers?.get === \"function\") {\n    return headers.get(\"authorization\") ?? undefined;\n  }\n  const value = headers?.authorization ?? headers?.Authorization;\n  return Array.isArray(value) ? value[0] : value;\n}\n\n/**\n * The hosted workspace registry actions accept a caller JWT from Dispatch.\n * Keep this resolver path-scoped so the shared secret never becomes a bearer\n * credential for unrelated Dispatch actions.\n */\nexport const workspaceAppActionRouteAuth: ActionRouteAuthAdapter = {\n  resolveCaller: async (event): Promise<ActionRouteResolvedCaller | null> => {\n    if (!isWorkspaceAppsActionPath(event)) return null;\n\n    const authorization = readAuthorizationHeader(event);\n    if (!authorization) return null;\n    if (!authorization.startsWith(\"Bearer \")) {\n      refuseRegistryCaller(\"malformed-authorization\");\n    }\n\n    const hasRequestUrl =\n      typeof event?.node?.req?.url === \"string\" ||\n      typeof event?.req?.url === \"string\" ||\n      typeof event?.url === \"string\";\n    const session = hasRequestUrl ? await getSession(event) : null;\n    if (session?.email) {\n      return {\n        owner: session.email,\n        anonymous: false,\n        ...(session.orgId ? { orgId: session.orgId } : {}),\n      };\n    }\n\n    const token = authorization.slice(\"Bearer \".length).trim();\n    if (!token) refuseRegistryCaller(\"malformed-authorization\");\n\n    const identity = await verifyA2AToken(token, event);\n    if (!identity.email) {\n      // An organization principal is a token that verified but may not name a\n      // user: its org secret equals the deploy secret, or only the org secret\n      // verified it. Anything else failed outright.\n      if (identity.identityAssurance === \"organization\") {\n        refuseRegistryCaller(\"token-without-user\");\n      }\n      refuseRegistryCaller(\n        \"token-not-verified\",\n        await diagnoseA2ATokenFailure(token, event),\n      );\n    }\n\n    const orgDomain = identity.orgDomain?.trim().toLowerCase();\n    const claimedOrgId = identity.orgId?.trim();\n    let orgId: string | null;\n    if (claimedOrgId) {\n      if (orgDomain) {\n        const org = await resolveOrgByDomain(orgDomain);\n        if (org && org.orgId !== claimedOrgId) {\n          refuseRegistryCaller(\"org-mismatch\");\n        }\n      }\n      if (\n        !(await isOrgMember(claimedOrgId, identity.email, {\n          requestEvent: event,\n        }))\n      ) {\n        refuseRegistryCaller(\"not-org-member\");\n      }\n      orgId = claimedOrgId;\n    } else if (orgDomain) {\n      const org = await resolveOrgByDomain(orgDomain);\n      if (!org) refuseRegistryCaller(\"org-unknown\");\n      if (\n        !(await isOrgMember(org.orgId, identity.email, {\n          requestEvent: event,\n        }))\n      ) {\n        refuseRegistryCaller(\"not-org-member\");\n      }\n      orgId = org.orgId;\n    } else {\n      orgId = await resolveOrgIdForEmail(identity.email);\n    }\n\n    return {\n      owner: identity.email,\n      anonymous: false,\n      orgId,\n      identityAssurance:\n        identity.identityAssurance === \"org-member\" ? \"org-member\" : \"user\",\n    };\n  },\n};\n"]}

package/dist/server/plugins/agent-chat.js

@@ -85,7 +85,7 @@ Use the standard workspace primitives:
 - Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.
 - Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.
 - For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.
-- For Builder.io or AI credit spend, LLM usage by workspace member or month, or workspace app/Builder branch creation history, call list-dispatch-usage-metrics with scope=workspace and the requested sinceDays. Its monthlyByUser and workspaceAppCreationsByUserMonth fields are the authoritative shared-database result; do not ask for a user export or BigQuery schema. For app adoption, call it with scope=app and appId: app creators can see aggregate daily/weekly active users and tracked actions for their own app, while organization owners/admins can inspect any accessible app. App scope omits individual users and prompt previews.
+- Use list-dispatch-usage-metrics only for this workspace's own members' agent/LLM usage and spend, or aggregate adoption of an accessible workspace app. For agent/LLM usage or spend, call it with scope=workspace and the requested sinceDays; it reports workspace-member usage only. For app adoption, call it with scope=app and appId; app creators can see aggregate daily/weekly active users and tracked actions for their own app, while organization owners/admins can inspect any accessible app. App scope omits individual users and prompt previews. External customer, account, or company usage, credits, activity, or product data belongs to the relevant app: use its identity in <relevant-apps> when clear, or call describe-workspace-apps with a query when ownership is unclear. Do not use this action for external customer/account/company data.
 
 When a user asks for something like a digest, reminder, routing rule, or saved behavior:
 - First decide whether it should be a resource, a recurring job, a destination, or a delegated task.

package/dist/server/plugins/agent-chat.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-chat.js","sourceRoot":"","sources":["../../../src/server/plugins/agent-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,qBAAqB;IACrB,+BAA+B;IAC/B,uBAAuB;IACvB,SAAS;IACT,UAAU;IACV,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,cAAc;IACd,mBAAmB;IACnB,iBAAiB;IACjB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,8BAA8B;IAC9B,6BAA6B;IAC7B,oCAAoC;IACpC,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,UAAU;CACX,CAAC;AAEF,eAAe,qBAAqB,CAAC;IACnC,KAAK,EAAE,UAAU;IACjB,WAAW,EAAE,IAAI;IACjB,qBAAqB,EAAE,IAAI;IAC3B,gBAAgB,EAAE,kBAAkB;IACpC,GAAG,EAAE;QACH,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,8BAA8B;YAC9B,6BAA6B;SAC9B;KACF;IACD,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,eAAe;IACxB,eAAe,EAAE,2BAA2B;IAC5C,sBAAsB,EAAE;QACtB,0BAA0B;QAC1B,+BAA+B;KAChC;IACD,aAAa,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;IAC1C,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4EAoC4D;CAC3E,CAAC,CAAC","sourcesContent":["import { getOrgContext } from \"@agent-native/core/org\";\nimport { createAgentChatPlugin } from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../../actions/index.js\";\nimport {\n  workspaceAppActionRouteAuth,\n  WORKSPACE_APP_CLAIM_ACTION_PATH,\n  WORKSPACE_APPS_ACTION_PATH,\n} from \"../lib/workspace-app-action-auth.js\";\n\nconst INITIAL_TOOL_NAMES = [\n  \"view-screen\",\n  \"list-workspace-apps\",\n  \"update-workspace-app-metadata\",\n  \"list-connected-agents\",\n  \"ask_app\",\n  \"open_app\",\n  \"list-workspace-resources\",\n  \"create-workspace-resource\",\n  \"update-workspace-resource\",\n  \"import-agent\",\n  \"import-agent-pack\",\n  \"list-agent-pack\",\n  \"connect-external-agent\",\n  \"list-vault-secrets\",\n  \"request-vault-secret\",\n  \"create-vault-secret\",\n  \"list-destinations\",\n  \"upsert-destination\",\n  \"list-dreams\",\n  \"start-workspace-app-creation\",\n  \"list-dispatch-usage-metrics\",\n  \"list-available-workspace-templates\",\n  \"provider-api-catalog\",\n  \"provider-api-docs\",\n  \"provider-api-request\",\n  \"query-staged-dataset\",\n  \"navigate\",\n];\n\nexport default createAgentChatPlugin({\n  appId: \"dispatch\",\n  connectApps: true,\n  durableBackgroundRuns: true,\n  initialToolNames: INITIAL_TOOL_NAMES,\n  mcp: {\n    connectorCatalog: [\n      \"resolve-integration-source-context\",\n      \"start-workspace-app-creation\",\n      \"list-dispatch-usage-metrics\",\n    ],\n  },\n  resolveOrgId: async (event) => {\n    const ctx = await getOrgContext(event);\n    return ctx.orgId;\n  },\n  actions: dispatchActions,\n  actionRouteAuth: workspaceAppActionRouteAuth,\n  actionRoutePublicPaths: [\n    WORKSPACE_APPS_ACTION_PATH,\n    WORKSPACE_APP_CLAIM_ACTION_PATH,\n  ],\n  codeExecution: { production: \"sandboxed\" },\n  systemPrompt: `You are the central dispatch for this workspace.\n\nDefault posture:\n- Treat Slack and Telegram as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A when another app owns the job.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Prefer replying in the current external thread unless the user explicitly asks you to send to a saved destination.\n\nUse the standard workspace primitives:\n- Read and update resources like AGENTS.md, LEARNINGS.md, jobs/*.md, agents/*.md, and remote-agents/*.json when appropriate.\n- Use recurring jobs for scheduled behavior.\n- Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.\n- For a Claude-style Markdown or JSON agent setup, use import-agent so the\n  profile is normalized into agents/<slug>.md. Never import credentials, hooks,\n  shell commands, or local environment settings.\n- For a folder of agent instructions, references, or skills, use\n  import-agent-pack. It preserves the text files under agents/<slug>/ and\n  creates the normalized profile alongside them. Use list-agent-pack to inspect\n  the pack before editing or handing it off to an app.\n- For an existing HTTP/A2A endpoint, use connect-external-agent and let the\n  normal A2A/MCP connection flow handle authentication.\n- You receive a compact available-apps block with sibling workspace app names and descriptions. Use it to pick the right A2A target, and call list-connected-agents or tool-search only when you need fresh details.\n- Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.\n- When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.\n- When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.\n- When a user asks to rename an existing workspace app or change its Dispatch title/description, call update-workspace-app-metadata with the existing appId from list-workspace-apps. This is a metadata-only edit — never call start-workspace-app-creation, which creates a new app and Builder branch.\n- When an explicit app-creation request already includes a source brief or a concrete repeatable workflow, call start-workspace-app-creation without asking non-blocking product or UX questions. Choose recommended defaults, let the Builder handoff record assumptions, and ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow.\n- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible \"Chat\", \"Starter\", \"Blank app\", or \"New app\" UI behind.\n- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.\n- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.\n- For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.\n- For Builder.io or AI credit spend, LLM usage by workspace member or month, or workspace app/Builder branch creation history, call list-dispatch-usage-metrics with scope=workspace and the requested sinceDays. Its monthlyByUser and workspaceAppCreationsByUserMonth fields are the authoritative shared-database result; do not ask for a user export or BigQuery schema. For app adoption, call it with scope=app and appId: app creators can see aggregate daily/weekly active users and tracked actions for their own app, while organization owners/admins can inspect any accessible app. App scope omits individual users and prompt previews.\n\nWhen a user asks for something like a digest, reminder, routing rule, or saved behavior:\n- First decide whether it should be a resource, a recurring job, a destination, or a delegated task.\n- Keep responses concise and operational.\n- Avoid inventing integrations or destinations that are not configured yet.`,\n});\n"]}
+{"version":3,"file":"agent-chat.js","sourceRoot":"","sources":["../../../src/server/plugins/agent-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,qBAAqB;IACrB,+BAA+B;IAC/B,uBAAuB;IACvB,SAAS;IACT,UAAU;IACV,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,cAAc;IACd,mBAAmB;IACnB,iBAAiB;IACjB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,8BAA8B;IAC9B,6BAA6B;IAC7B,oCAAoC;IACpC,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,UAAU;CACX,CAAC;AAEF,eAAe,qBAAqB,CAAC;IACnC,KAAK,EAAE,UAAU;IACjB,WAAW,EAAE,IAAI;IACjB,qBAAqB,EAAE,IAAI;IAC3B,gBAAgB,EAAE,kBAAkB;IACpC,GAAG,EAAE;QACH,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,8BAA8B;YAC9B,6BAA6B;SAC9B;KACF;IACD,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,eAAe;IACxB,eAAe,EAAE,2BAA2B;IAC5C,sBAAsB,EAAE;QACtB,0BAA0B;QAC1B,+BAA+B;KAChC;IACD,aAAa,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;IAC1C,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4EAoC4D;CAC3E,CAAC,CAAC","sourcesContent":["import { getOrgContext } from \"@agent-native/core/org\";\nimport { createAgentChatPlugin } from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../../actions/index.js\";\nimport {\n  workspaceAppActionRouteAuth,\n  WORKSPACE_APP_CLAIM_ACTION_PATH,\n  WORKSPACE_APPS_ACTION_PATH,\n} from \"../lib/workspace-app-action-auth.js\";\n\nconst INITIAL_TOOL_NAMES = [\n  \"view-screen\",\n  \"list-workspace-apps\",\n  \"update-workspace-app-metadata\",\n  \"list-connected-agents\",\n  \"ask_app\",\n  \"open_app\",\n  \"list-workspace-resources\",\n  \"create-workspace-resource\",\n  \"update-workspace-resource\",\n  \"import-agent\",\n  \"import-agent-pack\",\n  \"list-agent-pack\",\n  \"connect-external-agent\",\n  \"list-vault-secrets\",\n  \"request-vault-secret\",\n  \"create-vault-secret\",\n  \"list-destinations\",\n  \"upsert-destination\",\n  \"list-dreams\",\n  \"start-workspace-app-creation\",\n  \"list-dispatch-usage-metrics\",\n  \"list-available-workspace-templates\",\n  \"provider-api-catalog\",\n  \"provider-api-docs\",\n  \"provider-api-request\",\n  \"query-staged-dataset\",\n  \"navigate\",\n];\n\nexport default createAgentChatPlugin({\n  appId: \"dispatch\",\n  connectApps: true,\n  durableBackgroundRuns: true,\n  initialToolNames: INITIAL_TOOL_NAMES,\n  mcp: {\n    connectorCatalog: [\n      \"resolve-integration-source-context\",\n      \"start-workspace-app-creation\",\n      \"list-dispatch-usage-metrics\",\n    ],\n  },\n  resolveOrgId: async (event) => {\n    const ctx = await getOrgContext(event);\n    return ctx.orgId;\n  },\n  actions: dispatchActions,\n  actionRouteAuth: workspaceAppActionRouteAuth,\n  actionRoutePublicPaths: [\n    WORKSPACE_APPS_ACTION_PATH,\n    WORKSPACE_APP_CLAIM_ACTION_PATH,\n  ],\n  codeExecution: { production: \"sandboxed\" },\n  systemPrompt: `You are the central dispatch for this workspace.\n\nDefault posture:\n- Treat Slack and Telegram as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A when another app owns the job.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Prefer replying in the current external thread unless the user explicitly asks you to send to a saved destination.\n\nUse the standard workspace primitives:\n- Read and update resources like AGENTS.md, LEARNINGS.md, jobs/*.md, agents/*.md, and remote-agents/*.json when appropriate.\n- Use recurring jobs for scheduled behavior.\n- Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.\n- For a Claude-style Markdown or JSON agent setup, use import-agent so the\n  profile is normalized into agents/<slug>.md. Never import credentials, hooks,\n  shell commands, or local environment settings.\n- For a folder of agent instructions, references, or skills, use\n  import-agent-pack. It preserves the text files under agents/<slug>/ and\n  creates the normalized profile alongside them. Use list-agent-pack to inspect\n  the pack before editing or handing it off to an app.\n- For an existing HTTP/A2A endpoint, use connect-external-agent and let the\n  normal A2A/MCP connection flow handle authentication.\n- You receive a compact available-apps block with sibling workspace app names and descriptions. Use it to pick the right A2A target, and call list-connected-agents or tool-search only when you need fresh details.\n- Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.\n- When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.\n- When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.\n- When a user asks to rename an existing workspace app or change its Dispatch title/description, call update-workspace-app-metadata with the existing appId from list-workspace-apps. This is a metadata-only edit — never call start-workspace-app-creation, which creates a new app and Builder branch.\n- When an explicit app-creation request already includes a source brief or a concrete repeatable workflow, call start-workspace-app-creation without asking non-blocking product or UX questions. Choose recommended defaults, let the Builder handoff record assumptions, and ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow.\n- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible \"Chat\", \"Starter\", \"Blank app\", or \"New app\" UI behind.\n- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.\n- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.\n- For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.\n- Use list-dispatch-usage-metrics only for this workspace's own members' agent/LLM usage and spend, or aggregate adoption of an accessible workspace app. For agent/LLM usage or spend, call it with scope=workspace and the requested sinceDays; it reports workspace-member usage only. For app adoption, call it with scope=app and appId; app creators can see aggregate daily/weekly active users and tracked actions for their own app, while organization owners/admins can inspect any accessible app. App scope omits individual users and prompt previews. External customer, account, or company usage, credits, activity, or product data belongs to the relevant app: use its identity in <relevant-apps> when clear, or call describe-workspace-apps with a query when ownership is unclear. Do not use this action for external customer/account/company data.\n\nWhen a user asks for something like a digest, reminder, routing rule, or saved behavior:\n- First decide whether it should be a resource, a recurring job, a destination, or a delegated task.\n- Keep responses concise and operational.\n- Avoid inventing integrations or destinations that are not configured yet.`,\n});\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.40.31",
+  "version": "0.40.34",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -90,7 +90,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.212.1"
+    "@agent-native/toolkit": "0.214.0"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -104,7 +104,7 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.212.1"
+    "@agent-native/core": "0.214.0"
   },
   "peerDependencies": {
     "@agent-native/core": ">=0.209.1",