@agimon-ai/po-config 0.0.0-alpha.21 → 0.0.0-alpha.23

package/dist/agentPluginMcp.cjs

@@ -377,6 +377,72 @@ function normalizeAgentPluginMcpSource(source, options) {
 		return disabledResult(label, error);
 	}
 }
+const AGENT_PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stablePluginIdentity(entry) {
+	const source = entry.source;
+	const identity = source?.type === "git" ? [
+		"git",
+		source.url,
+		source.path ?? ""
+	] : source?.type === "npm" ? [
+		"npm",
+		source.registry ?? "",
+		source.package
+	] : ["local", node_fs.default.realpathSync(entry.directory)];
+	return (0, node_crypto.createHash)("sha256").update(JSON.stringify(identity)).digest("hex");
+}
+function rootAgentPluginSchema(entry) {
+	const manifestPath = node_path.default.join(entry.directory, "plugin.json");
+	if (entry.manifest?.path === manifestPath && entry.manifest.agentPluginSchema === AGENT_PLUGIN_SCHEMA) return AGENT_PLUGIN_SCHEMA;
+	try {
+		const stat = node_fs.default.lstatSync(manifestPath);
+		if (stat.isSymbolicLink() || !stat.isFile()) return void 0;
+		const parsed = JSON.parse(node_fs.default.readFileSync(manifestPath, "utf8"));
+		return isPlainObject(parsed) && parsed.$schema === AGENT_PLUGIN_SCHEMA ? AGENT_PLUGIN_SCHEMA : void 0;
+	} catch {
+		return;
+	}
+}
+/** One plugin's MCP config as a projection source, or nothing when it ships none. Shared by sync and settings. */
+async function pluginMcpSource(entry, pluginDataRoot) {
+	if (entry.mcp === false) return void 0;
+	const pluginRoot = node_fs.default.realpathSync(entry.directory);
+	const agentPlugin = rootAgentPluginSchema(entry) === AGENT_PLUGIN_SCHEMA;
+	const configPath = node_path.default.join(pluginRoot, agentPlugin ? "mcp.json" : ".mcp.json");
+	let stat;
+	try {
+		stat = await node_fs.default.promises.lstat(configPath);
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
+	if (!stat.isFile() || stat.isSymbolicLink()) return void 0;
+	const content = await node_fs.default.promises.readFile(configPath);
+	const contentDigest = (0, node_crypto.createHash)("sha256").update(content).digest("hex");
+	const pluginId = stablePluginIdentity(entry);
+	const sourceId = `plugin:${pluginId}`;
+	if (!agentPlugin) return {
+		sourceId,
+		owner: "plugin",
+		format: "native",
+		configPath,
+		contentDigest
+	};
+	return {
+		sourceId,
+		owner: "plugin",
+		format: "agent-plugin-v1",
+		configPath,
+		contentDigest,
+		pluginId,
+		pluginRoot,
+		pluginDataDirectory: node_path.default.join(pluginDataRoot, pluginId),
+		mcpSchemaUrl: _agimon_ai_po_core_mcpProjection.AGENT_PLUGIN_MCP_SCHEMA_URL
+	};
+}
 //#endregion
 //#region src/services/agentPluginMcp/index.ts
 async function realContainedPath(fs, root, candidate, label, context) {
@@ -497,5 +563,6 @@ async function normalizeAgentPluginMcpSourceAsync(fs, source, options, context)
 //#endregion
 exports.normalizeAgentPluginMcpSource = normalizeAgentPluginMcpSource;
 exports.normalizeAgentPluginMcpSourceAsync = normalizeAgentPluginMcpSourceAsync;
+exports.pluginMcpSource = pluginMcpSource;
 
 //# sourceMappingURL=agentPluginMcp.cjs.map

package/dist/agentPluginMcp.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"agentPluginMcp.cjs","names":["path","createHash","AGENT_PLUGIN_MCP_SCHEMA_URL","realContainedPath","fs","normalizeCommand","path","normalizeWorkingDirectory","normalizeServer","writeStagedInternalConfig","randomUUID","path","getOrThrow","nodeHost","writeFileAtomic"],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"sourcesContent":["/** Pure Agent Plugin MCP normalisation shared by the async API and the deprecated Node-only sync shim. */\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\n\nimport { AGENT_PLUGIN_MCP_SCHEMA_URL, type PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\n/** Same token grammar as node:http `validateHeaderName` (RFC 9110 tchar). */\nconst HTTP_TOKEN = /^[\\^_`a-zA-Z\\-0-9!#$%&'*+.|~]+$/u;\n/** Same rejected characters as node:http `validateHeaderValue`. */\nconst INVALID_HEADER_VALUE_CHARACTER = /[^\\t\\x20-\\x7e\\x80-\\xff]/u;\nconst IPV4_OCTET = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]?\\\\d)';\nconst IPV4_ADDRESS = new RegExp(`^${IPV4_OCTET}(?:\\\\.${IPV4_OCTET}){3}$`, 'u');\n\nfunction isIPv4(value: string): boolean {\n  return IPV4_ADDRESS.test(value);\n}\n\nexport const PRIVATE_FILE_MODE = 0o600;\nexport const PRIVATE_DIRECTORY_MODE = 0o700;\nexport const RESERVED_ENVIRONMENT_KEYS = new Set(['PLUGIN_ROOT', 'PLUGIN_DATA']);\nexport const PROXY_SERVER_ALIASES = new Set(['mcp-proxy', 'agiflow-proxy']);\n\nexport type JsonObject = Record<string, unknown>;\n\nexport interface AgentPluginMcpConfigSource {\n  path: string;\n  format: 'internal';\n  cacheKey: string;\n}\n\nexport interface NormalizedAgentPluginMcpSource {\n  /** Owner-only, content-addressed layer that bypasses Claude env interpolation. */\n  configSource?: AgentPluginMcpConfigSource;\n  /** Claude-compatible definitions for an external merged config. */\n  claudeConfig: { mcpServers: Record<string, JsonObject> };\n  serverNames: string[];\n  droppedServers: string[];\n  diagnostics: string[];\n}\n\nexport interface NormalizeAgentPluginMcpOptions {\n  stagingDirectory: string;\n  /** Empty and absent lists both mean keep every server. */\n  allowedServers?: readonly string[];\n  /** Po strips nested wrappers; external-only callers may opt out. */\n  stripProxyWrappers?: boolean;\n}\n\nexport interface NormalizedServer {\n  internal: JsonObject;\n  claude: JsonObject;\n}\n\nexport function isObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function onlyKeys(value: JsonObject, allowed: readonly string[], label: string): void {\n  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));\n  if (unexpected) throw new Error(`${label} contains unsupported field \"${unexpected}\"`);\n}\n\nexport function nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nexport function optionalStringArray(value: unknown, label: string): string[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error(`${label} must be an array of strings`);\n  return value.map((item, index) => {\n    if (typeof item !== 'string') throw new Error(`${label}[${index}] must be a string`);\n    return item;\n  });\n}\n\nfunction optionalStringRecord(value: unknown, label: string): Record<string, string> | undefined {\n  if (value === undefined) return undefined;\n  if (!isObject(value)) throw new Error(`${label} must be an object of string values`);\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => {\n      if (typeof item !== 'string') throw new Error(`${label}.${key} must be a string`);\n      return [key, item];\n    }),\n  );\n}\n\nexport function expandPluginPlaceholders(value: string, pluginRoot: string, pluginDataDirectory: string): string {\n  // The portable contract is a single, non-recursive replacement pass. An\n  // unrecognised placeholder remains literal and mcp-proxy must not reinterpret it.\n  return value.replace(/\\$\\{PLUGIN_(ROOT|DATA)\\}/gu, (placeholder) =>\n    placeholder === '${PLUGIN_ROOT}' ? pluginRoot : pluginDataDirectory,\n  );\n}\n\nexport function isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));\n}\n\nexport function normalizeEnvironment(\n  value: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): Record<string, string> {\n  const declared = optionalStringRecord(value, 'env') ?? {};\n  for (const key of Object.keys(declared)) {\n    const reservedKey = process.platform === 'win32' ? key.toUpperCase() : key;\n    if (RESERVED_ENVIRONMENT_KEYS.has(reservedKey)) {\n      throw new Error(`env key \"${key}\" is reserved by Agent Plugins`);\n    }\n  }\n  return {\n    ...Object.fromEntries(\n      Object.entries(declared).map(([key, item]) => [\n        key,\n        expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n      ]),\n    ),\n    PLUGIN_ROOT: pluginRoot,\n    PLUGIN_DATA: pluginDataDirectory,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const bareHostname = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (bareHostname.toLowerCase() === 'localhost') return true;\n  if (isIPv4(bareHostname)) return bareHostname.split('.')[0] === '127';\n  return bareHostname === '::1';\n}\n\nexport function normalizeUrl(value: unknown): string {\n  const raw = nonEmptyString(value, 'url');\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('url must be an absolute HTTP(S) URL');\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error('url must use http or https');\n  }\n  if (parsed.username || parsed.password) throw new Error('url must not contain user information');\n  if (parsed.hash) throw new Error('url must not contain a fragment');\n  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {\n    throw new Error('non-loopback MCP URLs must use https');\n  }\n  return raw;\n}\n\nexport function normalizeHeaders(value: unknown): Record<string, string> | undefined {\n  const headers = optionalStringRecord(value, 'headers');\n  if (!headers) return undefined;\n  const seen = new Set<string>();\n  for (const [name, item] of Object.entries(headers)) {\n    const canonical = name.toLowerCase();\n    if (seen.has(canonical)) throw new Error(`headers contain duplicate name \"${name}\"`);\n    seen.add(canonical);\n    if (!HTTP_TOKEN.test(name) || INVALID_HEADER_VALUE_CHARACTER.test(item)) {\n      throw new Error(`header \"${name}\" is invalid`);\n    }\n  }\n  return headers;\n}\n\nexport function stagedInternalPath(\n  source: PoMcpAgentPluginProjectionSource,\n  contents: string,\n  stagingDirectory: string,\n): string {\n  const digest = createHash('sha256')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(contents)\n    .digest('hex')\n    .slice(0, 20);\n  return path.join(stagingDirectory, `agent-plugin-mcp-${digest}.internal.json`);\n}\n\nexport function emptyResult(diagnostic: string): NormalizedAgentPluginMcpSource {\n  return {\n    claudeConfig: { mcpServers: {} },\n    serverNames: [],\n    droppedServers: [],\n    diagnostics: [diagnostic],\n  };\n}\n\nexport function sourceLabel(source: PoMcpAgentPluginProjectionSource): string {\n  return `Agent Plugin MCP source \"${source.sourceId}\"`;\n}\n\n/** Checks the projection identity before any file is touched. */\nexport function assertProjectionSource(source: PoMcpAgentPluginProjectionSource): void {\n  if (source.mcpSchemaUrl !== AGENT_PLUGIN_MCP_SCHEMA_URL) {\n    throw new Error(`unsupported schema \"${String(source.mcpSchemaUrl)}\"`);\n  }\n  if (!path.isAbsolute(source.pluginRoot) || !path.isAbsolute(source.pluginDataDirectory)) {\n    throw new Error('pluginRoot and pluginDataDirectory must be absolute');\n  }\n}\n\nexport function assertRootConfigPath(configPath: string, pluginRoot: string): void {\n  if (path.dirname(configPath) !== pluginRoot || path.basename(configPath) !== 'mcp.json') {\n    throw new Error('portable plugin config must be root mcp.json');\n  }\n}\n\n/** Verifies the digest and document shape of the raw mcp.json bytes; returns its server map. */\nexport function parseMcpDocument(\n  source: PoMcpAgentPluginProjectionSource,\n  bytes: Uint8Array,\n  label: string,\n): Record<string, unknown> {\n  const digest = createHash('sha256').update(bytes).digest('hex');\n  if (digest !== source.contentDigest) throw new Error('content digest does not match the projection');\n  const parsed: unknown = JSON.parse(new TextDecoder('utf-8', { ignoreBOM: true }).decode(bytes));\n  if (!isObject(parsed)) throw new Error('document must be an object');\n  onlyKeys(parsed, ['$schema', 'mcpServers'], label);\n  if (parsed.$schema !== source.mcpSchemaUrl) throw new Error('$schema does not match the projected schema');\n  if (!isObject(parsed.mcpServers)) throw new Error('mcpServers must be an object');\n  return parsed.mcpServers;\n}\n\n/** Whether a declared server is skipped (empty name), dropped by the allowlist or wrapper rule, or normalised. */\nexport function serverDisposition(name: string, options: NormalizeAgentPluginMcpOptions): 'empty' | 'dropped' | 'keep' {\n  if (!name) return 'empty';\n  const allowed = options.allowedServers;\n  const keepAll = !allowed || allowed.length === 0;\n  const stripProxyWrappers = options.stripProxyWrappers ?? true;\n  if ((!keepAll && !allowed.includes(name)) || (stripProxyWrappers && PROXY_SERVER_ALIASES.has(name))) return 'dropped';\n  return 'keep';\n}\n\nexport function emptyServerDiagnostic(label: string): string {\n  return `${label} contains an empty server name; that entry was skipped.`;\n}\n\nexport function skippedServerDiagnostic(label: string, name: string, error: unknown): string {\n  return `${label} skipped server \"${name}\": ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function disabledResult(label: string, error: unknown): NormalizedAgentPluginMcpSource {\n  return emptyResult(`${label} was disabled: ${error instanceof Error ? error.message : String(error)}`);\n}\n\n/** The declared transport of one server; stdio declarations are also checked for unsupported fields. */\nexport function serverType(raw: unknown, name: string): string {\n  if (!isObject(raw)) throw new Error('definition must be an object');\n  const type = nonEmptyString(raw.type, 'type');\n  if (type === 'stdio') onlyKeys(raw, ['type', 'command', 'args', 'env', 'cwd'], `server \"${name}\"`);\n  return type;\n}\n\nexport function stdioServer(\n  name: string,\n  config: { command: string; args?: string[]; env: Record<string, string>; cwd: string },\n): NormalizedServer {\n  return {\n    internal: { name, transport: 'stdio', config },\n    claude: { type: 'stdio', ...config },\n  };\n}\n\n/** A streamable-http or sse server; any other type is unsupported. */\nexport function remoteServer(raw: JsonObject, name: string, type: string): NormalizedServer {\n  if (type === 'streamable-http' || type === 'sse') {\n    onlyKeys(raw, ['type', 'url', 'headers'], `server \"${name}\"`);\n    const url = normalizeUrl(raw.url);\n    const headers = normalizeHeaders(raw.headers);\n    const transport = type === 'streamable-http' ? 'http' : 'sse';\n    const config = { url, ...(headers ? { headers } : {}) };\n    return {\n      internal: { name, transport, config },\n      claude: { type: transport, ...config },\n    };\n  }\n  throw new Error(`unsupported transport type \"${type}\"`);\n}\n\nexport function stagedContents(internalServers: Record<string, JsonObject>): string {\n  return `${JSON.stringify({ mcpServers: internalServers }, null, 2)}\\n`;\n}\n\nexport function stagedCacheKey(source: PoMcpAgentPluginProjectionSource, configPath: string, contents: string): string {\n  return createHash('sha256')\n    .update('agent-plugin-v1\\0')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(configPath)\n    .update('\\0')\n    .update(contents)\n    .digest('hex');\n}\n\n/** The containment base and expanded path of a declared cwd, or undefined when the plugin root is the default. */\nexport function workingDirectoryCandidate(\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): { base: string; candidate: string } | undefined {\n  if (declared === undefined) return undefined;\n  const cwd = nonEmptyString(declared, 'cwd');\n  if (cwd.startsWith('./')) return { base: pluginRoot, candidate: path.resolve(pluginRoot, cwd) };\n  const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginDataDirectory);\n  if (cwd === '${PLUGIN_ROOT}' || cwd.startsWith('${PLUGIN_ROOT}/')) {\n    return { base: pluginRoot, candidate: path.resolve(expanded) };\n  }\n  if (cwd === '${PLUGIN_DATA}' || cwd.startsWith('${PLUGIN_DATA}/')) {\n    return { base: pluginDataDirectory, candidate: path.resolve(expanded) };\n  }\n  throw new Error('cwd must start with ./, ${PLUGIN_ROOT}, or ${PLUGIN_DATA}');\n}\n\n/** Rejects a command that is neither a bare executable name nor a ./ path; true when it must be resolved. */\nexport function isPluginRelativeCommand(command: string): boolean {\n  if (command.startsWith('./')) return true;\n  if (command === '.' || command === '..' || /[\\s/\\\\]/u.test(command)) {\n    throw new Error('command must be a bare executable name or a ./ path inside the plugin');\n  }\n  return false;\n}\n","import { randomUUID } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nfunction realContainedPath(root: string, candidate: string, label: string): string {\n  let realCandidate: string;\n  try {\n    realCandidate = fs.realpathSync(candidate);\n  } catch {\n    throw new Error(`${label} does not exist`);\n  }\n  if (!isInside(root, realCandidate)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return realCandidate;\n}\n\nfunction normalizeCommand(command: string, pluginRoot: string): string {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = realContainedPath(pluginRoot, path.resolve(pluginRoot, command), 'command');\n  if (!fs.statSync(resolved).isFile()) throw new Error('command must resolve to a regular file');\n  try {\n    fs.accessSync(resolved, fs.constants.X_OK);\n  } catch {\n    throw new Error('command must resolve to an executable file');\n  }\n  return resolved;\n}\n\nfunction normalizeWorkingDirectory(declared: unknown, pluginRoot: string, pluginDataDirectory: string): string {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = realContainedPath(declaredCwd.base, declaredCwd.candidate, 'cwd');\n  if (!fs.statSync(resolved).isDirectory()) throw new Error('cwd must resolve to a directory');\n  return resolved;\n}\n\nfunction normalizeServer(\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n): NormalizedServer {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = normalizeCommand(nonEmptyString(declaration.command, 'command'), pluginRoot);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = normalizeWorkingDirectory(declaration.cwd, pluginRoot, pluginDataDirectory);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\nfunction writeStagedInternalConfig(target: string, contents: string, stagingDirectory: string): void {\n  fs.mkdirSync(stagingDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n  fs.chmodSync(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  const temporaryPath = `${target}.${process.pid}-${randomUUID()}.tmp`;\n  try {\n    fs.writeFileSync(temporaryPath, contents, { flag: 'wx', mode: PRIVATE_FILE_MODE });\n    try {\n      fs.renameSync(temporaryPath, target);\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n      if (code !== 'EEXIST' && code !== 'EPERM') throw error;\n      const stat = fs.lstatSync(target);\n      if (stat.isSymbolicLink() || !stat.isFile() || fs.readFileSync(target, 'utf8') !== contents) {\n        throw new Error('content-addressed staging path is occupied by different content');\n      }\n    }\n    fs.chmodSync(target, PRIVATE_FILE_MODE);\n  } finally {\n    fs.rmSync(temporaryPath, { force: true });\n  }\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n *\n * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.\n */\nexport function normalizeAgentPluginMcpSource(\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n): NormalizedAgentPluginMcpSource {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = fs.realpathSync(source.pluginRoot);\n    try {\n      const dataStat = fs.lstatSync(source.pluginDataDirectory);\n      if (dataStat.isSymbolicLink() || !dataStat.isDirectory()) {\n        throw new Error('pluginDataDirectory must be a real directory');\n      }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      fs.mkdirSync(source.pluginDataDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n    }\n    fs.chmodSync(source.pluginDataDirectory, PRIVATE_DIRECTORY_MODE);\n    fs.accessSync(source.pluginDataDirectory, fs.constants.W_OK);\n    const pluginDataDirectory = fs.realpathSync(source.pluginDataDirectory);\n    const configPath = realContainedPath(pluginRoot, source.configPath, 'mcp.json');\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const servers = parseMcpDocument(source, fs.readFileSync(configPath), label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = normalizeServer(rawServer, pluginRoot, pluginDataDirectory, name);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    writeStagedInternalConfig(target, contents, options.stagingDirectory);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n","import path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\nimport { type FileSystem, getOrThrow, nodeHost, writeFileAtomic } from '@agimon-ai/po-core/platform';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nexport type {\n  AgentPluginMcpConfigSource,\n  NormalizeAgentPluginMcpOptions,\n  NormalizedAgentPluginMcpSource,\n} from './normalize';\nexport { normalizeAgentPluginMcpSource } from './sync';\n\ntype Context = Parameters<FileSystem['readTextFile']>[1];\n\nasync function realContainedPath(\n  fs: FileSystem,\n  root: string,\n  candidate: string,\n  label: string,\n  context: Context,\n): Promise<string> {\n  const real = await fs.canonicalPath(candidate, context);\n  if (!real.ok) throw new Error(`${label} does not exist`);\n  if (!isInside(root, real.value)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return real.value;\n}\n\nasync function normalizeCommand(\n  fs: FileSystem,\n  command: string,\n  pluginRoot: string,\n  context: Context,\n): Promise<string> {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = await realContainedPath(fs, pluginRoot, path.resolve(pluginRoot, command), 'command', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'file') {\n    throw new Error('command must resolve to a regular file');\n  }\n  // Execute bits stand in for access(X_OK); the edge has no modes, so nodeHost reports none and the check is skipped.\n  const mode = await nodeHost.fileMode(resolved);\n  if (mode !== undefined && (mode & 0o111) === 0) throw new Error('command must resolve to an executable file');\n  return resolved;\n}\n\nasync function normalizeWorkingDirectory(\n  fs: FileSystem,\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  context: Context,\n): Promise<string> {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = await realContainedPath(fs, declaredCwd.base, declaredCwd.candidate, 'cwd', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'directory') {\n    throw new Error('cwd must resolve to a directory');\n  }\n  return resolved;\n}\n\nasync function normalizeServer(\n  fs: FileSystem,\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n  context: Context,\n): Promise<NormalizedServer> {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = await normalizeCommand(fs, nonEmptyString(declaration.command, 'command'), pluginRoot, context);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = await normalizeWorkingDirectory(fs, declaration.cwd, pluginRoot, pluginDataDirectory, context);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\n/** Owner-only plugin data directory; a symbolic link or non-directory rejects the source. */\nasync function preparePluginDataDirectory(fs: FileSystem, directory: string, context: Context): Promise<string> {\n  const info = await fs.fileInfo(directory, context);\n  if (info.ok) {\n    if (info.value.kind !== 'directory') throw new Error('pluginDataDirectory must be a real directory');\n  } else if (info.error.code === 'not_found') {\n    getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n  } else {\n    throw info.error;\n  }\n  await nodeHost.setMode(directory, PRIVATE_DIRECTORY_MODE);\n  return getOrThrow(await fs.canonicalPath(directory, context));\n}\n\n/**\n * Content-addressed and owner-only. The name hashes the contents, so replacing an\n * existing staged file through a uniquely named temporary file never changes what it holds.\n */\nasync function writeStagedInternalConfig(\n  fs: FileSystem,\n  target: string,\n  contents: string,\n  stagingDirectory: string,\n  context: Context,\n): Promise<void> {\n  getOrThrow(await fs.createDir(stagingDirectory, { recursive: true }, context));\n  await nodeHost.setMode(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  await writeFileAtomic(fs, target, contents, context);\n  await nodeHost.setMode(target, PRIVATE_FILE_MODE);\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer,\n * reading and writing through the injected file system.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n */\nexport async function normalizeAgentPluginMcpSourceAsync(\n  fs: FileSystem,\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n  context: Context,\n): Promise<NormalizedAgentPluginMcpSource> {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = getOrThrow(await fs.canonicalPath(source.pluginRoot, context));\n    const pluginDataDirectory = await preparePluginDataDirectory(fs, source.pluginDataDirectory, context);\n    const configPath = await realContainedPath(fs, pluginRoot, source.configPath, 'mcp.json', context);\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const bytes = getOrThrow(await fs.readBinaryFile(configPath, context));\n    const servers = parseMcpDocument(source, bytes, label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = await normalizeServer(fs, rawServer, pluginRoot, pluginDataDirectory, name, context);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    await writeStagedInternalConfig(fs, target, contents, options.stagingDirectory, context);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAOA,MAAM,aAAa;;AAEnB,MAAM,iCAAiC;AACvC,MAAM,aAAa;AACnB,MAAM,eAAe,IAAI,OAAO,IAAI,WAAW,QAAQ,WAAW,QAAQ,GAAG;AAE7E,SAAS,OAAO,OAAwB;CACtC,OAAO,aAAa,KAAK,KAAK;AAChC;AAIA,MAAa,4CAA4B,IAAI,IAAI,CAAC,eAAe,aAAa,CAAC;AAC/E,MAAa,uCAAuB,IAAI,IAAI,CAAC,aAAa,eAAe,CAAC;AAiC1E,SAAgB,SAAS,OAAqC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAgB,SAAS,OAAmB,SAA4B,OAAqB;CAC3F,MAAM,aAAa,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC1E,IAAI,YAAY,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,WAAW,EAAE;AACvF;AAEA,SAAgB,eAAe,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAC1G,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAqC;CACvF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;CACjF,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;EACnF,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,OAAmD;CAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;CACnF,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU;EACzC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,kBAAkB;EAChF,OAAO,CAAC,KAAK,IAAI;CACnB,CAAC,CACH;AACF;AAEA,SAAgB,yBAAyB,OAAe,YAAoB,qBAAqC;CAG/G,OAAO,MAAM,QAAQ,+BAA+B,gBAClD,gBAAgB,mBAAmB,aAAa,mBAClD;AACF;AAEA,SAAgB,SAAS,MAAc,WAA4B;CACjE,MAAM,WAAWA,UAAAA,QAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAKA,UAAAA,QAAK,KAAK,KAAK,aAAa,QAAQ,CAACA,UAAAA,QAAK,WAAW,QAAQ;AACpH;AAEA,SAAgB,qBACd,OACA,YACA,qBACwB;CACxB,MAAM,WAAW,qBAAqB,OAAO,KAAK,KAAK,CAAC;CACxD,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GAAG;EACvC,MAAM,cAAc,QAAQ,aAAa,UAAU,IAAI,YAAY,IAAI;EACvE,IAAI,0BAA0B,IAAI,WAAW,GAC3C,MAAM,IAAI,MAAM,YAAY,IAAI,+BAA+B;CAEnE;CACA,OAAO;EACL,GAAG,OAAO,YACR,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAC5C,KACA,yBAAyB,MAAM,YAAY,mBAAmB,CAChE,CAAC,CACH;EACA,aAAa;EACb,aAAa;CACf;AACF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,eAAe,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAClG,IAAI,aAAa,YAAY,MAAM,aAAa,OAAO;CACvD,IAAI,OAAO,YAAY,GAAG,OAAO,aAAa,MAAM,GAAG,CAAC,CAAC,OAAO;CAChE,OAAO,iBAAiB;AAC1B;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,MAAM,eAAe,OAAO,KAAK;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,qCAAqC;CACvD;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,OAAO,YAAY,OAAO,UAAU,MAAM,IAAI,MAAM,uCAAuC;CAC/F,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,iCAAiC;CAClE,IAAI,OAAO,aAAa,WAAW,CAAC,eAAe,OAAO,QAAQ,GAChE,MAAM,IAAI,MAAM,sCAAsC;CAExD,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAAoD;CACnF,MAAM,UAAU,qBAAqB,OAAO,SAAS;CACrD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,YAAY,KAAK,YAAY;EACnC,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;EACnF,KAAK,IAAI,SAAS;EAClB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,+BAA+B,KAAK,IAAI,GACpE,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;CAEjD;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,UACA,kBACQ;CACR,MAAM,UAAA,GAASC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAChC,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAOD,UAAAA,QAAK,KAAK,kBAAkB,oBAAoB,OAAO,eAAe;AAC/E;AAEA,SAAgB,YAAY,YAAoD;CAC9E,OAAO;EACL,cAAc,EAAE,YAAY,CAAC,EAAE;EAC/B,aAAa,CAAC;EACd,gBAAgB,CAAC;EACjB,aAAa,CAAC,UAAU;CAC1B;AACF;AAEA,SAAgB,YAAY,QAAkD;CAC5E,OAAO,4BAA4B,OAAO,SAAS;AACrD;;AAGA,SAAgB,uBAAuB,QAAgD;CACrF,IAAI,OAAO,iBAAiBE,iCAAAA,6BAC1B,MAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,YAAY,EAAE,EAAE;CAEvE,IAAI,CAACF,UAAAA,QAAK,WAAW,OAAO,UAAU,KAAK,CAACA,UAAAA,QAAK,WAAW,OAAO,mBAAmB,GACpF,MAAM,IAAI,MAAM,qDAAqD;AAEzE;AAEA,SAAgB,qBAAqB,YAAoB,YAA0B;CACjF,IAAIA,UAAAA,QAAK,QAAQ,UAAU,MAAM,cAAcA,UAAAA,QAAK,SAAS,UAAU,MAAM,YAC3E,MAAM,IAAI,MAAM,8CAA8C;AAElE;;AAGA,SAAgB,iBACd,QACA,OACA,OACyB;CAEzB,KAAA,GADeC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAChD,MAAM,OAAO,eAAe,MAAM,IAAI,MAAM,8CAA8C;CACnG,MAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC9F,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B;CACnE,SAAS,QAAQ,CAAC,WAAW,YAAY,GAAG,KAAK;CACjD,IAAI,OAAO,YAAY,OAAO,cAAc,MAAM,IAAI,MAAM,6CAA6C;CACzG,IAAI,CAAC,SAAS,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAChF,OAAO,OAAO;AAChB;;AAGA,SAAgB,kBAAkB,MAAc,SAAuE;CACrH,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,CAAC,WAAW,QAAQ,WAAW;CAC/C,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,IAAK,CAAC,WAAW,CAAC,QAAQ,SAAS,IAAI,KAAO,sBAAsB,qBAAqB,IAAI,IAAI,GAAI,OAAO;CAC5G,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAuB;CAC3D,OAAO,GAAG,MAAM;AAClB;AAEA,SAAgB,wBAAwB,OAAe,MAAc,OAAwB;CAC3F,OAAO,GAAG,MAAM,mBAAmB,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpG;AAEA,SAAgB,eAAe,OAAe,OAAgD;CAC5F,OAAO,YAAY,GAAG,MAAM,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;AACvG;;AAGA,SAAgB,WAAW,KAAc,MAAsB;CAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAClE,MAAM,OAAO,eAAe,IAAI,MAAM,MAAM;CAC5C,IAAI,SAAS,SAAS,SAAS,KAAK;EAAC;EAAQ;EAAW;EAAQ;EAAO;CAAK,GAAG,WAAW,KAAK,EAAE;CACjG,OAAO;AACT;AAEA,SAAgB,YACd,MACA,QACkB;CAClB,OAAO;EACL,UAAU;GAAE;GAAM,WAAW;GAAS;EAAO;EAC7C,QAAQ;GAAE,MAAM;GAAS,GAAG;EAAO;CACrC;AACF;;AAGA,SAAgB,aAAa,KAAiB,MAAc,MAAgC;CAC1F,IAAI,SAAS,qBAAqB,SAAS,OAAO;EAChD,SAAS,KAAK;GAAC;GAAQ;GAAO;EAAS,GAAG,WAAW,KAAK,EAAE;EAC5D,MAAM,MAAM,aAAa,IAAI,GAAG;EAChC,MAAM,UAAU,iBAAiB,IAAI,OAAO;EAC5C,MAAM,YAAY,SAAS,oBAAoB,SAAS;EACxD,MAAM,SAAS;GAAE;GAAK,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAG;EACtD,OAAO;GACL,UAAU;IAAE;IAAM;IAAW;GAAO;GACpC,QAAQ;IAAE,MAAM;IAAW,GAAG;GAAO;EACvC;CACF;CACA,MAAM,IAAI,MAAM,+BAA+B,KAAK,EAAE;AACxD;AAEA,SAAgB,eAAe,iBAAqD;CAClF,OAAO,GAAG,KAAK,UAAU,EAAE,YAAY,gBAAgB,GAAG,MAAM,CAAC,EAAE;AACrE;AAEA,SAAgB,eAAe,QAA0C,YAAoB,UAA0B;CACrH,QAAA,GAAOA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CACxB,OAAO,mBAAmB,CAAC,CAC3B,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,UAAU,CAAC,CAClB,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK;AACjB;;AAGA,SAAgB,0BACd,UACA,YACA,qBACiD;CACjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,MAAM,eAAe,UAAU,KAAK;CAC1C,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EAAE,MAAM;EAAY,WAAWD,UAAAA,QAAK,QAAQ,YAAY,GAAG;CAAE;CAC9F,MAAM,WAAW,yBAAyB,KAAK,YAAY,mBAAmB;CAC9E,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAY,WAAWA,UAAAA,QAAK,QAAQ,QAAQ;CAAE;CAE/D,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAqB,WAAWA,UAAAA,QAAK,QAAQ,QAAQ;CAAE;CAExE,MAAM,IAAI,MAAM,2DAA2D;AAC7E;;AAGA,SAAgB,wBAAwB,SAA0B;CAChE,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,YAAY,OAAO,YAAY,QAAQ,WAAW,KAAK,OAAO,GAChE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;;;ACjSA,SAASG,oBAAkB,MAAc,WAAmB,OAAuB;CACjF,IAAI;CACJ,IAAI;EACF,gBAAgBC,QAAAA,QAAG,aAAa,SAAS;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CAC3C;CACA,IAAI,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CACnG,OAAO;AACT;AAEA,SAASC,mBAAiB,SAAiB,YAA4B;CACrE,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAWF,oBAAkB,YAAYG,UAAAA,QAAK,QAAQ,YAAY,OAAO,GAAG,SAAS;CAC3F,IAAI,CAACF,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC7F,IAAI;EACF,QAAA,QAAG,WAAW,UAAUA,QAAAA,QAAG,UAAU,IAAI;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,OAAO;AACT;AAEA,SAASG,4BAA0B,UAAmB,YAAoB,qBAAqC;CAC7G,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAWJ,oBAAkB,YAAY,MAAM,YAAY,WAAW,KAAK;CACjF,IAAI,CAACC,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,iCAAiC;CAC3F,OAAO;AACT;AAEA,SAASI,kBACP,KACA,YACA,qBACA,MACkB;CAClB,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAUH,mBAAiB,eAAe,YAAY,SAAS,SAAS,GAAG,UAAU;CAC3F,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAME,4BAA0B,YAAY,KAAK,YAAY,mBAAmB;CACtF,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;AAEA,SAASE,4BAA0B,QAAgB,UAAkB,kBAAgC;CACnG,QAAA,QAAG,UAAU,kBAAkB;EAAE,MAAA;EAA8B,WAAW;CAAK,CAAC;CAChF,QAAA,QAAG,UAAU,kBAAA,GAAwC;CACrD,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,IAAI,IAAA,GAAGC,YAAAA,WAAAA,CAAW,EAAE;CAC/D,IAAI;EACF,QAAA,QAAG,cAAc,eAAe,UAAU;GAAE,MAAM;GAAM,MAAA;EAAwB,CAAC;EACjF,IAAI;GACF,QAAA,QAAG,WAAW,eAAe,MAAM;EACrC,SAAS,OAAO;GACd,MAAM,OAAQ,MAAgC;GAC9C,IAAI,SAAS,YAAY,SAAS,SAAS,MAAM;GACjD,MAAM,OAAON,QAAAA,QAAG,UAAU,MAAM;GAChC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAKA,QAAAA,QAAG,aAAa,QAAQ,MAAM,MAAM,UACjF,MAAM,IAAI,MAAM,iEAAiE;EAErF;EACA,QAAA,QAAG,UAAU,QAAA,GAAyB;CACxC,UAAU;EACR,QAAA,QAAG,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;CAC1C;AACF;;;;;;;;;;;AAYA,SAAgB,8BACd,QACA,SACgC;CAChC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAaA,QAAAA,QAAG,aAAa,OAAO,UAAU;EACpD,IAAI;GACF,MAAM,WAAWA,QAAAA,QAAG,UAAU,OAAO,mBAAmB;GACxD,IAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAElE,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAC9D,QAAA,QAAG,UAAU,OAAO,qBAAqB;IAAE,MAAA;IAA8B,WAAW;GAAK,CAAC;EAC5F;EACA,QAAA,QAAG,UAAU,OAAO,qBAAA,GAA2C;EAC/D,QAAA,QAAG,WAAW,OAAO,qBAAqBA,QAAAA,QAAG,UAAU,IAAI;EAC3D,MAAM,sBAAsBA,QAAAA,QAAG,aAAa,OAAO,mBAAmB;EACtE,MAAM,aAAaD,oBAAkB,YAAY,OAAO,YAAY,UAAU;EAC9E,qBAAqB,YAAY,UAAU;EAE3C,MAAM,UAAU,iBAAiB,QAAQC,QAAAA,QAAG,aAAa,UAAU,GAAG,KAAK;EAC3E,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAaI,kBAAgB,WAAW,YAAY,qBAAqB,IAAI;IACnF,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,4BAA0B,QAAQ,UAAU,QAAQ,gBAAgB;EACpE,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF;;;ACvIA,eAAe,kBACb,IACA,MACA,WACA,OACA,SACiB;CACjB,MAAM,OAAO,MAAM,GAAG,cAAc,WAAW,OAAO;CACtD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CACvD,IAAI,CAAC,SAAS,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CAChG,OAAO,KAAK;AACd;AAEA,eAAe,iBACb,IACA,SACA,YACA,SACiB;CACjB,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAYG,UAAAA,QAAK,QAAQ,YAAY,OAAO,GAAG,WAAW,OAAO;CAC9G,KAAA,GAAIC,4BAAAA,WAAAA,CAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,QAC5D,MAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,OAAO,MAAMC,4BAAAA,SAAS,SAAS,QAAQ;CAC7C,IAAI,SAAS,KAAA,MAAc,OAAO,QAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5G,OAAO;AACT;AAEA,eAAe,0BACb,IACA,UACA,YACA,qBACA,SACiB;CACjB,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,MAAM,YAAY,WAAW,OAAO,OAAO;CACpG,KAAA,GAAID,4BAAAA,WAAAA,CAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,aAC5D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO;AACT;AAEA,eAAe,gBACb,IACA,KACA,YACA,qBACA,MACA,SAC2B;CAC3B,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAU,MAAM,iBAAiB,IAAI,eAAe,YAAY,SAAS,SAAS,GAAG,YAAY,OAAO;CAC9G,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAM,MAAM,0BAA0B,IAAI,YAAY,KAAK,YAAY,qBAAqB,OAAO;CACzG,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;;AAGA,eAAe,2BAA2B,IAAgB,WAAmB,SAAmC;CAC9G,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,OAAO;CACjD,IAAI,KAAK,IACH;MAAA,KAAK,MAAM,SAAS,aAAa,MAAM,IAAI,MAAM,8CAA8C;CAAA,OAC9F,IAAI,KAAK,MAAM,SAAS,aAC7B,CAAA,GAAA,4BAAA,WAAA,CAAW,MAAM,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;MAEtE,MAAM,KAAK;CAEb,MAAMC,4BAAAA,SAAS,QAAQ,WAAA,GAAiC;CACxD,QAAA,GAAOD,4BAAAA,WAAAA,CAAW,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC;AAC9D;;;;;AAMA,eAAe,0BACb,IACA,QACA,UACA,kBACA,SACe;CACf,CAAA,GAAA,4BAAA,WAAA,CAAW,MAAM,GAAG,UAAU,kBAAkB,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;CAC7E,MAAMC,4BAAAA,SAAS,QAAQ,kBAAA,GAAwC;CAC/D,OAAA,GAAMC,4BAAAA,gBAAAA,CAAgB,IAAI,QAAQ,UAAU,OAAO;CACnD,MAAMD,4BAAAA,SAAS,QAAQ,QAAA,GAAyB;AAClD;;;;;;;;;;AAWA,eAAsB,mCACpB,IACA,QACA,SACA,SACyC;CACzC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,cAAA,GAAaD,4BAAAA,WAAAA,CAAW,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,CAAC;EAChF,MAAM,sBAAsB,MAAM,2BAA2B,IAAI,OAAO,qBAAqB,OAAO;EACpG,MAAM,aAAa,MAAM,kBAAkB,IAAI,YAAY,OAAO,YAAY,YAAY,OAAO;EACjG,qBAAqB,YAAY,UAAU;EAG3C,MAAM,UAAU,iBAAiB,SAD3B,GAAQA,4BAAAA,WAAAA,CAAW,MAAM,GAAG,eAAe,YAAY,OAAO,CAC3B,GAAO,KAAK;EACrD,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAa,MAAM,gBAAgB,IAAI,WAAW,YAAY,qBAAqB,MAAM,OAAO;IACtG,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,MAAM,0BAA0B,IAAI,QAAQ,UAAU,QAAQ,kBAAkB,OAAO;EACvF,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF"}
+{"version":3,"file":"agentPluginMcp.cjs","names":["path","createHash","AGENT_PLUGIN_MCP_SCHEMA_URL","realContainedPath","fs","normalizeCommand","path","normalizeWorkingDirectory","normalizeServer","writeStagedInternalConfig","randomUUID","createHash","AGENT_PLUGIN_MCP_SCHEMA_URL","path","getOrThrow","nodeHost","writeFileAtomic"],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"sourcesContent":["/** Pure Agent Plugin MCP normalisation shared by the async API and the deprecated Node-only sync shim. */\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\n\nimport { AGENT_PLUGIN_MCP_SCHEMA_URL, type PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\n/** Same token grammar as node:http `validateHeaderName` (RFC 9110 tchar). */\nconst HTTP_TOKEN = /^[\\^_`a-zA-Z\\-0-9!#$%&'*+.|~]+$/u;\n/** Same rejected characters as node:http `validateHeaderValue`. */\nconst INVALID_HEADER_VALUE_CHARACTER = /[^\\t\\x20-\\x7e\\x80-\\xff]/u;\nconst IPV4_OCTET = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]?\\\\d)';\nconst IPV4_ADDRESS = new RegExp(`^${IPV4_OCTET}(?:\\\\.${IPV4_OCTET}){3}$`, 'u');\n\nfunction isIPv4(value: string): boolean {\n  return IPV4_ADDRESS.test(value);\n}\n\nexport const PRIVATE_FILE_MODE = 0o600;\nexport const PRIVATE_DIRECTORY_MODE = 0o700;\nexport const RESERVED_ENVIRONMENT_KEYS = new Set(['PLUGIN_ROOT', 'PLUGIN_DATA']);\nexport const PROXY_SERVER_ALIASES = new Set(['mcp-proxy', 'agiflow-proxy']);\n\nexport type JsonObject = Record<string, unknown>;\n\nexport interface AgentPluginMcpConfigSource {\n  path: string;\n  format: 'internal';\n  cacheKey: string;\n}\n\nexport interface NormalizedAgentPluginMcpSource {\n  /** Owner-only, content-addressed layer that bypasses Claude env interpolation. */\n  configSource?: AgentPluginMcpConfigSource;\n  /** Claude-compatible definitions for an external merged config. */\n  claudeConfig: { mcpServers: Record<string, JsonObject> };\n  serverNames: string[];\n  droppedServers: string[];\n  diagnostics: string[];\n}\n\nexport interface NormalizeAgentPluginMcpOptions {\n  stagingDirectory: string;\n  /** Empty and absent lists both mean keep every server. */\n  allowedServers?: readonly string[];\n  /** Po strips nested wrappers; external-only callers may opt out. */\n  stripProxyWrappers?: boolean;\n}\n\nexport interface NormalizedServer {\n  internal: JsonObject;\n  claude: JsonObject;\n}\n\nexport function isObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function onlyKeys(value: JsonObject, allowed: readonly string[], label: string): void {\n  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));\n  if (unexpected) throw new Error(`${label} contains unsupported field \"${unexpected}\"`);\n}\n\nexport function nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nexport function optionalStringArray(value: unknown, label: string): string[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error(`${label} must be an array of strings`);\n  return value.map((item, index) => {\n    if (typeof item !== 'string') throw new Error(`${label}[${index}] must be a string`);\n    return item;\n  });\n}\n\nfunction optionalStringRecord(value: unknown, label: string): Record<string, string> | undefined {\n  if (value === undefined) return undefined;\n  if (!isObject(value)) throw new Error(`${label} must be an object of string values`);\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => {\n      if (typeof item !== 'string') throw new Error(`${label}.${key} must be a string`);\n      return [key, item];\n    }),\n  );\n}\n\nexport function expandPluginPlaceholders(value: string, pluginRoot: string, pluginDataDirectory: string): string {\n  // The portable contract is a single, non-recursive replacement pass. An\n  // unrecognised placeholder remains literal and mcp-proxy must not reinterpret it.\n  return value.replace(/\\$\\{PLUGIN_(ROOT|DATA)\\}/gu, (placeholder) =>\n    placeholder === '${PLUGIN_ROOT}' ? pluginRoot : pluginDataDirectory,\n  );\n}\n\nexport function isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));\n}\n\nexport function normalizeEnvironment(\n  value: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): Record<string, string> {\n  const declared = optionalStringRecord(value, 'env') ?? {};\n  for (const key of Object.keys(declared)) {\n    const reservedKey = process.platform === 'win32' ? key.toUpperCase() : key;\n    if (RESERVED_ENVIRONMENT_KEYS.has(reservedKey)) {\n      throw new Error(`env key \"${key}\" is reserved by Agent Plugins`);\n    }\n  }\n  return {\n    ...Object.fromEntries(\n      Object.entries(declared).map(([key, item]) => [\n        key,\n        expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n      ]),\n    ),\n    PLUGIN_ROOT: pluginRoot,\n    PLUGIN_DATA: pluginDataDirectory,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const bareHostname = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (bareHostname.toLowerCase() === 'localhost') return true;\n  if (isIPv4(bareHostname)) return bareHostname.split('.')[0] === '127';\n  return bareHostname === '::1';\n}\n\nexport function normalizeUrl(value: unknown): string {\n  const raw = nonEmptyString(value, 'url');\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('url must be an absolute HTTP(S) URL');\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error('url must use http or https');\n  }\n  if (parsed.username || parsed.password) throw new Error('url must not contain user information');\n  if (parsed.hash) throw new Error('url must not contain a fragment');\n  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {\n    throw new Error('non-loopback MCP URLs must use https');\n  }\n  return raw;\n}\n\nexport function normalizeHeaders(value: unknown): Record<string, string> | undefined {\n  const headers = optionalStringRecord(value, 'headers');\n  if (!headers) return undefined;\n  const seen = new Set<string>();\n  for (const [name, item] of Object.entries(headers)) {\n    const canonical = name.toLowerCase();\n    if (seen.has(canonical)) throw new Error(`headers contain duplicate name \"${name}\"`);\n    seen.add(canonical);\n    if (!HTTP_TOKEN.test(name) || INVALID_HEADER_VALUE_CHARACTER.test(item)) {\n      throw new Error(`header \"${name}\" is invalid`);\n    }\n  }\n  return headers;\n}\n\nexport function stagedInternalPath(\n  source: PoMcpAgentPluginProjectionSource,\n  contents: string,\n  stagingDirectory: string,\n): string {\n  const digest = createHash('sha256')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(contents)\n    .digest('hex')\n    .slice(0, 20);\n  return path.join(stagingDirectory, `agent-plugin-mcp-${digest}.internal.json`);\n}\n\nexport function emptyResult(diagnostic: string): NormalizedAgentPluginMcpSource {\n  return {\n    claudeConfig: { mcpServers: {} },\n    serverNames: [],\n    droppedServers: [],\n    diagnostics: [diagnostic],\n  };\n}\n\nexport function sourceLabel(source: PoMcpAgentPluginProjectionSource): string {\n  return `Agent Plugin MCP source \"${source.sourceId}\"`;\n}\n\n/** Checks the projection identity before any file is touched. */\nexport function assertProjectionSource(source: PoMcpAgentPluginProjectionSource): void {\n  if (source.mcpSchemaUrl !== AGENT_PLUGIN_MCP_SCHEMA_URL) {\n    throw new Error(`unsupported schema \"${String(source.mcpSchemaUrl)}\"`);\n  }\n  if (!path.isAbsolute(source.pluginRoot) || !path.isAbsolute(source.pluginDataDirectory)) {\n    throw new Error('pluginRoot and pluginDataDirectory must be absolute');\n  }\n}\n\nexport function assertRootConfigPath(configPath: string, pluginRoot: string): void {\n  if (path.dirname(configPath) !== pluginRoot || path.basename(configPath) !== 'mcp.json') {\n    throw new Error('portable plugin config must be root mcp.json');\n  }\n}\n\n/** Verifies the digest and document shape of the raw mcp.json bytes; returns its server map. */\nexport function parseMcpDocument(\n  source: PoMcpAgentPluginProjectionSource,\n  bytes: Uint8Array,\n  label: string,\n): Record<string, unknown> {\n  const digest = createHash('sha256').update(bytes).digest('hex');\n  if (digest !== source.contentDigest) throw new Error('content digest does not match the projection');\n  const parsed: unknown = JSON.parse(new TextDecoder('utf-8', { ignoreBOM: true }).decode(bytes));\n  if (!isObject(parsed)) throw new Error('document must be an object');\n  onlyKeys(parsed, ['$schema', 'mcpServers'], label);\n  if (parsed.$schema !== source.mcpSchemaUrl) throw new Error('$schema does not match the projected schema');\n  if (!isObject(parsed.mcpServers)) throw new Error('mcpServers must be an object');\n  return parsed.mcpServers;\n}\n\n/** Whether a declared server is skipped (empty name), dropped by the allowlist or wrapper rule, or normalised. */\nexport function serverDisposition(name: string, options: NormalizeAgentPluginMcpOptions): 'empty' | 'dropped' | 'keep' {\n  if (!name) return 'empty';\n  const allowed = options.allowedServers;\n  const keepAll = !allowed || allowed.length === 0;\n  const stripProxyWrappers = options.stripProxyWrappers ?? true;\n  if ((!keepAll && !allowed.includes(name)) || (stripProxyWrappers && PROXY_SERVER_ALIASES.has(name))) return 'dropped';\n  return 'keep';\n}\n\nexport function emptyServerDiagnostic(label: string): string {\n  return `${label} contains an empty server name; that entry was skipped.`;\n}\n\nexport function skippedServerDiagnostic(label: string, name: string, error: unknown): string {\n  return `${label} skipped server \"${name}\": ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function disabledResult(label: string, error: unknown): NormalizedAgentPluginMcpSource {\n  return emptyResult(`${label} was disabled: ${error instanceof Error ? error.message : String(error)}`);\n}\n\n/** The declared transport of one server; stdio declarations are also checked for unsupported fields. */\nexport function serverType(raw: unknown, name: string): string {\n  if (!isObject(raw)) throw new Error('definition must be an object');\n  const type = nonEmptyString(raw.type, 'type');\n  if (type === 'stdio') onlyKeys(raw, ['type', 'command', 'args', 'env', 'cwd'], `server \"${name}\"`);\n  return type;\n}\n\nexport function stdioServer(\n  name: string,\n  config: { command: string; args?: string[]; env: Record<string, string>; cwd: string },\n): NormalizedServer {\n  return {\n    internal: { name, transport: 'stdio', config },\n    claude: { type: 'stdio', ...config },\n  };\n}\n\n/** A streamable-http or sse server; any other type is unsupported. */\nexport function remoteServer(raw: JsonObject, name: string, type: string): NormalizedServer {\n  if (type === 'streamable-http' || type === 'sse') {\n    onlyKeys(raw, ['type', 'url', 'headers'], `server \"${name}\"`);\n    const url = normalizeUrl(raw.url);\n    const headers = normalizeHeaders(raw.headers);\n    const transport = type === 'streamable-http' ? 'http' : 'sse';\n    const config = { url, ...(headers ? { headers } : {}) };\n    return {\n      internal: { name, transport, config },\n      claude: { type: transport, ...config },\n    };\n  }\n  throw new Error(`unsupported transport type \"${type}\"`);\n}\n\nexport function stagedContents(internalServers: Record<string, JsonObject>): string {\n  return `${JSON.stringify({ mcpServers: internalServers }, null, 2)}\\n`;\n}\n\nexport function stagedCacheKey(source: PoMcpAgentPluginProjectionSource, configPath: string, contents: string): string {\n  return createHash('sha256')\n    .update('agent-plugin-v1\\0')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(configPath)\n    .update('\\0')\n    .update(contents)\n    .digest('hex');\n}\n\n/** The containment base and expanded path of a declared cwd, or undefined when the plugin root is the default. */\nexport function workingDirectoryCandidate(\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): { base: string; candidate: string } | undefined {\n  if (declared === undefined) return undefined;\n  const cwd = nonEmptyString(declared, 'cwd');\n  if (cwd.startsWith('./')) return { base: pluginRoot, candidate: path.resolve(pluginRoot, cwd) };\n  const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginDataDirectory);\n  if (cwd === '${PLUGIN_ROOT}' || cwd.startsWith('${PLUGIN_ROOT}/')) {\n    return { base: pluginRoot, candidate: path.resolve(expanded) };\n  }\n  if (cwd === '${PLUGIN_DATA}' || cwd.startsWith('${PLUGIN_DATA}/')) {\n    return { base: pluginDataDirectory, candidate: path.resolve(expanded) };\n  }\n  throw new Error('cwd must start with ./, ${PLUGIN_ROOT}, or ${PLUGIN_DATA}');\n}\n\n/** Rejects a command that is neither a bare executable name nor a ./ path; true when it must be resolved. */\nexport function isPluginRelativeCommand(command: string): boolean {\n  if (command.startsWith('./')) return true;\n  if (command === '.' || command === '..' || /[\\s/\\\\]/u.test(command)) {\n    throw new Error('command must be a bare executable name or a ./ path inside the plugin');\n  }\n  return false;\n}\n","import { createHash, randomUUID } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n  AGENT_PLUGIN_MCP_SCHEMA_URL,\n  type PoMcpAgentPluginProjectionSource,\n  type PoMcpProjectionSource,\n} from '@agimon-ai/po-core/mcpProjection';\n\nimport type { PluginEntry } from '../../types/domains';\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nfunction realContainedPath(root: string, candidate: string, label: string): string {\n  let realCandidate: string;\n  try {\n    realCandidate = fs.realpathSync(candidate);\n  } catch {\n    throw new Error(`${label} does not exist`);\n  }\n  if (!isInside(root, realCandidate)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return realCandidate;\n}\n\nfunction normalizeCommand(command: string, pluginRoot: string): string {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = realContainedPath(pluginRoot, path.resolve(pluginRoot, command), 'command');\n  if (!fs.statSync(resolved).isFile()) throw new Error('command must resolve to a regular file');\n  try {\n    fs.accessSync(resolved, fs.constants.X_OK);\n  } catch {\n    throw new Error('command must resolve to an executable file');\n  }\n  return resolved;\n}\n\nfunction normalizeWorkingDirectory(declared: unknown, pluginRoot: string, pluginDataDirectory: string): string {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = realContainedPath(declaredCwd.base, declaredCwd.candidate, 'cwd');\n  if (!fs.statSync(resolved).isDirectory()) throw new Error('cwd must resolve to a directory');\n  return resolved;\n}\n\nfunction normalizeServer(\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n): NormalizedServer {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = normalizeCommand(nonEmptyString(declaration.command, 'command'), pluginRoot);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = normalizeWorkingDirectory(declaration.cwd, pluginRoot, pluginDataDirectory);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\nfunction writeStagedInternalConfig(target: string, contents: string, stagingDirectory: string): void {\n  fs.mkdirSync(stagingDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n  fs.chmodSync(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  const temporaryPath = `${target}.${process.pid}-${randomUUID()}.tmp`;\n  try {\n    fs.writeFileSync(temporaryPath, contents, { flag: 'wx', mode: PRIVATE_FILE_MODE });\n    try {\n      fs.renameSync(temporaryPath, target);\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n      if (code !== 'EEXIST' && code !== 'EPERM') throw error;\n      const stat = fs.lstatSync(target);\n      if (stat.isSymbolicLink() || !stat.isFile() || fs.readFileSync(target, 'utf8') !== contents) {\n        throw new Error('content-addressed staging path is occupied by different content');\n      }\n    }\n    fs.chmodSync(target, PRIVATE_FILE_MODE);\n  } finally {\n    fs.rmSync(temporaryPath, { force: true });\n  }\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n *\n * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.\n */\nexport function normalizeAgentPluginMcpSource(\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n): NormalizedAgentPluginMcpSource {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = fs.realpathSync(source.pluginRoot);\n    try {\n      const dataStat = fs.lstatSync(source.pluginDataDirectory);\n      if (dataStat.isSymbolicLink() || !dataStat.isDirectory()) {\n        throw new Error('pluginDataDirectory must be a real directory');\n      }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      fs.mkdirSync(source.pluginDataDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n    }\n    fs.chmodSync(source.pluginDataDirectory, PRIVATE_DIRECTORY_MODE);\n    fs.accessSync(source.pluginDataDirectory, fs.constants.W_OK);\n    const pluginDataDirectory = fs.realpathSync(source.pluginDataDirectory);\n    const configPath = realContainedPath(pluginRoot, source.configPath, 'mcp.json');\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const servers = parseMcpDocument(source, fs.readFileSync(configPath), label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = normalizeServer(rawServer, pluginRoot, pluginDataDirectory, name);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    writeStagedInternalConfig(target, contents, options.stagingDirectory);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n\nconst AGENT_PLUGIN_SCHEMA = 'https://agent-plugins.org/schemas/1.0.0/plugin.schema.json';\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction stablePluginIdentity(entry: PluginEntry): string {\n  const source = entry.source;\n  const identity =\n    source?.type === 'git'\n      ? ['git', source.url, source.path ?? '']\n      : source?.type === 'npm'\n        ? ['npm', source.registry ?? '', source.package]\n        : ['local', fs.realpathSync(entry.directory)];\n  return createHash('sha256').update(JSON.stringify(identity)).digest('hex');\n}\n\nfunction rootAgentPluginSchema(entry: PluginEntry): string | undefined {\n  const manifestPath = path.join(entry.directory, 'plugin.json');\n  if (entry.manifest?.path === manifestPath && entry.manifest.agentPluginSchema === AGENT_PLUGIN_SCHEMA) {\n    return AGENT_PLUGIN_SCHEMA;\n  }\n  try {\n    const stat = fs.lstatSync(manifestPath);\n    if (stat.isSymbolicLink() || !stat.isFile()) return undefined;\n    const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8')) as unknown;\n    return isPlainObject(parsed) && parsed.$schema === AGENT_PLUGIN_SCHEMA ? AGENT_PLUGIN_SCHEMA : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** One plugin's MCP config as a projection source, or nothing when it ships none. Shared by sync and settings. */\nexport async function pluginMcpSource(\n  entry: PluginEntry,\n  pluginDataRoot: string,\n): Promise<PoMcpProjectionSource | undefined> {\n  if (entry.mcp === false) return undefined;\n  const pluginRoot = fs.realpathSync(entry.directory);\n  const agentPlugin = rootAgentPluginSchema(entry) === AGENT_PLUGIN_SCHEMA;\n  const configPath = path.join(pluginRoot, agentPlugin ? 'mcp.json' : '.mcp.json');\n  let stat: fs.Stats;\n  try {\n    stat = await fs.promises.lstat(configPath);\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;\n    throw error;\n  }\n  if (!stat.isFile() || stat.isSymbolicLink()) return undefined;\n  const content = await fs.promises.readFile(configPath);\n  const contentDigest = createHash('sha256').update(content).digest('hex');\n  const pluginId = stablePluginIdentity(entry);\n  const sourceId = `plugin:${pluginId}`;\n  if (!agentPlugin) return { sourceId, owner: 'plugin', format: 'native', configPath, contentDigest };\n  return {\n    sourceId,\n    owner: 'plugin',\n    format: 'agent-plugin-v1',\n    configPath,\n    contentDigest,\n    pluginId,\n    pluginRoot,\n    pluginDataDirectory: path.join(pluginDataRoot, pluginId),\n    mcpSchemaUrl: AGENT_PLUGIN_MCP_SCHEMA_URL,\n  };\n}\n","import path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\nimport { type FileSystem, getOrThrow, nodeHost, writeFileAtomic } from '@agimon-ai/po-core/platform';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nexport type {\n  AgentPluginMcpConfigSource,\n  NormalizeAgentPluginMcpOptions,\n  NormalizedAgentPluginMcpSource,\n} from './normalize';\nexport { normalizeAgentPluginMcpSource, pluginMcpSource } from './sync';\n\ntype Context = Parameters<FileSystem['readTextFile']>[1];\n\nasync function realContainedPath(\n  fs: FileSystem,\n  root: string,\n  candidate: string,\n  label: string,\n  context: Context,\n): Promise<string> {\n  const real = await fs.canonicalPath(candidate, context);\n  if (!real.ok) throw new Error(`${label} does not exist`);\n  if (!isInside(root, real.value)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return real.value;\n}\n\nasync function normalizeCommand(\n  fs: FileSystem,\n  command: string,\n  pluginRoot: string,\n  context: Context,\n): Promise<string> {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = await realContainedPath(fs, pluginRoot, path.resolve(pluginRoot, command), 'command', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'file') {\n    throw new Error('command must resolve to a regular file');\n  }\n  // Execute bits stand in for access(X_OK); the edge has no modes, so nodeHost reports none and the check is skipped.\n  const mode = await nodeHost.fileMode(resolved);\n  if (mode !== undefined && (mode & 0o111) === 0) throw new Error('command must resolve to an executable file');\n  return resolved;\n}\n\nasync function normalizeWorkingDirectory(\n  fs: FileSystem,\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  context: Context,\n): Promise<string> {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = await realContainedPath(fs, declaredCwd.base, declaredCwd.candidate, 'cwd', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'directory') {\n    throw new Error('cwd must resolve to a directory');\n  }\n  return resolved;\n}\n\nasync function normalizeServer(\n  fs: FileSystem,\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n  context: Context,\n): Promise<NormalizedServer> {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = await normalizeCommand(fs, nonEmptyString(declaration.command, 'command'), pluginRoot, context);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = await normalizeWorkingDirectory(fs, declaration.cwd, pluginRoot, pluginDataDirectory, context);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\n/** Owner-only plugin data directory; a symbolic link or non-directory rejects the source. */\nasync function preparePluginDataDirectory(fs: FileSystem, directory: string, context: Context): Promise<string> {\n  const info = await fs.fileInfo(directory, context);\n  if (info.ok) {\n    if (info.value.kind !== 'directory') throw new Error('pluginDataDirectory must be a real directory');\n  } else if (info.error.code === 'not_found') {\n    getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n  } else {\n    throw info.error;\n  }\n  await nodeHost.setMode(directory, PRIVATE_DIRECTORY_MODE);\n  return getOrThrow(await fs.canonicalPath(directory, context));\n}\n\n/**\n * Content-addressed and owner-only. The name hashes the contents, so replacing an\n * existing staged file through a uniquely named temporary file never changes what it holds.\n */\nasync function writeStagedInternalConfig(\n  fs: FileSystem,\n  target: string,\n  contents: string,\n  stagingDirectory: string,\n  context: Context,\n): Promise<void> {\n  getOrThrow(await fs.createDir(stagingDirectory, { recursive: true }, context));\n  await nodeHost.setMode(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  await writeFileAtomic(fs, target, contents, context);\n  await nodeHost.setMode(target, PRIVATE_FILE_MODE);\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer,\n * reading and writing through the injected file system.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n */\nexport async function normalizeAgentPluginMcpSourceAsync(\n  fs: FileSystem,\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n  context: Context,\n): Promise<NormalizedAgentPluginMcpSource> {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = getOrThrow(await fs.canonicalPath(source.pluginRoot, context));\n    const pluginDataDirectory = await preparePluginDataDirectory(fs, source.pluginDataDirectory, context);\n    const configPath = await realContainedPath(fs, pluginRoot, source.configPath, 'mcp.json', context);\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const bytes = getOrThrow(await fs.readBinaryFile(configPath, context));\n    const servers = parseMcpDocument(source, bytes, label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = await normalizeServer(fs, rawServer, pluginRoot, pluginDataDirectory, name, context);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    await writeStagedInternalConfig(fs, target, contents, options.stagingDirectory, context);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAOA,MAAM,aAAa;;AAEnB,MAAM,iCAAiC;AACvC,MAAM,aAAa;AACnB,MAAM,eAAe,IAAI,OAAO,IAAI,WAAW,QAAQ,WAAW,QAAQ,GAAG;AAE7E,SAAS,OAAO,OAAwB;CACtC,OAAO,aAAa,KAAK,KAAK;AAChC;AAIA,MAAa,4CAA4B,IAAI,IAAI,CAAC,eAAe,aAAa,CAAC;AAC/E,MAAa,uCAAuB,IAAI,IAAI,CAAC,aAAa,eAAe,CAAC;AAiC1E,SAAgB,SAAS,OAAqC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAgB,SAAS,OAAmB,SAA4B,OAAqB;CAC3F,MAAM,aAAa,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC1E,IAAI,YAAY,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,WAAW,EAAE;AACvF;AAEA,SAAgB,eAAe,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAC1G,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAqC;CACvF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;CACjF,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;EACnF,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,OAAmD;CAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;CACnF,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU;EACzC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,kBAAkB;EAChF,OAAO,CAAC,KAAK,IAAI;CACnB,CAAC,CACH;AACF;AAEA,SAAgB,yBAAyB,OAAe,YAAoB,qBAAqC;CAG/G,OAAO,MAAM,QAAQ,+BAA+B,gBAClD,gBAAgB,mBAAmB,aAAa,mBAClD;AACF;AAEA,SAAgB,SAAS,MAAc,WAA4B;CACjE,MAAM,WAAWA,UAAAA,QAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAKA,UAAAA,QAAK,KAAK,KAAK,aAAa,QAAQ,CAACA,UAAAA,QAAK,WAAW,QAAQ;AACpH;AAEA,SAAgB,qBACd,OACA,YACA,qBACwB;CACxB,MAAM,WAAW,qBAAqB,OAAO,KAAK,KAAK,CAAC;CACxD,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GAAG;EACvC,MAAM,cAAc,QAAQ,aAAa,UAAU,IAAI,YAAY,IAAI;EACvE,IAAI,0BAA0B,IAAI,WAAW,GAC3C,MAAM,IAAI,MAAM,YAAY,IAAI,+BAA+B;CAEnE;CACA,OAAO;EACL,GAAG,OAAO,YACR,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAC5C,KACA,yBAAyB,MAAM,YAAY,mBAAmB,CAChE,CAAC,CACH;EACA,aAAa;EACb,aAAa;CACf;AACF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,eAAe,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAClG,IAAI,aAAa,YAAY,MAAM,aAAa,OAAO;CACvD,IAAI,OAAO,YAAY,GAAG,OAAO,aAAa,MAAM,GAAG,CAAC,CAAC,OAAO;CAChE,OAAO,iBAAiB;AAC1B;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,MAAM,eAAe,OAAO,KAAK;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,qCAAqC;CACvD;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,OAAO,YAAY,OAAO,UAAU,MAAM,IAAI,MAAM,uCAAuC;CAC/F,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,iCAAiC;CAClE,IAAI,OAAO,aAAa,WAAW,CAAC,eAAe,OAAO,QAAQ,GAChE,MAAM,IAAI,MAAM,sCAAsC;CAExD,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAAoD;CACnF,MAAM,UAAU,qBAAqB,OAAO,SAAS;CACrD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,YAAY,KAAK,YAAY;EACnC,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;EACnF,KAAK,IAAI,SAAS;EAClB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,+BAA+B,KAAK,IAAI,GACpE,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;CAEjD;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,UACA,kBACQ;CACR,MAAM,UAAA,GAASC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAChC,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAOD,UAAAA,QAAK,KAAK,kBAAkB,oBAAoB,OAAO,eAAe;AAC/E;AAEA,SAAgB,YAAY,YAAoD;CAC9E,OAAO;EACL,cAAc,EAAE,YAAY,CAAC,EAAE;EAC/B,aAAa,CAAC;EACd,gBAAgB,CAAC;EACjB,aAAa,CAAC,UAAU;CAC1B;AACF;AAEA,SAAgB,YAAY,QAAkD;CAC5E,OAAO,4BAA4B,OAAO,SAAS;AACrD;;AAGA,SAAgB,uBAAuB,QAAgD;CACrF,IAAI,OAAO,iBAAiBE,iCAAAA,6BAC1B,MAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,YAAY,EAAE,EAAE;CAEvE,IAAI,CAACF,UAAAA,QAAK,WAAW,OAAO,UAAU,KAAK,CAACA,UAAAA,QAAK,WAAW,OAAO,mBAAmB,GACpF,MAAM,IAAI,MAAM,qDAAqD;AAEzE;AAEA,SAAgB,qBAAqB,YAAoB,YAA0B;CACjF,IAAIA,UAAAA,QAAK,QAAQ,UAAU,MAAM,cAAcA,UAAAA,QAAK,SAAS,UAAU,MAAM,YAC3E,MAAM,IAAI,MAAM,8CAA8C;AAElE;;AAGA,SAAgB,iBACd,QACA,OACA,OACyB;CAEzB,KAAA,GADeC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAChD,MAAM,OAAO,eAAe,MAAM,IAAI,MAAM,8CAA8C;CACnG,MAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC9F,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B;CACnE,SAAS,QAAQ,CAAC,WAAW,YAAY,GAAG,KAAK;CACjD,IAAI,OAAO,YAAY,OAAO,cAAc,MAAM,IAAI,MAAM,6CAA6C;CACzG,IAAI,CAAC,SAAS,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAChF,OAAO,OAAO;AAChB;;AAGA,SAAgB,kBAAkB,MAAc,SAAuE;CACrH,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,CAAC,WAAW,QAAQ,WAAW;CAC/C,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,IAAK,CAAC,WAAW,CAAC,QAAQ,SAAS,IAAI,KAAO,sBAAsB,qBAAqB,IAAI,IAAI,GAAI,OAAO;CAC5G,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAuB;CAC3D,OAAO,GAAG,MAAM;AAClB;AAEA,SAAgB,wBAAwB,OAAe,MAAc,OAAwB;CAC3F,OAAO,GAAG,MAAM,mBAAmB,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpG;AAEA,SAAgB,eAAe,OAAe,OAAgD;CAC5F,OAAO,YAAY,GAAG,MAAM,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;AACvG;;AAGA,SAAgB,WAAW,KAAc,MAAsB;CAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAClE,MAAM,OAAO,eAAe,IAAI,MAAM,MAAM;CAC5C,IAAI,SAAS,SAAS,SAAS,KAAK;EAAC;EAAQ;EAAW;EAAQ;EAAO;CAAK,GAAG,WAAW,KAAK,EAAE;CACjG,OAAO;AACT;AAEA,SAAgB,YACd,MACA,QACkB;CAClB,OAAO;EACL,UAAU;GAAE;GAAM,WAAW;GAAS;EAAO;EAC7C,QAAQ;GAAE,MAAM;GAAS,GAAG;EAAO;CACrC;AACF;;AAGA,SAAgB,aAAa,KAAiB,MAAc,MAAgC;CAC1F,IAAI,SAAS,qBAAqB,SAAS,OAAO;EAChD,SAAS,KAAK;GAAC;GAAQ;GAAO;EAAS,GAAG,WAAW,KAAK,EAAE;EAC5D,MAAM,MAAM,aAAa,IAAI,GAAG;EAChC,MAAM,UAAU,iBAAiB,IAAI,OAAO;EAC5C,MAAM,YAAY,SAAS,oBAAoB,SAAS;EACxD,MAAM,SAAS;GAAE;GAAK,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAG;EACtD,OAAO;GACL,UAAU;IAAE;IAAM;IAAW;GAAO;GACpC,QAAQ;IAAE,MAAM;IAAW,GAAG;GAAO;EACvC;CACF;CACA,MAAM,IAAI,MAAM,+BAA+B,KAAK,EAAE;AACxD;AAEA,SAAgB,eAAe,iBAAqD;CAClF,OAAO,GAAG,KAAK,UAAU,EAAE,YAAY,gBAAgB,GAAG,MAAM,CAAC,EAAE;AACrE;AAEA,SAAgB,eAAe,QAA0C,YAAoB,UAA0B;CACrH,QAAA,GAAOA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CACxB,OAAO,mBAAmB,CAAC,CAC3B,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,UAAU,CAAC,CAClB,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK;AACjB;;AAGA,SAAgB,0BACd,UACA,YACA,qBACiD;CACjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,MAAM,eAAe,UAAU,KAAK;CAC1C,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EAAE,MAAM;EAAY,WAAWD,UAAAA,QAAK,QAAQ,YAAY,GAAG;CAAE;CAC9F,MAAM,WAAW,yBAAyB,KAAK,YAAY,mBAAmB;CAC9E,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAY,WAAWA,UAAAA,QAAK,QAAQ,QAAQ;CAAE;CAE/D,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAqB,WAAWA,UAAAA,QAAK,QAAQ,QAAQ;CAAE;CAExE,MAAM,IAAI,MAAM,2DAA2D;AAC7E;;AAGA,SAAgB,wBAAwB,SAA0B;CAChE,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,YAAY,OAAO,YAAY,QAAQ,WAAW,KAAK,OAAO,GAChE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;;;AC5RA,SAASG,oBAAkB,MAAc,WAAmB,OAAuB;CACjF,IAAI;CACJ,IAAI;EACF,gBAAgBC,QAAAA,QAAG,aAAa,SAAS;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CAC3C;CACA,IAAI,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CACnG,OAAO;AACT;AAEA,SAASC,mBAAiB,SAAiB,YAA4B;CACrE,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAWF,oBAAkB,YAAYG,UAAAA,QAAK,QAAQ,YAAY,OAAO,GAAG,SAAS;CAC3F,IAAI,CAACF,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC7F,IAAI;EACF,QAAA,QAAG,WAAW,UAAUA,QAAAA,QAAG,UAAU,IAAI;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,OAAO;AACT;AAEA,SAASG,4BAA0B,UAAmB,YAAoB,qBAAqC;CAC7G,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAWJ,oBAAkB,YAAY,MAAM,YAAY,WAAW,KAAK;CACjF,IAAI,CAACC,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,iCAAiC;CAC3F,OAAO;AACT;AAEA,SAASI,kBACP,KACA,YACA,qBACA,MACkB;CAClB,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAUH,mBAAiB,eAAe,YAAY,SAAS,SAAS,GAAG,UAAU;CAC3F,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAME,4BAA0B,YAAY,KAAK,YAAY,mBAAmB;CACtF,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;AAEA,SAASE,4BAA0B,QAAgB,UAAkB,kBAAgC;CACnG,QAAA,QAAG,UAAU,kBAAkB;EAAE,MAAA;EAA8B,WAAW;CAAK,CAAC;CAChF,QAAA,QAAG,UAAU,kBAAA,GAAwC;CACrD,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,IAAI,IAAA,GAAGC,YAAAA,WAAAA,CAAW,EAAE;CAC/D,IAAI;EACF,QAAA,QAAG,cAAc,eAAe,UAAU;GAAE,MAAM;GAAM,MAAA;EAAwB,CAAC;EACjF,IAAI;GACF,QAAA,QAAG,WAAW,eAAe,MAAM;EACrC,SAAS,OAAO;GACd,MAAM,OAAQ,MAAgC;GAC9C,IAAI,SAAS,YAAY,SAAS,SAAS,MAAM;GACjD,MAAM,OAAON,QAAAA,QAAG,UAAU,MAAM;GAChC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAKA,QAAAA,QAAG,aAAa,QAAQ,MAAM,MAAM,UACjF,MAAM,IAAI,MAAM,iEAAiE;EAErF;EACA,QAAA,QAAG,UAAU,QAAA,GAAyB;CACxC,UAAU;EACR,QAAA,QAAG,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;CAC1C;AACF;;;;;;;;;;;AAYA,SAAgB,8BACd,QACA,SACgC;CAChC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAaA,QAAAA,QAAG,aAAa,OAAO,UAAU;EACpD,IAAI;GACF,MAAM,WAAWA,QAAAA,QAAG,UAAU,OAAO,mBAAmB;GACxD,IAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAElE,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAC9D,QAAA,QAAG,UAAU,OAAO,qBAAqB;IAAE,MAAA;IAA8B,WAAW;GAAK,CAAC;EAC5F;EACA,QAAA,QAAG,UAAU,OAAO,qBAAA,GAA2C;EAC/D,QAAA,QAAG,WAAW,OAAO,qBAAqBA,QAAAA,QAAG,UAAU,IAAI;EAC3D,MAAM,sBAAsBA,QAAAA,QAAG,aAAa,OAAO,mBAAmB;EACtE,MAAM,aAAaD,oBAAkB,YAAY,OAAO,YAAY,UAAU;EAC9E,qBAAqB,YAAY,UAAU;EAE3C,MAAM,UAAU,iBAAiB,QAAQC,QAAAA,QAAG,aAAa,UAAU,GAAG,KAAK;EAC3E,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAaI,kBAAgB,WAAW,YAAY,qBAAqB,IAAI;IACnF,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,4BAA0B,QAAQ,UAAU,QAAQ,gBAAgB;EACpE,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF;AAEA,MAAM,sBAAsB;AAE5B,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,qBAAqB,OAA4B;CACxD,MAAM,SAAS,MAAM;CACrB,MAAM,WACJ,QAAQ,SAAS,QACb;EAAC;EAAO,OAAO;EAAK,OAAO,QAAQ;CAAE,IACrC,QAAQ,SAAS,QACf;EAAC;EAAO,OAAO,YAAY;EAAI,OAAO;CAAO,IAC7C,CAAC,SAASJ,QAAAA,QAAG,aAAa,MAAM,SAAS,CAAC;CAClD,QAAA,GAAOO,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK;AAC3E;AAEA,SAAS,sBAAsB,OAAwC;CACrE,MAAM,eAAeL,UAAAA,QAAK,KAAK,MAAM,WAAW,aAAa;CAC7D,IAAI,MAAM,UAAU,SAAS,gBAAgB,MAAM,SAAS,sBAAsB,qBAChF,OAAO;CAET,IAAI;EACF,MAAM,OAAOF,QAAAA,QAAG,UAAU,YAAY;EACtC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,GAAG,OAAO,KAAA;EACpD,MAAM,SAAS,KAAK,MAAMA,QAAAA,QAAG,aAAa,cAAc,MAAM,CAAC;EAC/D,OAAO,cAAc,MAAM,KAAK,OAAO,YAAY,sBAAsB,sBAAsB,KAAA;CACjG,QAAQ;EACN;CACF;AACF;;AAGA,eAAsB,gBACpB,OACA,gBAC4C;CAC5C,IAAI,MAAM,QAAQ,OAAO,OAAO,KAAA;CAChC,MAAM,aAAaA,QAAAA,QAAG,aAAa,MAAM,SAAS;CAClD,MAAM,cAAc,sBAAsB,KAAK,MAAM;CACrD,MAAM,aAAaE,UAAAA,QAAK,KAAK,YAAY,cAAc,aAAa,WAAW;CAC/E,IAAI;CACJ,IAAI;EACF,OAAO,MAAMF,QAAAA,QAAG,SAAS,MAAM,UAAU;CAC3C,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,OAAO,KAAA;EAC/D,MAAM;CACR;CACA,IAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe,GAAG,OAAO,KAAA;CACpD,MAAM,UAAU,MAAMA,QAAAA,QAAG,SAAS,SAAS,UAAU;CACrD,MAAM,iBAAA,GAAgBO,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CACvE,MAAM,WAAW,qBAAqB,KAAK;CAC3C,MAAM,WAAW,UAAU;CAC3B,IAAI,CAAC,aAAa,OAAO;EAAE;EAAU,OAAO;EAAU,QAAQ;EAAU;EAAY;CAAc;CAClG,OAAO;EACL;EACA,OAAO;EACP,QAAQ;EACR;EACA;EACA;EACA;EACA,qBAAqBL,UAAAA,QAAK,KAAK,gBAAgB,QAAQ;EACvD,cAAcM,iCAAAA;CAChB;AACF;;;AC/MA,eAAe,kBACb,IACA,MACA,WACA,OACA,SACiB;CACjB,MAAM,OAAO,MAAM,GAAG,cAAc,WAAW,OAAO;CACtD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CACvD,IAAI,CAAC,SAAS,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CAChG,OAAO,KAAK;AACd;AAEA,eAAe,iBACb,IACA,SACA,YACA,SACiB;CACjB,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAYC,UAAAA,QAAK,QAAQ,YAAY,OAAO,GAAG,WAAW,OAAO;CAC9G,KAAA,GAAIC,4BAAAA,WAAAA,CAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,QAC5D,MAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,OAAO,MAAMC,4BAAAA,SAAS,SAAS,QAAQ;CAC7C,IAAI,SAAS,KAAA,MAAc,OAAO,QAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5G,OAAO;AACT;AAEA,eAAe,0BACb,IACA,UACA,YACA,qBACA,SACiB;CACjB,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,MAAM,YAAY,WAAW,OAAO,OAAO;CACpG,KAAA,GAAID,4BAAAA,WAAAA,CAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,aAC5D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO;AACT;AAEA,eAAe,gBACb,IACA,KACA,YACA,qBACA,MACA,SAC2B;CAC3B,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAU,MAAM,iBAAiB,IAAI,eAAe,YAAY,SAAS,SAAS,GAAG,YAAY,OAAO;CAC9G,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAM,MAAM,0BAA0B,IAAI,YAAY,KAAK,YAAY,qBAAqB,OAAO;CACzG,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;;AAGA,eAAe,2BAA2B,IAAgB,WAAmB,SAAmC;CAC9G,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,OAAO;CACjD,IAAI,KAAK,IACH;MAAA,KAAK,MAAM,SAAS,aAAa,MAAM,IAAI,MAAM,8CAA8C;CAAA,OAC9F,IAAI,KAAK,MAAM,SAAS,aAC7B,CAAA,GAAA,4BAAA,WAAA,CAAW,MAAM,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;MAEtE,MAAM,KAAK;CAEb,MAAMC,4BAAAA,SAAS,QAAQ,WAAA,GAAiC;CACxD,QAAA,GAAOD,4BAAAA,WAAAA,CAAW,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC;AAC9D;;;;;AAMA,eAAe,0BACb,IACA,QACA,UACA,kBACA,SACe;CACf,CAAA,GAAA,4BAAA,WAAA,CAAW,MAAM,GAAG,UAAU,kBAAkB,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;CAC7E,MAAMC,4BAAAA,SAAS,QAAQ,kBAAA,GAAwC;CAC/D,OAAA,GAAMC,4BAAAA,gBAAAA,CAAgB,IAAI,QAAQ,UAAU,OAAO;CACnD,MAAMD,4BAAAA,SAAS,QAAQ,QAAA,GAAyB;AAClD;;;;;;;;;;AAWA,eAAsB,mCACpB,IACA,QACA,SACA,SACyC;CACzC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,cAAA,GAAaD,4BAAAA,WAAAA,CAAW,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,CAAC;EAChF,MAAM,sBAAsB,MAAM,2BAA2B,IAAI,OAAO,qBAAqB,OAAO;EACpG,MAAM,aAAa,MAAM,kBAAkB,IAAI,YAAY,OAAO,YAAY,YAAY,OAAO;EACjG,qBAAqB,YAAY,UAAU;EAG3C,MAAM,UAAU,iBAAiB,SAD3B,GAAQA,4BAAAA,WAAAA,CAAW,MAAM,GAAG,eAAe,YAAY,OAAO,CAC3B,GAAO,KAAK;EACrD,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAa,MAAM,gBAAgB,IAAI,WAAW,YAAY,qBAAqB,MAAM,OAAO;IACtG,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,MAAM,0BAA0B,IAAI,QAAQ,UAAU,QAAQ,kBAAkB,OAAO;EACvF,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF"}

package/dist/agentPluginMcp.d.mts

@@ -1,5 +1,6 @@
+import { u as PluginEntry } from "./domains-Bo9krPQ5.mjs";
 import { FileSystem } from "@agimon-ai/po-core/platform";
-import { PoMcpAgentPluginProjectionSource } from "@agimon-ai/po-core/mcpProjection";
+import { PoMcpAgentPluginProjectionSource, PoMcpProjectionSource } from "@agimon-ai/po-core/mcpProjection";
 //#region src/services/agentPluginMcp/normalize.d.ts
 type JsonObject = Record<string, unknown>;
 interface AgentPluginMcpConfigSource {
@@ -38,6 +39,8 @@ interface NormalizeAgentPluginMcpOptions {
  * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.
  */
 export declare function normalizeAgentPluginMcpSource(source: PoMcpAgentPluginProjectionSource, options: NormalizeAgentPluginMcpOptions): NormalizedAgentPluginMcpSource;
+/** One plugin's MCP config as a projection source, or nothing when it ships none. Shared by sync and settings. */
+export declare function pluginMcpSource(entry: PluginEntry, pluginDataRoot: string): Promise<PoMcpProjectionSource | undefined>;
 //#endregion
 //#region src/services/agentPluginMcp/index.d.ts
 type Context = Parameters<FileSystem['readTextFile']>[1];

package/dist/agentPluginMcp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"agentPluginMcp.d.mts","names":[],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"mappings":";;;KAsBY,aAAa;UAER;EACf;EACA;EACA;;UAGe;;EAEf,eAAe;;EAEf;IAAgB,YAAY,eAAe;;EAC3C;EACA;EACA;;UAGe;EACf;;EAEA;;EAEA;;;;;;;;;;;;;;wBCwEc,8BACd,QAAQ,kCACR,SAAS,iCACR;;;KC9EE,UAAU,WAAW;;;;;;;;;;wBA4GJ,mCACpB,IAAI,YACJ,QAAQ,kCACR,SAAS,gCACT,SAAS,UACR,QAAQ"}
+{"version":3,"file":"agentPluginMcp.d.mts","names":[],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"mappings":";;;;KAsBY,aAAa;UAER;EACf;EACA;EACA;;UAGe;;EAEf,eAAe;;EAEf;IAAgB,YAAY,eAAe;;EAC3C;EACA;EACA;;UAGe;EACf;;EAEA;;EAEA;;;;;;;;;;;;;;wBC6Ec,8BACd,QAAQ,kCACR,SAAS,iCACR;;wBA8FmB,gBACpB,OAAO,aACP,yBACC,QAAQ;;;KCpLN,UAAU,WAAW;;;;;;;;;;wBA4GJ,mCACpB,IAAI,YACJ,QAAQ,kCACR,SAAS,gCACT,SAAS,UACR,QAAQ"}

package/dist/agentPluginMcp.mjs

@@ -373,6 +373,72 @@ function normalizeAgentPluginMcpSource(source, options) {
 		return disabledResult(label, error);
 	}
 }
+const AGENT_PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stablePluginIdentity(entry) {
+	const source = entry.source;
+	const identity = source?.type === "git" ? [
+		"git",
+		source.url,
+		source.path ?? ""
+	] : source?.type === "npm" ? [
+		"npm",
+		source.registry ?? "",
+		source.package
+	] : ["local", fs.realpathSync(entry.directory)];
+	return createHash("sha256").update(JSON.stringify(identity)).digest("hex");
+}
+function rootAgentPluginSchema(entry) {
+	const manifestPath = path.join(entry.directory, "plugin.json");
+	if (entry.manifest?.path === manifestPath && entry.manifest.agentPluginSchema === AGENT_PLUGIN_SCHEMA) return AGENT_PLUGIN_SCHEMA;
+	try {
+		const stat = fs.lstatSync(manifestPath);
+		if (stat.isSymbolicLink() || !stat.isFile()) return void 0;
+		const parsed = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+		return isPlainObject(parsed) && parsed.$schema === AGENT_PLUGIN_SCHEMA ? AGENT_PLUGIN_SCHEMA : void 0;
+	} catch {
+		return;
+	}
+}
+/** One plugin's MCP config as a projection source, or nothing when it ships none. Shared by sync and settings. */
+async function pluginMcpSource(entry, pluginDataRoot) {
+	if (entry.mcp === false) return void 0;
+	const pluginRoot = fs.realpathSync(entry.directory);
+	const agentPlugin = rootAgentPluginSchema(entry) === AGENT_PLUGIN_SCHEMA;
+	const configPath = path.join(pluginRoot, agentPlugin ? "mcp.json" : ".mcp.json");
+	let stat;
+	try {
+		stat = await fs.promises.lstat(configPath);
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
+	if (!stat.isFile() || stat.isSymbolicLink()) return void 0;
+	const content = await fs.promises.readFile(configPath);
+	const contentDigest = createHash("sha256").update(content).digest("hex");
+	const pluginId = stablePluginIdentity(entry);
+	const sourceId = `plugin:${pluginId}`;
+	if (!agentPlugin) return {
+		sourceId,
+		owner: "plugin",
+		format: "native",
+		configPath,
+		contentDigest
+	};
+	return {
+		sourceId,
+		owner: "plugin",
+		format: "agent-plugin-v1",
+		configPath,
+		contentDigest,
+		pluginId,
+		pluginRoot,
+		pluginDataDirectory: path.join(pluginDataRoot, pluginId),
+		mcpSchemaUrl: AGENT_PLUGIN_MCP_SCHEMA_URL
+	};
+}
 //#endregion
 //#region src/services/agentPluginMcp/index.ts
 async function realContainedPath(fs, root, candidate, label, context) {
@@ -491,6 +557,6 @@ async function normalizeAgentPluginMcpSourceAsync(fs, source, options, context)
 	}
 }
 //#endregion
-export { normalizeAgentPluginMcpSource, normalizeAgentPluginMcpSourceAsync };
+export { normalizeAgentPluginMcpSource, normalizeAgentPluginMcpSourceAsync, pluginMcpSource };
 
 //# sourceMappingURL=agentPluginMcp.mjs.map

package/dist/agentPluginMcp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"agentPluginMcp.mjs","names":["realContainedPath","normalizeCommand","normalizeWorkingDirectory","normalizeServer","writeStagedInternalConfig"],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"sourcesContent":["/** Pure Agent Plugin MCP normalisation shared by the async API and the deprecated Node-only sync shim. */\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\n\nimport { AGENT_PLUGIN_MCP_SCHEMA_URL, type PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\n/** Same token grammar as node:http `validateHeaderName` (RFC 9110 tchar). */\nconst HTTP_TOKEN = /^[\\^_`a-zA-Z\\-0-9!#$%&'*+.|~]+$/u;\n/** Same rejected characters as node:http `validateHeaderValue`. */\nconst INVALID_HEADER_VALUE_CHARACTER = /[^\\t\\x20-\\x7e\\x80-\\xff]/u;\nconst IPV4_OCTET = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]?\\\\d)';\nconst IPV4_ADDRESS = new RegExp(`^${IPV4_OCTET}(?:\\\\.${IPV4_OCTET}){3}$`, 'u');\n\nfunction isIPv4(value: string): boolean {\n  return IPV4_ADDRESS.test(value);\n}\n\nexport const PRIVATE_FILE_MODE = 0o600;\nexport const PRIVATE_DIRECTORY_MODE = 0o700;\nexport const RESERVED_ENVIRONMENT_KEYS = new Set(['PLUGIN_ROOT', 'PLUGIN_DATA']);\nexport const PROXY_SERVER_ALIASES = new Set(['mcp-proxy', 'agiflow-proxy']);\n\nexport type JsonObject = Record<string, unknown>;\n\nexport interface AgentPluginMcpConfigSource {\n  path: string;\n  format: 'internal';\n  cacheKey: string;\n}\n\nexport interface NormalizedAgentPluginMcpSource {\n  /** Owner-only, content-addressed layer that bypasses Claude env interpolation. */\n  configSource?: AgentPluginMcpConfigSource;\n  /** Claude-compatible definitions for an external merged config. */\n  claudeConfig: { mcpServers: Record<string, JsonObject> };\n  serverNames: string[];\n  droppedServers: string[];\n  diagnostics: string[];\n}\n\nexport interface NormalizeAgentPluginMcpOptions {\n  stagingDirectory: string;\n  /** Empty and absent lists both mean keep every server. */\n  allowedServers?: readonly string[];\n  /** Po strips nested wrappers; external-only callers may opt out. */\n  stripProxyWrappers?: boolean;\n}\n\nexport interface NormalizedServer {\n  internal: JsonObject;\n  claude: JsonObject;\n}\n\nexport function isObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function onlyKeys(value: JsonObject, allowed: readonly string[], label: string): void {\n  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));\n  if (unexpected) throw new Error(`${label} contains unsupported field \"${unexpected}\"`);\n}\n\nexport function nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nexport function optionalStringArray(value: unknown, label: string): string[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error(`${label} must be an array of strings`);\n  return value.map((item, index) => {\n    if (typeof item !== 'string') throw new Error(`${label}[${index}] must be a string`);\n    return item;\n  });\n}\n\nfunction optionalStringRecord(value: unknown, label: string): Record<string, string> | undefined {\n  if (value === undefined) return undefined;\n  if (!isObject(value)) throw new Error(`${label} must be an object of string values`);\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => {\n      if (typeof item !== 'string') throw new Error(`${label}.${key} must be a string`);\n      return [key, item];\n    }),\n  );\n}\n\nexport function expandPluginPlaceholders(value: string, pluginRoot: string, pluginDataDirectory: string): string {\n  // The portable contract is a single, non-recursive replacement pass. An\n  // unrecognised placeholder remains literal and mcp-proxy must not reinterpret it.\n  return value.replace(/\\$\\{PLUGIN_(ROOT|DATA)\\}/gu, (placeholder) =>\n    placeholder === '${PLUGIN_ROOT}' ? pluginRoot : pluginDataDirectory,\n  );\n}\n\nexport function isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));\n}\n\nexport function normalizeEnvironment(\n  value: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): Record<string, string> {\n  const declared = optionalStringRecord(value, 'env') ?? {};\n  for (const key of Object.keys(declared)) {\n    const reservedKey = process.platform === 'win32' ? key.toUpperCase() : key;\n    if (RESERVED_ENVIRONMENT_KEYS.has(reservedKey)) {\n      throw new Error(`env key \"${key}\" is reserved by Agent Plugins`);\n    }\n  }\n  return {\n    ...Object.fromEntries(\n      Object.entries(declared).map(([key, item]) => [\n        key,\n        expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n      ]),\n    ),\n    PLUGIN_ROOT: pluginRoot,\n    PLUGIN_DATA: pluginDataDirectory,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const bareHostname = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (bareHostname.toLowerCase() === 'localhost') return true;\n  if (isIPv4(bareHostname)) return bareHostname.split('.')[0] === '127';\n  return bareHostname === '::1';\n}\n\nexport function normalizeUrl(value: unknown): string {\n  const raw = nonEmptyString(value, 'url');\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('url must be an absolute HTTP(S) URL');\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error('url must use http or https');\n  }\n  if (parsed.username || parsed.password) throw new Error('url must not contain user information');\n  if (parsed.hash) throw new Error('url must not contain a fragment');\n  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {\n    throw new Error('non-loopback MCP URLs must use https');\n  }\n  return raw;\n}\n\nexport function normalizeHeaders(value: unknown): Record<string, string> | undefined {\n  const headers = optionalStringRecord(value, 'headers');\n  if (!headers) return undefined;\n  const seen = new Set<string>();\n  for (const [name, item] of Object.entries(headers)) {\n    const canonical = name.toLowerCase();\n    if (seen.has(canonical)) throw new Error(`headers contain duplicate name \"${name}\"`);\n    seen.add(canonical);\n    if (!HTTP_TOKEN.test(name) || INVALID_HEADER_VALUE_CHARACTER.test(item)) {\n      throw new Error(`header \"${name}\" is invalid`);\n    }\n  }\n  return headers;\n}\n\nexport function stagedInternalPath(\n  source: PoMcpAgentPluginProjectionSource,\n  contents: string,\n  stagingDirectory: string,\n): string {\n  const digest = createHash('sha256')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(contents)\n    .digest('hex')\n    .slice(0, 20);\n  return path.join(stagingDirectory, `agent-plugin-mcp-${digest}.internal.json`);\n}\n\nexport function emptyResult(diagnostic: string): NormalizedAgentPluginMcpSource {\n  return {\n    claudeConfig: { mcpServers: {} },\n    serverNames: [],\n    droppedServers: [],\n    diagnostics: [diagnostic],\n  };\n}\n\nexport function sourceLabel(source: PoMcpAgentPluginProjectionSource): string {\n  return `Agent Plugin MCP source \"${source.sourceId}\"`;\n}\n\n/** Checks the projection identity before any file is touched. */\nexport function assertProjectionSource(source: PoMcpAgentPluginProjectionSource): void {\n  if (source.mcpSchemaUrl !== AGENT_PLUGIN_MCP_SCHEMA_URL) {\n    throw new Error(`unsupported schema \"${String(source.mcpSchemaUrl)}\"`);\n  }\n  if (!path.isAbsolute(source.pluginRoot) || !path.isAbsolute(source.pluginDataDirectory)) {\n    throw new Error('pluginRoot and pluginDataDirectory must be absolute');\n  }\n}\n\nexport function assertRootConfigPath(configPath: string, pluginRoot: string): void {\n  if (path.dirname(configPath) !== pluginRoot || path.basename(configPath) !== 'mcp.json') {\n    throw new Error('portable plugin config must be root mcp.json');\n  }\n}\n\n/** Verifies the digest and document shape of the raw mcp.json bytes; returns its server map. */\nexport function parseMcpDocument(\n  source: PoMcpAgentPluginProjectionSource,\n  bytes: Uint8Array,\n  label: string,\n): Record<string, unknown> {\n  const digest = createHash('sha256').update(bytes).digest('hex');\n  if (digest !== source.contentDigest) throw new Error('content digest does not match the projection');\n  const parsed: unknown = JSON.parse(new TextDecoder('utf-8', { ignoreBOM: true }).decode(bytes));\n  if (!isObject(parsed)) throw new Error('document must be an object');\n  onlyKeys(parsed, ['$schema', 'mcpServers'], label);\n  if (parsed.$schema !== source.mcpSchemaUrl) throw new Error('$schema does not match the projected schema');\n  if (!isObject(parsed.mcpServers)) throw new Error('mcpServers must be an object');\n  return parsed.mcpServers;\n}\n\n/** Whether a declared server is skipped (empty name), dropped by the allowlist or wrapper rule, or normalised. */\nexport function serverDisposition(name: string, options: NormalizeAgentPluginMcpOptions): 'empty' | 'dropped' | 'keep' {\n  if (!name) return 'empty';\n  const allowed = options.allowedServers;\n  const keepAll = !allowed || allowed.length === 0;\n  const stripProxyWrappers = options.stripProxyWrappers ?? true;\n  if ((!keepAll && !allowed.includes(name)) || (stripProxyWrappers && PROXY_SERVER_ALIASES.has(name))) return 'dropped';\n  return 'keep';\n}\n\nexport function emptyServerDiagnostic(label: string): string {\n  return `${label} contains an empty server name; that entry was skipped.`;\n}\n\nexport function skippedServerDiagnostic(label: string, name: string, error: unknown): string {\n  return `${label} skipped server \"${name}\": ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function disabledResult(label: string, error: unknown): NormalizedAgentPluginMcpSource {\n  return emptyResult(`${label} was disabled: ${error instanceof Error ? error.message : String(error)}`);\n}\n\n/** The declared transport of one server; stdio declarations are also checked for unsupported fields. */\nexport function serverType(raw: unknown, name: string): string {\n  if (!isObject(raw)) throw new Error('definition must be an object');\n  const type = nonEmptyString(raw.type, 'type');\n  if (type === 'stdio') onlyKeys(raw, ['type', 'command', 'args', 'env', 'cwd'], `server \"${name}\"`);\n  return type;\n}\n\nexport function stdioServer(\n  name: string,\n  config: { command: string; args?: string[]; env: Record<string, string>; cwd: string },\n): NormalizedServer {\n  return {\n    internal: { name, transport: 'stdio', config },\n    claude: { type: 'stdio', ...config },\n  };\n}\n\n/** A streamable-http or sse server; any other type is unsupported. */\nexport function remoteServer(raw: JsonObject, name: string, type: string): NormalizedServer {\n  if (type === 'streamable-http' || type === 'sse') {\n    onlyKeys(raw, ['type', 'url', 'headers'], `server \"${name}\"`);\n    const url = normalizeUrl(raw.url);\n    const headers = normalizeHeaders(raw.headers);\n    const transport = type === 'streamable-http' ? 'http' : 'sse';\n    const config = { url, ...(headers ? { headers } : {}) };\n    return {\n      internal: { name, transport, config },\n      claude: { type: transport, ...config },\n    };\n  }\n  throw new Error(`unsupported transport type \"${type}\"`);\n}\n\nexport function stagedContents(internalServers: Record<string, JsonObject>): string {\n  return `${JSON.stringify({ mcpServers: internalServers }, null, 2)}\\n`;\n}\n\nexport function stagedCacheKey(source: PoMcpAgentPluginProjectionSource, configPath: string, contents: string): string {\n  return createHash('sha256')\n    .update('agent-plugin-v1\\0')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(configPath)\n    .update('\\0')\n    .update(contents)\n    .digest('hex');\n}\n\n/** The containment base and expanded path of a declared cwd, or undefined when the plugin root is the default. */\nexport function workingDirectoryCandidate(\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): { base: string; candidate: string } | undefined {\n  if (declared === undefined) return undefined;\n  const cwd = nonEmptyString(declared, 'cwd');\n  if (cwd.startsWith('./')) return { base: pluginRoot, candidate: path.resolve(pluginRoot, cwd) };\n  const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginDataDirectory);\n  if (cwd === '${PLUGIN_ROOT}' || cwd.startsWith('${PLUGIN_ROOT}/')) {\n    return { base: pluginRoot, candidate: path.resolve(expanded) };\n  }\n  if (cwd === '${PLUGIN_DATA}' || cwd.startsWith('${PLUGIN_DATA}/')) {\n    return { base: pluginDataDirectory, candidate: path.resolve(expanded) };\n  }\n  throw new Error('cwd must start with ./, ${PLUGIN_ROOT}, or ${PLUGIN_DATA}');\n}\n\n/** Rejects a command that is neither a bare executable name nor a ./ path; true when it must be resolved. */\nexport function isPluginRelativeCommand(command: string): boolean {\n  if (command.startsWith('./')) return true;\n  if (command === '.' || command === '..' || /[\\s/\\\\]/u.test(command)) {\n    throw new Error('command must be a bare executable name or a ./ path inside the plugin');\n  }\n  return false;\n}\n","import { randomUUID } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nfunction realContainedPath(root: string, candidate: string, label: string): string {\n  let realCandidate: string;\n  try {\n    realCandidate = fs.realpathSync(candidate);\n  } catch {\n    throw new Error(`${label} does not exist`);\n  }\n  if (!isInside(root, realCandidate)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return realCandidate;\n}\n\nfunction normalizeCommand(command: string, pluginRoot: string): string {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = realContainedPath(pluginRoot, path.resolve(pluginRoot, command), 'command');\n  if (!fs.statSync(resolved).isFile()) throw new Error('command must resolve to a regular file');\n  try {\n    fs.accessSync(resolved, fs.constants.X_OK);\n  } catch {\n    throw new Error('command must resolve to an executable file');\n  }\n  return resolved;\n}\n\nfunction normalizeWorkingDirectory(declared: unknown, pluginRoot: string, pluginDataDirectory: string): string {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = realContainedPath(declaredCwd.base, declaredCwd.candidate, 'cwd');\n  if (!fs.statSync(resolved).isDirectory()) throw new Error('cwd must resolve to a directory');\n  return resolved;\n}\n\nfunction normalizeServer(\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n): NormalizedServer {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = normalizeCommand(nonEmptyString(declaration.command, 'command'), pluginRoot);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = normalizeWorkingDirectory(declaration.cwd, pluginRoot, pluginDataDirectory);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\nfunction writeStagedInternalConfig(target: string, contents: string, stagingDirectory: string): void {\n  fs.mkdirSync(stagingDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n  fs.chmodSync(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  const temporaryPath = `${target}.${process.pid}-${randomUUID()}.tmp`;\n  try {\n    fs.writeFileSync(temporaryPath, contents, { flag: 'wx', mode: PRIVATE_FILE_MODE });\n    try {\n      fs.renameSync(temporaryPath, target);\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n      if (code !== 'EEXIST' && code !== 'EPERM') throw error;\n      const stat = fs.lstatSync(target);\n      if (stat.isSymbolicLink() || !stat.isFile() || fs.readFileSync(target, 'utf8') !== contents) {\n        throw new Error('content-addressed staging path is occupied by different content');\n      }\n    }\n    fs.chmodSync(target, PRIVATE_FILE_MODE);\n  } finally {\n    fs.rmSync(temporaryPath, { force: true });\n  }\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n *\n * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.\n */\nexport function normalizeAgentPluginMcpSource(\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n): NormalizedAgentPluginMcpSource {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = fs.realpathSync(source.pluginRoot);\n    try {\n      const dataStat = fs.lstatSync(source.pluginDataDirectory);\n      if (dataStat.isSymbolicLink() || !dataStat.isDirectory()) {\n        throw new Error('pluginDataDirectory must be a real directory');\n      }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      fs.mkdirSync(source.pluginDataDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n    }\n    fs.chmodSync(source.pluginDataDirectory, PRIVATE_DIRECTORY_MODE);\n    fs.accessSync(source.pluginDataDirectory, fs.constants.W_OK);\n    const pluginDataDirectory = fs.realpathSync(source.pluginDataDirectory);\n    const configPath = realContainedPath(pluginRoot, source.configPath, 'mcp.json');\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const servers = parseMcpDocument(source, fs.readFileSync(configPath), label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = normalizeServer(rawServer, pluginRoot, pluginDataDirectory, name);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    writeStagedInternalConfig(target, contents, options.stagingDirectory);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n","import path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\nimport { type FileSystem, getOrThrow, nodeHost, writeFileAtomic } from '@agimon-ai/po-core/platform';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nexport type {\n  AgentPluginMcpConfigSource,\n  NormalizeAgentPluginMcpOptions,\n  NormalizedAgentPluginMcpSource,\n} from './normalize';\nexport { normalizeAgentPluginMcpSource } from './sync';\n\ntype Context = Parameters<FileSystem['readTextFile']>[1];\n\nasync function realContainedPath(\n  fs: FileSystem,\n  root: string,\n  candidate: string,\n  label: string,\n  context: Context,\n): Promise<string> {\n  const real = await fs.canonicalPath(candidate, context);\n  if (!real.ok) throw new Error(`${label} does not exist`);\n  if (!isInside(root, real.value)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return real.value;\n}\n\nasync function normalizeCommand(\n  fs: FileSystem,\n  command: string,\n  pluginRoot: string,\n  context: Context,\n): Promise<string> {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = await realContainedPath(fs, pluginRoot, path.resolve(pluginRoot, command), 'command', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'file') {\n    throw new Error('command must resolve to a regular file');\n  }\n  // Execute bits stand in for access(X_OK); the edge has no modes, so nodeHost reports none and the check is skipped.\n  const mode = await nodeHost.fileMode(resolved);\n  if (mode !== undefined && (mode & 0o111) === 0) throw new Error('command must resolve to an executable file');\n  return resolved;\n}\n\nasync function normalizeWorkingDirectory(\n  fs: FileSystem,\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  context: Context,\n): Promise<string> {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = await realContainedPath(fs, declaredCwd.base, declaredCwd.candidate, 'cwd', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'directory') {\n    throw new Error('cwd must resolve to a directory');\n  }\n  return resolved;\n}\n\nasync function normalizeServer(\n  fs: FileSystem,\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n  context: Context,\n): Promise<NormalizedServer> {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = await normalizeCommand(fs, nonEmptyString(declaration.command, 'command'), pluginRoot, context);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = await normalizeWorkingDirectory(fs, declaration.cwd, pluginRoot, pluginDataDirectory, context);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\n/** Owner-only plugin data directory; a symbolic link or non-directory rejects the source. */\nasync function preparePluginDataDirectory(fs: FileSystem, directory: string, context: Context): Promise<string> {\n  const info = await fs.fileInfo(directory, context);\n  if (info.ok) {\n    if (info.value.kind !== 'directory') throw new Error('pluginDataDirectory must be a real directory');\n  } else if (info.error.code === 'not_found') {\n    getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n  } else {\n    throw info.error;\n  }\n  await nodeHost.setMode(directory, PRIVATE_DIRECTORY_MODE);\n  return getOrThrow(await fs.canonicalPath(directory, context));\n}\n\n/**\n * Content-addressed and owner-only. The name hashes the contents, so replacing an\n * existing staged file through a uniquely named temporary file never changes what it holds.\n */\nasync function writeStagedInternalConfig(\n  fs: FileSystem,\n  target: string,\n  contents: string,\n  stagingDirectory: string,\n  context: Context,\n): Promise<void> {\n  getOrThrow(await fs.createDir(stagingDirectory, { recursive: true }, context));\n  await nodeHost.setMode(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  await writeFileAtomic(fs, target, contents, context);\n  await nodeHost.setMode(target, PRIVATE_FILE_MODE);\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer,\n * reading and writing through the injected file system.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n */\nexport async function normalizeAgentPluginMcpSourceAsync(\n  fs: FileSystem,\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n  context: Context,\n): Promise<NormalizedAgentPluginMcpSource> {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = getOrThrow(await fs.canonicalPath(source.pluginRoot, context));\n    const pluginDataDirectory = await preparePluginDataDirectory(fs, source.pluginDataDirectory, context);\n    const configPath = await realContainedPath(fs, pluginRoot, source.configPath, 'mcp.json', context);\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const bytes = getOrThrow(await fs.readBinaryFile(configPath, context));\n    const servers = parseMcpDocument(source, bytes, label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = await normalizeServer(fs, rawServer, pluginRoot, pluginDataDirectory, name, context);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    await writeStagedInternalConfig(fs, target, contents, options.stagingDirectory, context);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,aAAa;;AAEnB,MAAM,iCAAiC;AACvC,MAAM,aAAa;AACnB,MAAM,eAAe,IAAI,OAAO,IAAI,WAAW,QAAQ,WAAW,QAAQ,GAAG;AAE7E,SAAS,OAAO,OAAwB;CACtC,OAAO,aAAa,KAAK,KAAK;AAChC;AAIA,MAAa,4CAA4B,IAAI,IAAI,CAAC,eAAe,aAAa,CAAC;AAC/E,MAAa,uCAAuB,IAAI,IAAI,CAAC,aAAa,eAAe,CAAC;AAiC1E,SAAgB,SAAS,OAAqC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAgB,SAAS,OAAmB,SAA4B,OAAqB;CAC3F,MAAM,aAAa,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC1E,IAAI,YAAY,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,WAAW,EAAE;AACvF;AAEA,SAAgB,eAAe,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAC1G,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAqC;CACvF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;CACjF,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;EACnF,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,OAAmD;CAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;CACnF,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU;EACzC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,kBAAkB;EAChF,OAAO,CAAC,KAAK,IAAI;CACnB,CAAC,CACH;AACF;AAEA,SAAgB,yBAAyB,OAAe,YAAoB,qBAAqC;CAG/G,OAAO,MAAM,QAAQ,+BAA+B,gBAClD,gBAAgB,mBAAmB,aAAa,mBAClD;AACF;AAEA,SAAgB,SAAS,MAAc,WAA4B;CACjE,MAAM,WAAW,KAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAK,KAAK,KAAK,KAAK,aAAa,QAAQ,CAAC,KAAK,WAAW,QAAQ;AACpH;AAEA,SAAgB,qBACd,OACA,YACA,qBACwB;CACxB,MAAM,WAAW,qBAAqB,OAAO,KAAK,KAAK,CAAC;CACxD,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GAAG;EACvC,MAAM,cAAc,QAAQ,aAAa,UAAU,IAAI,YAAY,IAAI;EACvE,IAAI,0BAA0B,IAAI,WAAW,GAC3C,MAAM,IAAI,MAAM,YAAY,IAAI,+BAA+B;CAEnE;CACA,OAAO;EACL,GAAG,OAAO,YACR,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAC5C,KACA,yBAAyB,MAAM,YAAY,mBAAmB,CAChE,CAAC,CACH;EACA,aAAa;EACb,aAAa;CACf;AACF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,eAAe,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAClG,IAAI,aAAa,YAAY,MAAM,aAAa,OAAO;CACvD,IAAI,OAAO,YAAY,GAAG,OAAO,aAAa,MAAM,GAAG,CAAC,CAAC,OAAO;CAChE,OAAO,iBAAiB;AAC1B;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,MAAM,eAAe,OAAO,KAAK;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,qCAAqC;CACvD;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,OAAO,YAAY,OAAO,UAAU,MAAM,IAAI,MAAM,uCAAuC;CAC/F,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,iCAAiC;CAClE,IAAI,OAAO,aAAa,WAAW,CAAC,eAAe,OAAO,QAAQ,GAChE,MAAM,IAAI,MAAM,sCAAsC;CAExD,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAAoD;CACnF,MAAM,UAAU,qBAAqB,OAAO,SAAS;CACrD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,YAAY,KAAK,YAAY;EACnC,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;EACnF,KAAK,IAAI,SAAS;EAClB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,+BAA+B,KAAK,IAAI,GACpE,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;CAEjD;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,UACA,kBACQ;CACR,MAAM,SAAS,WAAW,QAAQ,CAAC,CAChC,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,KAAK,KAAK,kBAAkB,oBAAoB,OAAO,eAAe;AAC/E;AAEA,SAAgB,YAAY,YAAoD;CAC9E,OAAO;EACL,cAAc,EAAE,YAAY,CAAC,EAAE;EAC/B,aAAa,CAAC;EACd,gBAAgB,CAAC;EACjB,aAAa,CAAC,UAAU;CAC1B;AACF;AAEA,SAAgB,YAAY,QAAkD;CAC5E,OAAO,4BAA4B,OAAO,SAAS;AACrD;;AAGA,SAAgB,uBAAuB,QAAgD;CACrF,IAAI,OAAO,iBAAiB,6BAC1B,MAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,YAAY,EAAE,EAAE;CAEvE,IAAI,CAAC,KAAK,WAAW,OAAO,UAAU,KAAK,CAAC,KAAK,WAAW,OAAO,mBAAmB,GACpF,MAAM,IAAI,MAAM,qDAAqD;AAEzE;AAEA,SAAgB,qBAAqB,YAAoB,YAA0B;CACjF,IAAI,KAAK,QAAQ,UAAU,MAAM,cAAc,KAAK,SAAS,UAAU,MAAM,YAC3E,MAAM,IAAI,MAAM,8CAA8C;AAElE;;AAGA,SAAgB,iBACd,QACA,OACA,OACyB;CAEzB,IADe,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAChD,MAAM,OAAO,eAAe,MAAM,IAAI,MAAM,8CAA8C;CACnG,MAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC9F,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B;CACnE,SAAS,QAAQ,CAAC,WAAW,YAAY,GAAG,KAAK;CACjD,IAAI,OAAO,YAAY,OAAO,cAAc,MAAM,IAAI,MAAM,6CAA6C;CACzG,IAAI,CAAC,SAAS,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAChF,OAAO,OAAO;AAChB;;AAGA,SAAgB,kBAAkB,MAAc,SAAuE;CACrH,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,CAAC,WAAW,QAAQ,WAAW;CAC/C,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,IAAK,CAAC,WAAW,CAAC,QAAQ,SAAS,IAAI,KAAO,sBAAsB,qBAAqB,IAAI,IAAI,GAAI,OAAO;CAC5G,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAuB;CAC3D,OAAO,GAAG,MAAM;AAClB;AAEA,SAAgB,wBAAwB,OAAe,MAAc,OAAwB;CAC3F,OAAO,GAAG,MAAM,mBAAmB,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpG;AAEA,SAAgB,eAAe,OAAe,OAAgD;CAC5F,OAAO,YAAY,GAAG,MAAM,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;AACvG;;AAGA,SAAgB,WAAW,KAAc,MAAsB;CAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAClE,MAAM,OAAO,eAAe,IAAI,MAAM,MAAM;CAC5C,IAAI,SAAS,SAAS,SAAS,KAAK;EAAC;EAAQ;EAAW;EAAQ;EAAO;CAAK,GAAG,WAAW,KAAK,EAAE;CACjG,OAAO;AACT;AAEA,SAAgB,YACd,MACA,QACkB;CAClB,OAAO;EACL,UAAU;GAAE;GAAM,WAAW;GAAS;EAAO;EAC7C,QAAQ;GAAE,MAAM;GAAS,GAAG;EAAO;CACrC;AACF;;AAGA,SAAgB,aAAa,KAAiB,MAAc,MAAgC;CAC1F,IAAI,SAAS,qBAAqB,SAAS,OAAO;EAChD,SAAS,KAAK;GAAC;GAAQ;GAAO;EAAS,GAAG,WAAW,KAAK,EAAE;EAC5D,MAAM,MAAM,aAAa,IAAI,GAAG;EAChC,MAAM,UAAU,iBAAiB,IAAI,OAAO;EAC5C,MAAM,YAAY,SAAS,oBAAoB,SAAS;EACxD,MAAM,SAAS;GAAE;GAAK,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAG;EACtD,OAAO;GACL,UAAU;IAAE;IAAM;IAAW;GAAO;GACpC,QAAQ;IAAE,MAAM;IAAW,GAAG;GAAO;EACvC;CACF;CACA,MAAM,IAAI,MAAM,+BAA+B,KAAK,EAAE;AACxD;AAEA,SAAgB,eAAe,iBAAqD;CAClF,OAAO,GAAG,KAAK,UAAU,EAAE,YAAY,gBAAgB,GAAG,MAAM,CAAC,EAAE;AACrE;AAEA,SAAgB,eAAe,QAA0C,YAAoB,UAA0B;CACrH,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,mBAAmB,CAAC,CAC3B,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,UAAU,CAAC,CAClB,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK;AACjB;;AAGA,SAAgB,0BACd,UACA,YACA,qBACiD;CACjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,MAAM,eAAe,UAAU,KAAK;CAC1C,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EAAE,MAAM;EAAY,WAAW,KAAK,QAAQ,YAAY,GAAG;CAAE;CAC9F,MAAM,WAAW,yBAAyB,KAAK,YAAY,mBAAmB;CAC9E,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAY,WAAW,KAAK,QAAQ,QAAQ;CAAE;CAE/D,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAqB,WAAW,KAAK,QAAQ,QAAQ;CAAE;CAExE,MAAM,IAAI,MAAM,2DAA2D;AAC7E;;AAGA,SAAgB,wBAAwB,SAA0B;CAChE,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,YAAY,OAAO,YAAY,QAAQ,WAAW,KAAK,OAAO,GAChE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;;;ACjSA,SAASA,oBAAkB,MAAc,WAAmB,OAAuB;CACjF,IAAI;CACJ,IAAI;EACF,gBAAgB,GAAG,aAAa,SAAS;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CAC3C;CACA,IAAI,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CACnG,OAAO;AACT;AAEA,SAASC,mBAAiB,SAAiB,YAA4B;CACrE,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAWD,oBAAkB,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG,SAAS;CAC3F,IAAI,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC7F,IAAI;EACF,GAAG,WAAW,UAAU,GAAG,UAAU,IAAI;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,OAAO;AACT;AAEA,SAASE,4BAA0B,UAAmB,YAAoB,qBAAqC;CAC7G,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAWF,oBAAkB,YAAY,MAAM,YAAY,WAAW,KAAK;CACjF,IAAI,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,iCAAiC;CAC3F,OAAO;AACT;AAEA,SAASG,kBACP,KACA,YACA,qBACA,MACkB;CAClB,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAUF,mBAAiB,eAAe,YAAY,SAAS,SAAS,GAAG,UAAU;CAC3F,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAMC,4BAA0B,YAAY,KAAK,YAAY,mBAAmB;CACtF,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;AAEA,SAASE,4BAA0B,QAAgB,UAAkB,kBAAgC;CACnG,GAAG,UAAU,kBAAkB;EAAE,MAAA;EAA8B,WAAW;CAAK,CAAC;CAChF,GAAG,UAAU,kBAAA,GAAwC;CACrD,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,IAAI,GAAG,WAAW,EAAE;CAC/D,IAAI;EACF,GAAG,cAAc,eAAe,UAAU;GAAE,MAAM;GAAM,MAAA;EAAwB,CAAC;EACjF,IAAI;GACF,GAAG,WAAW,eAAe,MAAM;EACrC,SAAS,OAAO;GACd,MAAM,OAAQ,MAAgC;GAC9C,IAAI,SAAS,YAAY,SAAS,SAAS,MAAM;GACjD,MAAM,OAAO,GAAG,UAAU,MAAM;GAChC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAK,GAAG,aAAa,QAAQ,MAAM,MAAM,UACjF,MAAM,IAAI,MAAM,iEAAiE;EAErF;EACA,GAAG,UAAU,QAAA,GAAyB;CACxC,UAAU;EACR,GAAG,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;CAC1C;AACF;;;;;;;;;;;AAYA,SAAgB,8BACd,QACA,SACgC;CAChC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAa,GAAG,aAAa,OAAO,UAAU;EACpD,IAAI;GACF,MAAM,WAAW,GAAG,UAAU,OAAO,mBAAmB;GACxD,IAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAElE,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAC9D,GAAG,UAAU,OAAO,qBAAqB;IAAE,MAAA;IAA8B,WAAW;GAAK,CAAC;EAC5F;EACA,GAAG,UAAU,OAAO,qBAAA,GAA2C;EAC/D,GAAG,WAAW,OAAO,qBAAqB,GAAG,UAAU,IAAI;EAC3D,MAAM,sBAAsB,GAAG,aAAa,OAAO,mBAAmB;EACtE,MAAM,aAAaJ,oBAAkB,YAAY,OAAO,YAAY,UAAU;EAC9E,qBAAqB,YAAY,UAAU;EAE3C,MAAM,UAAU,iBAAiB,QAAQ,GAAG,aAAa,UAAU,GAAG,KAAK;EAC3E,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAaG,kBAAgB,WAAW,YAAY,qBAAqB,IAAI;IACnF,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,4BAA0B,QAAQ,UAAU,QAAQ,gBAAgB;EACpE,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF;;;ACvIA,eAAe,kBACb,IACA,MACA,WACA,OACA,SACiB;CACjB,MAAM,OAAO,MAAM,GAAG,cAAc,WAAW,OAAO;CACtD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CACvD,IAAI,CAAC,SAAS,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CAChG,OAAO,KAAK;AACd;AAEA,eAAe,iBACb,IACA,SACA,YACA,SACiB;CACjB,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG,WAAW,OAAO;CAC9G,IAAI,WAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,QAC5D,MAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,OAAO,MAAM,SAAS,SAAS,QAAQ;CAC7C,IAAI,SAAS,KAAA,MAAc,OAAO,QAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5G,OAAO;AACT;AAEA,eAAe,0BACb,IACA,UACA,YACA,qBACA,SACiB;CACjB,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,MAAM,YAAY,WAAW,OAAO,OAAO;CACpG,IAAI,WAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,aAC5D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO;AACT;AAEA,eAAe,gBACb,IACA,KACA,YACA,qBACA,MACA,SAC2B;CAC3B,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAU,MAAM,iBAAiB,IAAI,eAAe,YAAY,SAAS,SAAS,GAAG,YAAY,OAAO;CAC9G,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAM,MAAM,0BAA0B,IAAI,YAAY,KAAK,YAAY,qBAAqB,OAAO;CACzG,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;;AAGA,eAAe,2BAA2B,IAAgB,WAAmB,SAAmC;CAC9G,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,OAAO;CACjD,IAAI,KAAK,IACH;MAAA,KAAK,MAAM,SAAS,aAAa,MAAM,IAAI,MAAM,8CAA8C;CAAA,OAC9F,IAAI,KAAK,MAAM,SAAS,aAC7B,WAAW,MAAM,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;MAEtE,MAAM,KAAK;CAEb,MAAM,SAAS,QAAQ,WAAA,GAAiC;CACxD,OAAO,WAAW,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC;AAC9D;;;;;AAMA,eAAe,0BACb,IACA,QACA,UACA,kBACA,SACe;CACf,WAAW,MAAM,GAAG,UAAU,kBAAkB,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;CAC7E,MAAM,SAAS,QAAQ,kBAAA,GAAwC;CAC/D,MAAM,gBAAgB,IAAI,QAAQ,UAAU,OAAO;CACnD,MAAM,SAAS,QAAQ,QAAA,GAAyB;AAClD;;;;;;;;;;AAWA,eAAsB,mCACpB,IACA,QACA,SACA,SACyC;CACzC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAa,WAAW,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,CAAC;EAChF,MAAM,sBAAsB,MAAM,2BAA2B,IAAI,OAAO,qBAAqB,OAAO;EACpG,MAAM,aAAa,MAAM,kBAAkB,IAAI,YAAY,OAAO,YAAY,YAAY,OAAO;EACjG,qBAAqB,YAAY,UAAU;EAG3C,MAAM,UAAU,iBAAiB,QADnB,WAAW,MAAM,GAAG,eAAe,YAAY,OAAO,CAC3B,GAAO,KAAK;EACrD,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAa,MAAM,gBAAgB,IAAI,WAAW,YAAY,qBAAqB,MAAM,OAAO;IACtG,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,MAAM,0BAA0B,IAAI,QAAQ,UAAU,QAAQ,kBAAkB,OAAO;EACvF,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF"}
+{"version":3,"file":"agentPluginMcp.mjs","names":["realContainedPath","normalizeCommand","normalizeWorkingDirectory","normalizeServer","writeStagedInternalConfig"],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"sourcesContent":["/** Pure Agent Plugin MCP normalisation shared by the async API and the deprecated Node-only sync shim. */\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\n\nimport { AGENT_PLUGIN_MCP_SCHEMA_URL, type PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\n/** Same token grammar as node:http `validateHeaderName` (RFC 9110 tchar). */\nconst HTTP_TOKEN = /^[\\^_`a-zA-Z\\-0-9!#$%&'*+.|~]+$/u;\n/** Same rejected characters as node:http `validateHeaderValue`. */\nconst INVALID_HEADER_VALUE_CHARACTER = /[^\\t\\x20-\\x7e\\x80-\\xff]/u;\nconst IPV4_OCTET = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]?\\\\d)';\nconst IPV4_ADDRESS = new RegExp(`^${IPV4_OCTET}(?:\\\\.${IPV4_OCTET}){3}$`, 'u');\n\nfunction isIPv4(value: string): boolean {\n  return IPV4_ADDRESS.test(value);\n}\n\nexport const PRIVATE_FILE_MODE = 0o600;\nexport const PRIVATE_DIRECTORY_MODE = 0o700;\nexport const RESERVED_ENVIRONMENT_KEYS = new Set(['PLUGIN_ROOT', 'PLUGIN_DATA']);\nexport const PROXY_SERVER_ALIASES = new Set(['mcp-proxy', 'agiflow-proxy']);\n\nexport type JsonObject = Record<string, unknown>;\n\nexport interface AgentPluginMcpConfigSource {\n  path: string;\n  format: 'internal';\n  cacheKey: string;\n}\n\nexport interface NormalizedAgentPluginMcpSource {\n  /** Owner-only, content-addressed layer that bypasses Claude env interpolation. */\n  configSource?: AgentPluginMcpConfigSource;\n  /** Claude-compatible definitions for an external merged config. */\n  claudeConfig: { mcpServers: Record<string, JsonObject> };\n  serverNames: string[];\n  droppedServers: string[];\n  diagnostics: string[];\n}\n\nexport interface NormalizeAgentPluginMcpOptions {\n  stagingDirectory: string;\n  /** Empty and absent lists both mean keep every server. */\n  allowedServers?: readonly string[];\n  /** Po strips nested wrappers; external-only callers may opt out. */\n  stripProxyWrappers?: boolean;\n}\n\nexport interface NormalizedServer {\n  internal: JsonObject;\n  claude: JsonObject;\n}\n\nexport function isObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function onlyKeys(value: JsonObject, allowed: readonly string[], label: string): void {\n  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));\n  if (unexpected) throw new Error(`${label} contains unsupported field \"${unexpected}\"`);\n}\n\nexport function nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nexport function optionalStringArray(value: unknown, label: string): string[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error(`${label} must be an array of strings`);\n  return value.map((item, index) => {\n    if (typeof item !== 'string') throw new Error(`${label}[${index}] must be a string`);\n    return item;\n  });\n}\n\nfunction optionalStringRecord(value: unknown, label: string): Record<string, string> | undefined {\n  if (value === undefined) return undefined;\n  if (!isObject(value)) throw new Error(`${label} must be an object of string values`);\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => {\n      if (typeof item !== 'string') throw new Error(`${label}.${key} must be a string`);\n      return [key, item];\n    }),\n  );\n}\n\nexport function expandPluginPlaceholders(value: string, pluginRoot: string, pluginDataDirectory: string): string {\n  // The portable contract is a single, non-recursive replacement pass. An\n  // unrecognised placeholder remains literal and mcp-proxy must not reinterpret it.\n  return value.replace(/\\$\\{PLUGIN_(ROOT|DATA)\\}/gu, (placeholder) =>\n    placeholder === '${PLUGIN_ROOT}' ? pluginRoot : pluginDataDirectory,\n  );\n}\n\nexport function isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));\n}\n\nexport function normalizeEnvironment(\n  value: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): Record<string, string> {\n  const declared = optionalStringRecord(value, 'env') ?? {};\n  for (const key of Object.keys(declared)) {\n    const reservedKey = process.platform === 'win32' ? key.toUpperCase() : key;\n    if (RESERVED_ENVIRONMENT_KEYS.has(reservedKey)) {\n      throw new Error(`env key \"${key}\" is reserved by Agent Plugins`);\n    }\n  }\n  return {\n    ...Object.fromEntries(\n      Object.entries(declared).map(([key, item]) => [\n        key,\n        expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n      ]),\n    ),\n    PLUGIN_ROOT: pluginRoot,\n    PLUGIN_DATA: pluginDataDirectory,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const bareHostname = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (bareHostname.toLowerCase() === 'localhost') return true;\n  if (isIPv4(bareHostname)) return bareHostname.split('.')[0] === '127';\n  return bareHostname === '::1';\n}\n\nexport function normalizeUrl(value: unknown): string {\n  const raw = nonEmptyString(value, 'url');\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('url must be an absolute HTTP(S) URL');\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error('url must use http or https');\n  }\n  if (parsed.username || parsed.password) throw new Error('url must not contain user information');\n  if (parsed.hash) throw new Error('url must not contain a fragment');\n  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {\n    throw new Error('non-loopback MCP URLs must use https');\n  }\n  return raw;\n}\n\nexport function normalizeHeaders(value: unknown): Record<string, string> | undefined {\n  const headers = optionalStringRecord(value, 'headers');\n  if (!headers) return undefined;\n  const seen = new Set<string>();\n  for (const [name, item] of Object.entries(headers)) {\n    const canonical = name.toLowerCase();\n    if (seen.has(canonical)) throw new Error(`headers contain duplicate name \"${name}\"`);\n    seen.add(canonical);\n    if (!HTTP_TOKEN.test(name) || INVALID_HEADER_VALUE_CHARACTER.test(item)) {\n      throw new Error(`header \"${name}\" is invalid`);\n    }\n  }\n  return headers;\n}\n\nexport function stagedInternalPath(\n  source: PoMcpAgentPluginProjectionSource,\n  contents: string,\n  stagingDirectory: string,\n): string {\n  const digest = createHash('sha256')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(contents)\n    .digest('hex')\n    .slice(0, 20);\n  return path.join(stagingDirectory, `agent-plugin-mcp-${digest}.internal.json`);\n}\n\nexport function emptyResult(diagnostic: string): NormalizedAgentPluginMcpSource {\n  return {\n    claudeConfig: { mcpServers: {} },\n    serverNames: [],\n    droppedServers: [],\n    diagnostics: [diagnostic],\n  };\n}\n\nexport function sourceLabel(source: PoMcpAgentPluginProjectionSource): string {\n  return `Agent Plugin MCP source \"${source.sourceId}\"`;\n}\n\n/** Checks the projection identity before any file is touched. */\nexport function assertProjectionSource(source: PoMcpAgentPluginProjectionSource): void {\n  if (source.mcpSchemaUrl !== AGENT_PLUGIN_MCP_SCHEMA_URL) {\n    throw new Error(`unsupported schema \"${String(source.mcpSchemaUrl)}\"`);\n  }\n  if (!path.isAbsolute(source.pluginRoot) || !path.isAbsolute(source.pluginDataDirectory)) {\n    throw new Error('pluginRoot and pluginDataDirectory must be absolute');\n  }\n}\n\nexport function assertRootConfigPath(configPath: string, pluginRoot: string): void {\n  if (path.dirname(configPath) !== pluginRoot || path.basename(configPath) !== 'mcp.json') {\n    throw new Error('portable plugin config must be root mcp.json');\n  }\n}\n\n/** Verifies the digest and document shape of the raw mcp.json bytes; returns its server map. */\nexport function parseMcpDocument(\n  source: PoMcpAgentPluginProjectionSource,\n  bytes: Uint8Array,\n  label: string,\n): Record<string, unknown> {\n  const digest = createHash('sha256').update(bytes).digest('hex');\n  if (digest !== source.contentDigest) throw new Error('content digest does not match the projection');\n  const parsed: unknown = JSON.parse(new TextDecoder('utf-8', { ignoreBOM: true }).decode(bytes));\n  if (!isObject(parsed)) throw new Error('document must be an object');\n  onlyKeys(parsed, ['$schema', 'mcpServers'], label);\n  if (parsed.$schema !== source.mcpSchemaUrl) throw new Error('$schema does not match the projected schema');\n  if (!isObject(parsed.mcpServers)) throw new Error('mcpServers must be an object');\n  return parsed.mcpServers;\n}\n\n/** Whether a declared server is skipped (empty name), dropped by the allowlist or wrapper rule, or normalised. */\nexport function serverDisposition(name: string, options: NormalizeAgentPluginMcpOptions): 'empty' | 'dropped' | 'keep' {\n  if (!name) return 'empty';\n  const allowed = options.allowedServers;\n  const keepAll = !allowed || allowed.length === 0;\n  const stripProxyWrappers = options.stripProxyWrappers ?? true;\n  if ((!keepAll && !allowed.includes(name)) || (stripProxyWrappers && PROXY_SERVER_ALIASES.has(name))) return 'dropped';\n  return 'keep';\n}\n\nexport function emptyServerDiagnostic(label: string): string {\n  return `${label} contains an empty server name; that entry was skipped.`;\n}\n\nexport function skippedServerDiagnostic(label: string, name: string, error: unknown): string {\n  return `${label} skipped server \"${name}\": ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function disabledResult(label: string, error: unknown): NormalizedAgentPluginMcpSource {\n  return emptyResult(`${label} was disabled: ${error instanceof Error ? error.message : String(error)}`);\n}\n\n/** The declared transport of one server; stdio declarations are also checked for unsupported fields. */\nexport function serverType(raw: unknown, name: string): string {\n  if (!isObject(raw)) throw new Error('definition must be an object');\n  const type = nonEmptyString(raw.type, 'type');\n  if (type === 'stdio') onlyKeys(raw, ['type', 'command', 'args', 'env', 'cwd'], `server \"${name}\"`);\n  return type;\n}\n\nexport function stdioServer(\n  name: string,\n  config: { command: string; args?: string[]; env: Record<string, string>; cwd: string },\n): NormalizedServer {\n  return {\n    internal: { name, transport: 'stdio', config },\n    claude: { type: 'stdio', ...config },\n  };\n}\n\n/** A streamable-http or sse server; any other type is unsupported. */\nexport function remoteServer(raw: JsonObject, name: string, type: string): NormalizedServer {\n  if (type === 'streamable-http' || type === 'sse') {\n    onlyKeys(raw, ['type', 'url', 'headers'], `server \"${name}\"`);\n    const url = normalizeUrl(raw.url);\n    const headers = normalizeHeaders(raw.headers);\n    const transport = type === 'streamable-http' ? 'http' : 'sse';\n    const config = { url, ...(headers ? { headers } : {}) };\n    return {\n      internal: { name, transport, config },\n      claude: { type: transport, ...config },\n    };\n  }\n  throw new Error(`unsupported transport type \"${type}\"`);\n}\n\nexport function stagedContents(internalServers: Record<string, JsonObject>): string {\n  return `${JSON.stringify({ mcpServers: internalServers }, null, 2)}\\n`;\n}\n\nexport function stagedCacheKey(source: PoMcpAgentPluginProjectionSource, configPath: string, contents: string): string {\n  return createHash('sha256')\n    .update('agent-plugin-v1\\0')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(configPath)\n    .update('\\0')\n    .update(contents)\n    .digest('hex');\n}\n\n/** The containment base and expanded path of a declared cwd, or undefined when the plugin root is the default. */\nexport function workingDirectoryCandidate(\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): { base: string; candidate: string } | undefined {\n  if (declared === undefined) return undefined;\n  const cwd = nonEmptyString(declared, 'cwd');\n  if (cwd.startsWith('./')) return { base: pluginRoot, candidate: path.resolve(pluginRoot, cwd) };\n  const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginDataDirectory);\n  if (cwd === '${PLUGIN_ROOT}' || cwd.startsWith('${PLUGIN_ROOT}/')) {\n    return { base: pluginRoot, candidate: path.resolve(expanded) };\n  }\n  if (cwd === '${PLUGIN_DATA}' || cwd.startsWith('${PLUGIN_DATA}/')) {\n    return { base: pluginDataDirectory, candidate: path.resolve(expanded) };\n  }\n  throw new Error('cwd must start with ./, ${PLUGIN_ROOT}, or ${PLUGIN_DATA}');\n}\n\n/** Rejects a command that is neither a bare executable name nor a ./ path; true when it must be resolved. */\nexport function isPluginRelativeCommand(command: string): boolean {\n  if (command.startsWith('./')) return true;\n  if (command === '.' || command === '..' || /[\\s/\\\\]/u.test(command)) {\n    throw new Error('command must be a bare executable name or a ./ path inside the plugin');\n  }\n  return false;\n}\n","import { createHash, randomUUID } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport {\n  AGENT_PLUGIN_MCP_SCHEMA_URL,\n  type PoMcpAgentPluginProjectionSource,\n  type PoMcpProjectionSource,\n} from '@agimon-ai/po-core/mcpProjection';\n\nimport type { PluginEntry } from '../../types/domains';\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nfunction realContainedPath(root: string, candidate: string, label: string): string {\n  let realCandidate: string;\n  try {\n    realCandidate = fs.realpathSync(candidate);\n  } catch {\n    throw new Error(`${label} does not exist`);\n  }\n  if (!isInside(root, realCandidate)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return realCandidate;\n}\n\nfunction normalizeCommand(command: string, pluginRoot: string): string {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = realContainedPath(pluginRoot, path.resolve(pluginRoot, command), 'command');\n  if (!fs.statSync(resolved).isFile()) throw new Error('command must resolve to a regular file');\n  try {\n    fs.accessSync(resolved, fs.constants.X_OK);\n  } catch {\n    throw new Error('command must resolve to an executable file');\n  }\n  return resolved;\n}\n\nfunction normalizeWorkingDirectory(declared: unknown, pluginRoot: string, pluginDataDirectory: string): string {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = realContainedPath(declaredCwd.base, declaredCwd.candidate, 'cwd');\n  if (!fs.statSync(resolved).isDirectory()) throw new Error('cwd must resolve to a directory');\n  return resolved;\n}\n\nfunction normalizeServer(\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n): NormalizedServer {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = normalizeCommand(nonEmptyString(declaration.command, 'command'), pluginRoot);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = normalizeWorkingDirectory(declaration.cwd, pluginRoot, pluginDataDirectory);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\nfunction writeStagedInternalConfig(target: string, contents: string, stagingDirectory: string): void {\n  fs.mkdirSync(stagingDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n  fs.chmodSync(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  const temporaryPath = `${target}.${process.pid}-${randomUUID()}.tmp`;\n  try {\n    fs.writeFileSync(temporaryPath, contents, { flag: 'wx', mode: PRIVATE_FILE_MODE });\n    try {\n      fs.renameSync(temporaryPath, target);\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n      if (code !== 'EEXIST' && code !== 'EPERM') throw error;\n      const stat = fs.lstatSync(target);\n      if (stat.isSymbolicLink() || !stat.isFile() || fs.readFileSync(target, 'utf8') !== contents) {\n        throw new Error('content-addressed staging path is occupied by different content');\n      }\n    }\n    fs.chmodSync(target, PRIVATE_FILE_MODE);\n  } finally {\n    fs.rmSync(temporaryPath, { force: true });\n  }\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n *\n * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.\n */\nexport function normalizeAgentPluginMcpSource(\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n): NormalizedAgentPluginMcpSource {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = fs.realpathSync(source.pluginRoot);\n    try {\n      const dataStat = fs.lstatSync(source.pluginDataDirectory);\n      if (dataStat.isSymbolicLink() || !dataStat.isDirectory()) {\n        throw new Error('pluginDataDirectory must be a real directory');\n      }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      fs.mkdirSync(source.pluginDataDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n    }\n    fs.chmodSync(source.pluginDataDirectory, PRIVATE_DIRECTORY_MODE);\n    fs.accessSync(source.pluginDataDirectory, fs.constants.W_OK);\n    const pluginDataDirectory = fs.realpathSync(source.pluginDataDirectory);\n    const configPath = realContainedPath(pluginRoot, source.configPath, 'mcp.json');\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const servers = parseMcpDocument(source, fs.readFileSync(configPath), label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = normalizeServer(rawServer, pluginRoot, pluginDataDirectory, name);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    writeStagedInternalConfig(target, contents, options.stagingDirectory);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n\nconst AGENT_PLUGIN_SCHEMA = 'https://agent-plugins.org/schemas/1.0.0/plugin.schema.json';\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction stablePluginIdentity(entry: PluginEntry): string {\n  const source = entry.source;\n  const identity =\n    source?.type === 'git'\n      ? ['git', source.url, source.path ?? '']\n      : source?.type === 'npm'\n        ? ['npm', source.registry ?? '', source.package]\n        : ['local', fs.realpathSync(entry.directory)];\n  return createHash('sha256').update(JSON.stringify(identity)).digest('hex');\n}\n\nfunction rootAgentPluginSchema(entry: PluginEntry): string | undefined {\n  const manifestPath = path.join(entry.directory, 'plugin.json');\n  if (entry.manifest?.path === manifestPath && entry.manifest.agentPluginSchema === AGENT_PLUGIN_SCHEMA) {\n    return AGENT_PLUGIN_SCHEMA;\n  }\n  try {\n    const stat = fs.lstatSync(manifestPath);\n    if (stat.isSymbolicLink() || !stat.isFile()) return undefined;\n    const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8')) as unknown;\n    return isPlainObject(parsed) && parsed.$schema === AGENT_PLUGIN_SCHEMA ? AGENT_PLUGIN_SCHEMA : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** One plugin's MCP config as a projection source, or nothing when it ships none. Shared by sync and settings. */\nexport async function pluginMcpSource(\n  entry: PluginEntry,\n  pluginDataRoot: string,\n): Promise<PoMcpProjectionSource | undefined> {\n  if (entry.mcp === false) return undefined;\n  const pluginRoot = fs.realpathSync(entry.directory);\n  const agentPlugin = rootAgentPluginSchema(entry) === AGENT_PLUGIN_SCHEMA;\n  const configPath = path.join(pluginRoot, agentPlugin ? 'mcp.json' : '.mcp.json');\n  let stat: fs.Stats;\n  try {\n    stat = await fs.promises.lstat(configPath);\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;\n    throw error;\n  }\n  if (!stat.isFile() || stat.isSymbolicLink()) return undefined;\n  const content = await fs.promises.readFile(configPath);\n  const contentDigest = createHash('sha256').update(content).digest('hex');\n  const pluginId = stablePluginIdentity(entry);\n  const sourceId = `plugin:${pluginId}`;\n  if (!agentPlugin) return { sourceId, owner: 'plugin', format: 'native', configPath, contentDigest };\n  return {\n    sourceId,\n    owner: 'plugin',\n    format: 'agent-plugin-v1',\n    configPath,\n    contentDigest,\n    pluginId,\n    pluginRoot,\n    pluginDataDirectory: path.join(pluginDataRoot, pluginId),\n    mcpSchemaUrl: AGENT_PLUGIN_MCP_SCHEMA_URL,\n  };\n}\n","import path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\nimport { type FileSystem, getOrThrow, nodeHost, writeFileAtomic } from '@agimon-ai/po-core/platform';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nexport type {\n  AgentPluginMcpConfigSource,\n  NormalizeAgentPluginMcpOptions,\n  NormalizedAgentPluginMcpSource,\n} from './normalize';\nexport { normalizeAgentPluginMcpSource, pluginMcpSource } from './sync';\n\ntype Context = Parameters<FileSystem['readTextFile']>[1];\n\nasync function realContainedPath(\n  fs: FileSystem,\n  root: string,\n  candidate: string,\n  label: string,\n  context: Context,\n): Promise<string> {\n  const real = await fs.canonicalPath(candidate, context);\n  if (!real.ok) throw new Error(`${label} does not exist`);\n  if (!isInside(root, real.value)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return real.value;\n}\n\nasync function normalizeCommand(\n  fs: FileSystem,\n  command: string,\n  pluginRoot: string,\n  context: Context,\n): Promise<string> {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = await realContainedPath(fs, pluginRoot, path.resolve(pluginRoot, command), 'command', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'file') {\n    throw new Error('command must resolve to a regular file');\n  }\n  // Execute bits stand in for access(X_OK); the edge has no modes, so nodeHost reports none and the check is skipped.\n  const mode = await nodeHost.fileMode(resolved);\n  if (mode !== undefined && (mode & 0o111) === 0) throw new Error('command must resolve to an executable file');\n  return resolved;\n}\n\nasync function normalizeWorkingDirectory(\n  fs: FileSystem,\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  context: Context,\n): Promise<string> {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = await realContainedPath(fs, declaredCwd.base, declaredCwd.candidate, 'cwd', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'directory') {\n    throw new Error('cwd must resolve to a directory');\n  }\n  return resolved;\n}\n\nasync function normalizeServer(\n  fs: FileSystem,\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n  context: Context,\n): Promise<NormalizedServer> {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = await normalizeCommand(fs, nonEmptyString(declaration.command, 'command'), pluginRoot, context);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = await normalizeWorkingDirectory(fs, declaration.cwd, pluginRoot, pluginDataDirectory, context);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\n/** Owner-only plugin data directory; a symbolic link or non-directory rejects the source. */\nasync function preparePluginDataDirectory(fs: FileSystem, directory: string, context: Context): Promise<string> {\n  const info = await fs.fileInfo(directory, context);\n  if (info.ok) {\n    if (info.value.kind !== 'directory') throw new Error('pluginDataDirectory must be a real directory');\n  } else if (info.error.code === 'not_found') {\n    getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n  } else {\n    throw info.error;\n  }\n  await nodeHost.setMode(directory, PRIVATE_DIRECTORY_MODE);\n  return getOrThrow(await fs.canonicalPath(directory, context));\n}\n\n/**\n * Content-addressed and owner-only. The name hashes the contents, so replacing an\n * existing staged file through a uniquely named temporary file never changes what it holds.\n */\nasync function writeStagedInternalConfig(\n  fs: FileSystem,\n  target: string,\n  contents: string,\n  stagingDirectory: string,\n  context: Context,\n): Promise<void> {\n  getOrThrow(await fs.createDir(stagingDirectory, { recursive: true }, context));\n  await nodeHost.setMode(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  await writeFileAtomic(fs, target, contents, context);\n  await nodeHost.setMode(target, PRIVATE_FILE_MODE);\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer,\n * reading and writing through the injected file system.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n */\nexport async function normalizeAgentPluginMcpSourceAsync(\n  fs: FileSystem,\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n  context: Context,\n): Promise<NormalizedAgentPluginMcpSource> {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = getOrThrow(await fs.canonicalPath(source.pluginRoot, context));\n    const pluginDataDirectory = await preparePluginDataDirectory(fs, source.pluginDataDirectory, context);\n    const configPath = await realContainedPath(fs, pluginRoot, source.configPath, 'mcp.json', context);\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const bytes = getOrThrow(await fs.readBinaryFile(configPath, context));\n    const servers = parseMcpDocument(source, bytes, label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = await normalizeServer(fs, rawServer, pluginRoot, pluginDataDirectory, name, context);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    await writeStagedInternalConfig(fs, target, contents, options.stagingDirectory, context);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,aAAa;;AAEnB,MAAM,iCAAiC;AACvC,MAAM,aAAa;AACnB,MAAM,eAAe,IAAI,OAAO,IAAI,WAAW,QAAQ,WAAW,QAAQ,GAAG;AAE7E,SAAS,OAAO,OAAwB;CACtC,OAAO,aAAa,KAAK,KAAK;AAChC;AAIA,MAAa,4CAA4B,IAAI,IAAI,CAAC,eAAe,aAAa,CAAC;AAC/E,MAAa,uCAAuB,IAAI,IAAI,CAAC,aAAa,eAAe,CAAC;AAiC1E,SAAgB,SAAS,OAAqC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAgB,SAAS,OAAmB,SAA4B,OAAqB;CAC3F,MAAM,aAAa,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC1E,IAAI,YAAY,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,WAAW,EAAE;AACvF;AAEA,SAAgB,eAAe,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAC1G,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAqC;CACvF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;CACjF,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;EACnF,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,OAAmD;CAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;CACnF,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU;EACzC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,kBAAkB;EAChF,OAAO,CAAC,KAAK,IAAI;CACnB,CAAC,CACH;AACF;AAEA,SAAgB,yBAAyB,OAAe,YAAoB,qBAAqC;CAG/G,OAAO,MAAM,QAAQ,+BAA+B,gBAClD,gBAAgB,mBAAmB,aAAa,mBAClD;AACF;AAEA,SAAgB,SAAS,MAAc,WAA4B;CACjE,MAAM,WAAW,KAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAK,KAAK,KAAK,KAAK,aAAa,QAAQ,CAAC,KAAK,WAAW,QAAQ;AACpH;AAEA,SAAgB,qBACd,OACA,YACA,qBACwB;CACxB,MAAM,WAAW,qBAAqB,OAAO,KAAK,KAAK,CAAC;CACxD,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GAAG;EACvC,MAAM,cAAc,QAAQ,aAAa,UAAU,IAAI,YAAY,IAAI;EACvE,IAAI,0BAA0B,IAAI,WAAW,GAC3C,MAAM,IAAI,MAAM,YAAY,IAAI,+BAA+B;CAEnE;CACA,OAAO;EACL,GAAG,OAAO,YACR,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAC5C,KACA,yBAAyB,MAAM,YAAY,mBAAmB,CAChE,CAAC,CACH;EACA,aAAa;EACb,aAAa;CACf;AACF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,eAAe,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAClG,IAAI,aAAa,YAAY,MAAM,aAAa,OAAO;CACvD,IAAI,OAAO,YAAY,GAAG,OAAO,aAAa,MAAM,GAAG,CAAC,CAAC,OAAO;CAChE,OAAO,iBAAiB;AAC1B;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,MAAM,eAAe,OAAO,KAAK;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,qCAAqC;CACvD;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,OAAO,YAAY,OAAO,UAAU,MAAM,IAAI,MAAM,uCAAuC;CAC/F,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,iCAAiC;CAClE,IAAI,OAAO,aAAa,WAAW,CAAC,eAAe,OAAO,QAAQ,GAChE,MAAM,IAAI,MAAM,sCAAsC;CAExD,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAAoD;CACnF,MAAM,UAAU,qBAAqB,OAAO,SAAS;CACrD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,YAAY,KAAK,YAAY;EACnC,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;EACnF,KAAK,IAAI,SAAS;EAClB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,+BAA+B,KAAK,IAAI,GACpE,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;CAEjD;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,UACA,kBACQ;CACR,MAAM,SAAS,WAAW,QAAQ,CAAC,CAChC,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,KAAK,KAAK,kBAAkB,oBAAoB,OAAO,eAAe;AAC/E;AAEA,SAAgB,YAAY,YAAoD;CAC9E,OAAO;EACL,cAAc,EAAE,YAAY,CAAC,EAAE;EAC/B,aAAa,CAAC;EACd,gBAAgB,CAAC;EACjB,aAAa,CAAC,UAAU;CAC1B;AACF;AAEA,SAAgB,YAAY,QAAkD;CAC5E,OAAO,4BAA4B,OAAO,SAAS;AACrD;;AAGA,SAAgB,uBAAuB,QAAgD;CACrF,IAAI,OAAO,iBAAiB,6BAC1B,MAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,YAAY,EAAE,EAAE;CAEvE,IAAI,CAAC,KAAK,WAAW,OAAO,UAAU,KAAK,CAAC,KAAK,WAAW,OAAO,mBAAmB,GACpF,MAAM,IAAI,MAAM,qDAAqD;AAEzE;AAEA,SAAgB,qBAAqB,YAAoB,YAA0B;CACjF,IAAI,KAAK,QAAQ,UAAU,MAAM,cAAc,KAAK,SAAS,UAAU,MAAM,YAC3E,MAAM,IAAI,MAAM,8CAA8C;AAElE;;AAGA,SAAgB,iBACd,QACA,OACA,OACyB;CAEzB,IADe,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAChD,MAAM,OAAO,eAAe,MAAM,IAAI,MAAM,8CAA8C;CACnG,MAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC9F,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B;CACnE,SAAS,QAAQ,CAAC,WAAW,YAAY,GAAG,KAAK;CACjD,IAAI,OAAO,YAAY,OAAO,cAAc,MAAM,IAAI,MAAM,6CAA6C;CACzG,IAAI,CAAC,SAAS,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAChF,OAAO,OAAO;AAChB;;AAGA,SAAgB,kBAAkB,MAAc,SAAuE;CACrH,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,CAAC,WAAW,QAAQ,WAAW;CAC/C,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,IAAK,CAAC,WAAW,CAAC,QAAQ,SAAS,IAAI,KAAO,sBAAsB,qBAAqB,IAAI,IAAI,GAAI,OAAO;CAC5G,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAuB;CAC3D,OAAO,GAAG,MAAM;AAClB;AAEA,SAAgB,wBAAwB,OAAe,MAAc,OAAwB;CAC3F,OAAO,GAAG,MAAM,mBAAmB,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpG;AAEA,SAAgB,eAAe,OAAe,OAAgD;CAC5F,OAAO,YAAY,GAAG,MAAM,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;AACvG;;AAGA,SAAgB,WAAW,KAAc,MAAsB;CAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAClE,MAAM,OAAO,eAAe,IAAI,MAAM,MAAM;CAC5C,IAAI,SAAS,SAAS,SAAS,KAAK;EAAC;EAAQ;EAAW;EAAQ;EAAO;CAAK,GAAG,WAAW,KAAK,EAAE;CACjG,OAAO;AACT;AAEA,SAAgB,YACd,MACA,QACkB;CAClB,OAAO;EACL,UAAU;GAAE;GAAM,WAAW;GAAS;EAAO;EAC7C,QAAQ;GAAE,MAAM;GAAS,GAAG;EAAO;CACrC;AACF;;AAGA,SAAgB,aAAa,KAAiB,MAAc,MAAgC;CAC1F,IAAI,SAAS,qBAAqB,SAAS,OAAO;EAChD,SAAS,KAAK;GAAC;GAAQ;GAAO;EAAS,GAAG,WAAW,KAAK,EAAE;EAC5D,MAAM,MAAM,aAAa,IAAI,GAAG;EAChC,MAAM,UAAU,iBAAiB,IAAI,OAAO;EAC5C,MAAM,YAAY,SAAS,oBAAoB,SAAS;EACxD,MAAM,SAAS;GAAE;GAAK,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAG;EACtD,OAAO;GACL,UAAU;IAAE;IAAM;IAAW;GAAO;GACpC,QAAQ;IAAE,MAAM;IAAW,GAAG;GAAO;EACvC;CACF;CACA,MAAM,IAAI,MAAM,+BAA+B,KAAK,EAAE;AACxD;AAEA,SAAgB,eAAe,iBAAqD;CAClF,OAAO,GAAG,KAAK,UAAU,EAAE,YAAY,gBAAgB,GAAG,MAAM,CAAC,EAAE;AACrE;AAEA,SAAgB,eAAe,QAA0C,YAAoB,UAA0B;CACrH,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,mBAAmB,CAAC,CAC3B,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,UAAU,CAAC,CAClB,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK;AACjB;;AAGA,SAAgB,0BACd,UACA,YACA,qBACiD;CACjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,MAAM,eAAe,UAAU,KAAK;CAC1C,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EAAE,MAAM;EAAY,WAAW,KAAK,QAAQ,YAAY,GAAG;CAAE;CAC9F,MAAM,WAAW,yBAAyB,KAAK,YAAY,mBAAmB;CAC9E,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAY,WAAW,KAAK,QAAQ,QAAQ;CAAE;CAE/D,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAqB,WAAW,KAAK,QAAQ,QAAQ;CAAE;CAExE,MAAM,IAAI,MAAM,2DAA2D;AAC7E;;AAGA,SAAgB,wBAAwB,SAA0B;CAChE,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,YAAY,OAAO,YAAY,QAAQ,WAAW,KAAK,OAAO,GAChE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;;;AC5RA,SAASA,oBAAkB,MAAc,WAAmB,OAAuB;CACjF,IAAI;CACJ,IAAI;EACF,gBAAgB,GAAG,aAAa,SAAS;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CAC3C;CACA,IAAI,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CACnG,OAAO;AACT;AAEA,SAASC,mBAAiB,SAAiB,YAA4B;CACrE,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAWD,oBAAkB,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG,SAAS;CAC3F,IAAI,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC7F,IAAI;EACF,GAAG,WAAW,UAAU,GAAG,UAAU,IAAI;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,OAAO;AACT;AAEA,SAASE,4BAA0B,UAAmB,YAAoB,qBAAqC;CAC7G,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAWF,oBAAkB,YAAY,MAAM,YAAY,WAAW,KAAK;CACjF,IAAI,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,iCAAiC;CAC3F,OAAO;AACT;AAEA,SAASG,kBACP,KACA,YACA,qBACA,MACkB;CAClB,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAUF,mBAAiB,eAAe,YAAY,SAAS,SAAS,GAAG,UAAU;CAC3F,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAMC,4BAA0B,YAAY,KAAK,YAAY,mBAAmB;CACtF,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;AAEA,SAASE,4BAA0B,QAAgB,UAAkB,kBAAgC;CACnG,GAAG,UAAU,kBAAkB;EAAE,MAAA;EAA8B,WAAW;CAAK,CAAC;CAChF,GAAG,UAAU,kBAAA,GAAwC;CACrD,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,IAAI,GAAG,WAAW,EAAE;CAC/D,IAAI;EACF,GAAG,cAAc,eAAe,UAAU;GAAE,MAAM;GAAM,MAAA;EAAwB,CAAC;EACjF,IAAI;GACF,GAAG,WAAW,eAAe,MAAM;EACrC,SAAS,OAAO;GACd,MAAM,OAAQ,MAAgC;GAC9C,IAAI,SAAS,YAAY,SAAS,SAAS,MAAM;GACjD,MAAM,OAAO,GAAG,UAAU,MAAM;GAChC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAK,GAAG,aAAa,QAAQ,MAAM,MAAM,UACjF,MAAM,IAAI,MAAM,iEAAiE;EAErF;EACA,GAAG,UAAU,QAAA,GAAyB;CACxC,UAAU;EACR,GAAG,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;CAC1C;AACF;;;;;;;;;;;AAYA,SAAgB,8BACd,QACA,SACgC;CAChC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAa,GAAG,aAAa,OAAO,UAAU;EACpD,IAAI;GACF,MAAM,WAAW,GAAG,UAAU,OAAO,mBAAmB;GACxD,IAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAElE,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAC9D,GAAG,UAAU,OAAO,qBAAqB;IAAE,MAAA;IAA8B,WAAW;GAAK,CAAC;EAC5F;EACA,GAAG,UAAU,OAAO,qBAAA,GAA2C;EAC/D,GAAG,WAAW,OAAO,qBAAqB,GAAG,UAAU,IAAI;EAC3D,MAAM,sBAAsB,GAAG,aAAa,OAAO,mBAAmB;EACtE,MAAM,aAAaJ,oBAAkB,YAAY,OAAO,YAAY,UAAU;EAC9E,qBAAqB,YAAY,UAAU;EAE3C,MAAM,UAAU,iBAAiB,QAAQ,GAAG,aAAa,UAAU,GAAG,KAAK;EAC3E,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAaG,kBAAgB,WAAW,YAAY,qBAAqB,IAAI;IACnF,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,4BAA0B,QAAQ,UAAU,QAAQ,gBAAgB;EACpE,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF;AAEA,MAAM,sBAAsB;AAE5B,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,qBAAqB,OAA4B;CACxD,MAAM,SAAS,MAAM;CACrB,MAAM,WACJ,QAAQ,SAAS,QACb;EAAC;EAAO,OAAO;EAAK,OAAO,QAAQ;CAAE,IACrC,QAAQ,SAAS,QACf;EAAC;EAAO,OAAO,YAAY;EAAI,OAAO;CAAO,IAC7C,CAAC,SAAS,GAAG,aAAa,MAAM,SAAS,CAAC;CAClD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK;AAC3E;AAEA,SAAS,sBAAsB,OAAwC;CACrE,MAAM,eAAe,KAAK,KAAK,MAAM,WAAW,aAAa;CAC7D,IAAI,MAAM,UAAU,SAAS,gBAAgB,MAAM,SAAS,sBAAsB,qBAChF,OAAO;CAET,IAAI;EACF,MAAM,OAAO,GAAG,UAAU,YAAY;EACtC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,GAAG,OAAO,KAAA;EACpD,MAAM,SAAS,KAAK,MAAM,GAAG,aAAa,cAAc,MAAM,CAAC;EAC/D,OAAO,cAAc,MAAM,KAAK,OAAO,YAAY,sBAAsB,sBAAsB,KAAA;CACjG,QAAQ;EACN;CACF;AACF;;AAGA,eAAsB,gBACpB,OACA,gBAC4C;CAC5C,IAAI,MAAM,QAAQ,OAAO,OAAO,KAAA;CAChC,MAAM,aAAa,GAAG,aAAa,MAAM,SAAS;CAClD,MAAM,cAAc,sBAAsB,KAAK,MAAM;CACrD,MAAM,aAAa,KAAK,KAAK,YAAY,cAAc,aAAa,WAAW;CAC/E,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,GAAG,SAAS,MAAM,UAAU;CAC3C,SAAS,OAAO;EACd,IAAK,MAAgC,SAAS,UAAU,OAAO,KAAA;EAC/D,MAAM;CACR;CACA,IAAI,CAAC,KAAK,OAAO,KAAK,KAAK,eAAe,GAAG,OAAO,KAAA;CACpD,MAAM,UAAU,MAAM,GAAG,SAAS,SAAS,UAAU;CACrD,MAAM,gBAAgB,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK;CACvE,MAAM,WAAW,qBAAqB,KAAK;CAC3C,MAAM,WAAW,UAAU;CAC3B,IAAI,CAAC,aAAa,OAAO;EAAE;EAAU,OAAO;EAAU,QAAQ;EAAU;EAAY;CAAc;CAClG,OAAO;EACL;EACA,OAAO;EACP,QAAQ;EACR;EACA;EACA;EACA;EACA,qBAAqB,KAAK,KAAK,gBAAgB,QAAQ;EACvD,cAAc;CAChB;AACF;;;AC/MA,eAAe,kBACb,IACA,MACA,WACA,OACA,SACiB;CACjB,MAAM,OAAO,MAAM,GAAG,cAAc,WAAW,OAAO;CACtD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CACvD,IAAI,CAAC,SAAS,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CAChG,OAAO,KAAK;AACd;AAEA,eAAe,iBACb,IACA,SACA,YACA,SACiB;CACjB,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG,WAAW,OAAO;CAC9G,IAAI,WAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,QAC5D,MAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,OAAO,MAAM,SAAS,SAAS,QAAQ;CAC7C,IAAI,SAAS,KAAA,MAAc,OAAO,QAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5G,OAAO;AACT;AAEA,eAAe,0BACb,IACA,UACA,YACA,qBACA,SACiB;CACjB,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,MAAM,YAAY,WAAW,OAAO,OAAO;CACpG,IAAI,WAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,aAC5D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO;AACT;AAEA,eAAe,gBACb,IACA,KACA,YACA,qBACA,MACA,SAC2B;CAC3B,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAU,MAAM,iBAAiB,IAAI,eAAe,YAAY,SAAS,SAAS,GAAG,YAAY,OAAO;CAC9G,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAM,MAAM,0BAA0B,IAAI,YAAY,KAAK,YAAY,qBAAqB,OAAO;CACzG,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;;AAGA,eAAe,2BAA2B,IAAgB,WAAmB,SAAmC;CAC9G,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,OAAO;CACjD,IAAI,KAAK,IACH;MAAA,KAAK,MAAM,SAAS,aAAa,MAAM,IAAI,MAAM,8CAA8C;CAAA,OAC9F,IAAI,KAAK,MAAM,SAAS,aAC7B,WAAW,MAAM,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;MAEtE,MAAM,KAAK;CAEb,MAAM,SAAS,QAAQ,WAAA,GAAiC;CACxD,OAAO,WAAW,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC;AAC9D;;;;;AAMA,eAAe,0BACb,IACA,QACA,UACA,kBACA,SACe;CACf,WAAW,MAAM,GAAG,UAAU,kBAAkB,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;CAC7E,MAAM,SAAS,QAAQ,kBAAA,GAAwC;CAC/D,MAAM,gBAAgB,IAAI,QAAQ,UAAU,OAAO;CACnD,MAAM,SAAS,QAAQ,QAAA,GAAyB;AAClD;;;;;;;;;;AAWA,eAAsB,mCACpB,IACA,QACA,SACA,SACyC;CACzC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAa,WAAW,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,CAAC;EAChF,MAAM,sBAAsB,MAAM,2BAA2B,IAAI,OAAO,qBAAqB,OAAO;EACpG,MAAM,aAAa,MAAM,kBAAkB,IAAI,YAAY,OAAO,YAAY,YAAY,OAAO;EACjG,qBAAqB,YAAY,UAAU;EAG3C,MAAM,UAAU,iBAAiB,QADnB,WAAW,MAAM,GAAG,eAAe,YAAY,OAAO,CAC3B,GAAO,KAAK;EACrD,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAa,MAAM,gBAAgB,IAAI,WAAW,YAAY,qBAAqB,MAAM,OAAO;IACtG,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,MAAM,0BAA0B,IAAI,QAAQ,UAAU,QAAQ,kBAAkB,OAAO;EACvF,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF"}

package/dist/{completion-Ba0TiBHa.d.mts → completion-CqlF0TFY.d.mts}

@@ -1,96 +1,6 @@
+import { a as GitPluginSource, n as DomainManifest, p as PluginSource, u as PluginEntry } from "./domains-Bo9krPQ5.mjs";
 import "./index-DNEK9W6n.mjs";
 import { FileSystem } from "@agimon-ai/po-core/platform";
-//#region src/types/domains.d.ts
-interface LocalPluginSource {
-  type: 'local';
-  /** Absolute plugin directory after resolving the declaring config or marketplace root. */
-  path: string;
-}
-interface GitPluginSource {
-  type: 'git';
-  url: string;
-  /** Optional repository-relative plugin directory. */
-  path?: string;
-  ref?: string;
-  sha?: string;
-}
-interface NpmPluginSource {
-  type: 'npm';
-  package: string;
-  version?: string;
-  registry?: string;
-}
-type PluginSource = LocalPluginSource | GitPluginSource | NpmPluginSource;
-type PluginSkillDiscovery = 'recursive' | 'direct-children';
-interface PluginManifestMetadata {
-  path: string;
-  name?: string;
-  version?: string;
-  description?: string;
-  agentPluginSchema?: string;
-}
-interface PluginCatalogEntry {
-  source: PluginSource;
-  description?: string;
-  marketplace?: string;
-  manifest?: PluginManifestMetadata;
-}
-interface PluginCatalog {
-  /** Marketplace, plugin, or plugin-container roots resolved against their declaring config. */
-  roots: string[];
-  /** Supported marketplace manifests discovered in precedence order. */
-  marketplaces: string[];
-  /** Named explicit and marketplace plugin entries. */
-  entries: Record<string, PluginCatalogEntry>;
-  /** Non-fatal errors from automatic marketplace and folder discovery. */
-  diagnostics: string[];
-}
-/** A named plugin, or a subset of one. */
-type DomainPlugin = string | {
-  name: string;
-  skills?: string[];
-  agents?: string[];
-  hooks?: boolean;
-  mcp?: boolean;
-};
-interface DomainMcpAllowlist {
-  /** Server names kept from the repository-level .mcp.json. */
-  servers?: string[];
-  /** Upstream server names kept in the agiflow-proxy config. */
-  proxy?: string[];
-}
-interface DomainDefinition {
-  description?: string;
-  plugins?: DomainPlugin[];
-  mcp?: DomainMcpAllowlist;
-  sharedSkills?: boolean;
-}
-interface ResolvedDomain extends DomainDefinition {
-  baseDirectory: string;
-}
-interface DomainManifest {
-  plugins: PluginCatalog;
-  domains: Record<string, ResolvedDomain>;
-  aliases: Record<string, string[]>;
-  defaultDomains?: string[];
-}
-interface PluginEntry {
-  /** Catalog identifier when the entry came from domains.yaml. */
-  name?: string;
-  directory: string;
-  /** The domain that admitted this plugin; absent for an explicit directory. */
-  domain?: string;
-  /** Omitted for legacy programmatic callers that already supply a directory. */
-  source?: PluginSource;
-  /** Manifest metadata retained so resource adapters can apply schema-gated plugin contracts. */
-  manifest?: PluginManifestMetadata;
-  skillDiscovery?: PluginSkillDiscovery;
-  skills?: string[];
-  agents?: string[];
-  hooks?: boolean;
-  mcp?: boolean;
-}
-//#endregion
 //#region src/services/pluginCatalog/parse.d.ts
 declare const MARKETPLACE_MANIFEST_RELATIVE_PATHS: readonly ['.agents/plugins/marketplace.json', '.agents/plugins/api_marketplace.json', '.claude-plugin/marketplace.json', '.cursor-plugin/marketplace.json'];
 declare function pluginDirectoryForSource(source: PluginSource, homePoDirectory: string): string;
@@ -169,5 +79,5 @@ declare function domainCompletionItems(domainNames: string[], query: string): Ar
   label: string;
 }>;
 //#endregion
-export { PluginCatalogEntry as A, DomainManifest as C, LocalPluginSource as D, GitPluginSource as E, ResolvedDomain as F, PluginManifestMetadata as M, PluginSkillDiscovery as N, NpmPluginSource as O, PluginSource as P, DomainDefinition as S, DomainPlugin as T, findPluginManifestPathAsync as _, loadDomainsAsync as a, isRemotePluginSource as b, resolveSharedSkillsAsync as c, resolvePluginDirectories as d, resolvePluginEntries as f, defaultDomainsForMajorMode as g, PO_DOMAINS_ENV as h, listDomainNamesAsync as i, PluginEntry as j, PluginCatalog as k, listDomainNames as l, DEFAULT_DOMAIN as m, domainCompletionPrefix as n, resolvePluginDirectoriesAsync as o, resolveSharedSkills as p, expandDomainNames as r, resolvePluginEntriesAsync as s, domainCompletionItems as t, loadDomains as u, findPluginManifestPath as v, DomainMcpAllowlist as w, pluginDirectoryForSource as x, MARKETPLACE_MANIFEST_RELATIVE_PATHS as y };
-//# sourceMappingURL=completion-Ba0TiBHa.d.mts.map
+export { findPluginManifestPathAsync as _, loadDomainsAsync as a, isRemotePluginSource as b, resolveSharedSkillsAsync as c, resolvePluginDirectories as d, resolvePluginEntries as f, defaultDomainsForMajorMode as g, PO_DOMAINS_ENV as h, listDomainNamesAsync as i, listDomainNames as l, DEFAULT_DOMAIN as m, domainCompletionPrefix as n, resolvePluginDirectoriesAsync as o, resolveSharedSkills as p, expandDomainNames as r, resolvePluginEntriesAsync as s, domainCompletionItems as t, loadDomains as u, findPluginManifestPath as v, pluginDirectoryForSource as x, MARKETPLACE_MANIFEST_RELATIVE_PATHS as y };
+//# sourceMappingURL=completion-CqlF0TFY.d.mts.map

package/dist/completion-CqlF0TFY.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion-CqlF0TFY.d.mts","names":[],"sources":["../src/services/pluginCatalog/parse.ts","../src/services/pluginCatalog/sync.ts","../src/services/pluginCatalog/index.ts","../src/services/domains/core.ts","../src/services/domains/sync.ts","../src/services/domains/index.ts","../src/services/domains/completion.ts"],"mappings":";;;;cAgBa;iBAgWG,yBAAyB,QAAQ,cAAc;iBAU/C,qBACd,QAAQ,eACP,UAAU,kBAAkB,QAAQ;EAAgB;;;;;;;;iBCnVvC,uBAAuB;;;KCnBlC,UAAU,WAAW;;iBAwDJ,4BACpB,IAAI,YACJ,oBACA,SAAS,UACR;;;cC4KU;cACA;;;;;;;;iBAiBG,2BACd,mBACA,aAAa,OAAO,YACpB;;;;;;;;iBC7Pc,YAAY,kBAAkB,yBAAmD;;iBAMjF,gBAAgB,kBAAkB;;iBAKlC,oBAAoB,kBAAkB,uBAAuB;;iBAK7D,qBACd,kBACA,uBACA,+BACA,yBACC;;iBAkBa,yBACd,kBACA,uBACA,+BACA;;;KClDG,YAAY,WAAW;;;;;;;;iBAkCN,iBACpB,IAAI,YACJ,kBACA,SAAS,WACT,yBACC,QAAQ;iBAOW,qBACpB,IAAI,YACJ,kBACA,SAAS,WACT,yBACC;;;;;;;iBAUmB,yBACpB,IAAI,YACJ,kBACA,uBACA,SAAS,WACT,yBACC;;iBAKmB,0BACpB,IAAI,YACJ,kBACA,uBACA,+BACA,SAAS,WACT,yBACC,QAAQ;iBAiBW,8BACpB,IAAI,YACJ,kBACA,uBACA,+BACA,SAAS,WACT,yBACC;;;;iBCjHa,kBAAkB,UAAU,gBAAgB;iBAW5C,uBAAuB;iBAKvB,sBAAsB,uBAAuB,gBAAgB;EAAQ;EAAe"}

package/dist/domains-Bo9krPQ5.d.mts

@@ -0,0 +1,93 @@
+//#region src/types/domains.d.ts
+interface LocalPluginSource {
+  type: 'local';
+  /** Absolute plugin directory after resolving the declaring config or marketplace root. */
+  path: string;
+}
+interface GitPluginSource {
+  type: 'git';
+  url: string;
+  /** Optional repository-relative plugin directory. */
+  path?: string;
+  ref?: string;
+  sha?: string;
+}
+interface NpmPluginSource {
+  type: 'npm';
+  package: string;
+  version?: string;
+  registry?: string;
+}
+type PluginSource = LocalPluginSource | GitPluginSource | NpmPluginSource;
+type PluginSkillDiscovery = 'recursive' | 'direct-children';
+interface PluginManifestMetadata {
+  path: string;
+  name?: string;
+  version?: string;
+  description?: string;
+  agentPluginSchema?: string;
+}
+interface PluginCatalogEntry {
+  source: PluginSource;
+  description?: string;
+  marketplace?: string;
+  manifest?: PluginManifestMetadata;
+}
+interface PluginCatalog {
+  /** Marketplace, plugin, or plugin-container roots resolved against their declaring config. */
+  roots: string[];
+  /** Supported marketplace manifests discovered in precedence order. */
+  marketplaces: string[];
+  /** Named explicit and marketplace plugin entries. */
+  entries: Record<string, PluginCatalogEntry>;
+  /** Non-fatal errors from automatic marketplace and folder discovery. */
+  diagnostics: string[];
+}
+/** A named plugin, or a subset of one. */
+type DomainPlugin = string | {
+  name: string;
+  skills?: string[];
+  agents?: string[];
+  hooks?: boolean;
+  mcp?: boolean;
+};
+interface DomainMcpAllowlist {
+  /** Server names kept from the repository-level .mcp.json. */
+  servers?: string[];
+  /** Upstream server names kept in the agiflow-proxy config. */
+  proxy?: string[];
+}
+interface DomainDefinition {
+  description?: string;
+  plugins?: DomainPlugin[];
+  mcp?: DomainMcpAllowlist;
+  sharedSkills?: boolean;
+}
+interface ResolvedDomain extends DomainDefinition {
+  baseDirectory: string;
+}
+interface DomainManifest {
+  plugins: PluginCatalog;
+  domains: Record<string, ResolvedDomain>;
+  aliases: Record<string, string[]>;
+  defaultDomains?: string[];
+}
+interface PluginEntry {
+  /** Catalog identifier when the entry came from domains.yaml. */
+  name?: string;
+  directory: string;
+  /** The domain that admitted this plugin; absent for an explicit directory. */
+  domain?: string;
+  /** Omitted for legacy programmatic callers that already supply a directory. */
+  source?: PluginSource;
+  /** Manifest metadata retained so resource adapters can apply schema-gated plugin contracts. */
+  manifest?: PluginManifestMetadata;
+  skillDiscovery?: PluginSkillDiscovery;
+  skills?: string[];
+  agents?: string[];
+  hooks?: boolean;
+  mcp?: boolean;
+}
+//#endregion
+export { GitPluginSource as a, PluginCatalog as c, PluginManifestMetadata as d, PluginSkillDiscovery as f, DomainPlugin as i, PluginCatalogEntry as l, ResolvedDomain as m, DomainManifest as n, LocalPluginSource as o, PluginSource as p, DomainMcpAllowlist as r, NpmPluginSource as s, DomainDefinition as t, PluginEntry as u };
+//# sourceMappingURL=domains-Bo9krPQ5.d.mts.map

package/dist/domains-Bo9krPQ5.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains-Bo9krPQ5.d.mts","names":[],"sources":["../src/types/domains.ts"],"mappings":";UAAiB;EACf;;EAEA;;UAGe;EACf;EACA;;EAEA;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;;KAGU,eAAe,oBAAoB,kBAAkB;KACrD;UAEK;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf,QAAQ;EACR;EACA;EACA,WAAW;;UAGI;;EAEf;;EAEA;;EAEA,SAAS,eAAe;;EAExB;;;KAIU;EAEN;EAAc;EAAmB;EAAmB;EAAiB;;UAE1D;;EAEf;;EAEA;;UAGe;EACf;EACA,UAAU;EACV,MAAM;EACN;;UAGe,uBAAuB;EACtC;;UAGe;EACf,SAAS;EACT,SAAS,eAAe;EACxB,SAAS;EACT;;UAGe;;EAEf;EACA;;EAEA;;EAEA,SAAS;;EAET,WAAW;EACX,iBAAiB;EACjB;EACA;EACA;EACA"}

package/dist/domains.d.mts

@@ -1,3 +1,4 @@
-import { A as PluginCatalogEntry, C as DomainManifest, D as LocalPluginSource, E as GitPluginSource, F as ResolvedDomain, M as PluginManifestMetadata, N as PluginSkillDiscovery, O as NpmPluginSource, P as PluginSource, S as DomainDefinition, T as DomainPlugin, _ as findPluginManifestPathAsync, a as loadDomainsAsync, b as isRemotePluginSource, c as resolveSharedSkillsAsync, d as resolvePluginDirectories, f as resolvePluginEntries, g as defaultDomainsForMajorMode, h as PO_DOMAINS_ENV, i as listDomainNamesAsync, j as PluginEntry, k as PluginCatalog, l as listDomainNames, m as DEFAULT_DOMAIN, n as domainCompletionPrefix, o as resolvePluginDirectoriesAsync, p as resolveSharedSkills, r as expandDomainNames, s as resolvePluginEntriesAsync, t as domainCompletionItems, u as loadDomains, v as findPluginManifestPath, w as DomainMcpAllowlist, x as pluginDirectoryForSource, y as MARKETPLACE_MANIFEST_RELATIVE_PATHS } from "./completion-Ba0TiBHa.mjs";
+import { a as GitPluginSource, c as PluginCatalog, d as PluginManifestMetadata, f as PluginSkillDiscovery, i as DomainPlugin, l as PluginCatalogEntry, m as ResolvedDomain, n as DomainManifest, o as LocalPluginSource, p as PluginSource, r as DomainMcpAllowlist, s as NpmPluginSource, t as DomainDefinition, u as PluginEntry } from "./domains-Bo9krPQ5.mjs";
 import { n as PO_DIR } from "./index-DNEK9W6n.mjs";
+import { _ as findPluginManifestPathAsync, a as loadDomainsAsync, b as isRemotePluginSource, c as resolveSharedSkillsAsync, d as resolvePluginDirectories, f as resolvePluginEntries, g as defaultDomainsForMajorMode, h as PO_DOMAINS_ENV, i as listDomainNamesAsync, l as listDomainNames, m as DEFAULT_DOMAIN, n as domainCompletionPrefix, o as resolvePluginDirectoriesAsync, p as resolveSharedSkills, r as expandDomainNames, s as resolvePluginEntriesAsync, t as domainCompletionItems, u as loadDomains, v as findPluginManifestPath, x as pluginDirectoryForSource, y as MARKETPLACE_MANIFEST_RELATIVE_PATHS } from "./completion-CqlF0TFY.mjs";
 export { DEFAULT_DOMAIN, type DomainDefinition, type DomainManifest, type DomainMcpAllowlist, type DomainPlugin, type GitPluginSource, type LocalPluginSource, MARKETPLACE_MANIFEST_RELATIVE_PATHS, type NpmPluginSource, PO_DIR, PO_DOMAINS_ENV, type PluginCatalog, type PluginCatalogEntry, type PluginEntry, type PluginManifestMetadata, type PluginSkillDiscovery, type PluginSource, type ResolvedDomain, defaultDomainsForMajorMode, domainCompletionItems, domainCompletionPrefix, expandDomainNames, findPluginManifestPath, findPluginManifestPathAsync, isRemotePluginSource, listDomainNames, listDomainNamesAsync, loadDomains, loadDomainsAsync, pluginDirectoryForSource, resolvePluginDirectories, resolvePluginDirectoriesAsync, resolvePluginEntries, resolvePluginEntriesAsync, resolveSharedSkills, resolveSharedSkillsAsync };

package/dist/index.d.mts

@@ -1,10 +1,11 @@
+import { a as GitPluginSource, c as PluginCatalog, d as PluginManifestMetadata, f as PluginSkillDiscovery, i as DomainPlugin, l as PluginCatalogEntry, m as ResolvedDomain, n as DomainManifest, o as LocalPluginSource, p as PluginSource, r as DomainMcpAllowlist, s as NpmPluginSource, t as DomainDefinition, u as PluginEntry } from "./domains-Bo9krPQ5.mjs";
 import { n as writePrivateAtomicJson, t as writePrivateAtomicJsonAsync } from "./index-fTuf8tVH.mjs";
 import { A as PoSelectionConfig, B as VoiceTtsConfig, C as PoConfigLayers, D as PoConfigTransitionRecord, E as PoConfigTransitionPhase, F as VoiceAutoCaptureConfig, I as VoiceConfig, L as VoiceEngine, M as ResolvedVoiceAutoCaptureConfig, N as ResolvedVoiceConfig, O as PoConfigTransitionStrategy, P as VoiceAdapterConfig, R as VoiceMode, S as PoConfigLayer, V as VoiceTtsEngine, _ as PlanningModeConfig, b as PoConfig, c as EditorConfig, d as IPoConfigService, g as PlanningAgentConfig, h as PackageAttribution, i as AutocompactTokenConfig, j as ProjectTrust, k as PoHarnessContext, l as HarnessState, m as PO_CONFIG_SERVICE, n as AutocompactOverrideConfig, o as ConfigValueOrigin, r as AutocompactThresholdConfig, s as DeepReadonly, t as AutocompactModeConfig, u as IPoConfigLoader, v as PlanningThinkingLevel, w as PoConfigPendingSelection, x as PoConfigContext, y as PluginHookSource, z as VoiceModelConfig } from "./config-pxC7FyUJ.mjs";
 import { C as loadPoConfigLenient, D as resolvePlanningPlansDirectory, E as repositoryPoConfigPath, S as loadPoConfigLayers, T as globalPoConfigPath, _ as readPoConfig, a as PO_VOICE_MODES, b as loadPoConfig, c as configRootKeys, d as parseAutocompactModeConfig, f as parsePlanningModeConfig, g as ReadPoConfigOptions, h as valueAtKeyPath, i as PO_VOICE_LIVE_VOICES, l as configScopeOf, m as resolveVoiceConfig, n as PO_PLANNING_THINKING_LEVELS, o as PO_VOICE_TTS_ENGINES, p as parsePoConfig, r as PO_VOICE_ENGINES, s as configLeafKeys, t as ConfigKeyScope, u as mergePoConfigs, v as readPoConfigLayers, w as globalPoConfigDirectory, x as loadPoConfigAsync, y as readPoConfigLenient } from "./index-D3vGEYup.mjs";
 import { i as PiConfigPaths, n as PiConfig, r as PiConfigLoadOptions, t as ConfigAdapterRegistrationOptions } from "./piConfig-C9rGUqPe.mjs";
 import { a as unsetPoConfigValue, c as PoConfigScope, i as setPoConfigValue, l as WritePoConfigOptions, n as unsetPoConfigValueAsync, o as writePoConfigValues, r as writePoConfigValuesAsync, s as PoConfigEdit, t as setPoConfigValueAsync } from "./index-COokUToB.mjs";
-import { A as PluginCatalogEntry, C as DomainManifest, D as LocalPluginSource, E as GitPluginSource, F as ResolvedDomain, M as PluginManifestMetadata, N as PluginSkillDiscovery, O as NpmPluginSource, P as PluginSource, S as DomainDefinition, T as DomainPlugin, _ as findPluginManifestPathAsync, b as isRemotePluginSource, d as resolvePluginDirectories, f as resolvePluginEntries, j as PluginEntry, k as PluginCatalog, l as listDomainNames, n as domainCompletionPrefix, p as resolveSharedSkills, r as expandDomainNames, t as domainCompletionItems, u as loadDomains, v as findPluginManifestPath, w as DomainMcpAllowlist, x as pluginDirectoryForSource, y as MARKETPLACE_MANIFEST_RELATIVE_PATHS } from "./completion-Ba0TiBHa.mjs";
 import { n as PO_DIR } from "./index-DNEK9W6n.mjs";
+import { _ as findPluginManifestPathAsync, b as isRemotePluginSource, d as resolvePluginDirectories, f as resolvePluginEntries, l as listDomainNames, n as domainCompletionPrefix, p as resolveSharedSkills, r as expandDomainNames, t as domainCompletionItems, u as loadDomains, v as findPluginManifestPath, x as pluginDirectoryForSource, y as MARKETPLACE_MANIFEST_RELATIVE_PATHS } from "./completion-CqlF0TFY.mjs";
 import { a as readHarnessState, i as projectHarnessEnvironment, n as HARNESS_STATE_KEYS, r as HarnessStateParseReporter, t as FILE_ONLY_STATE_FIELDS } from "./index-BTOU4XiI.mjs";
 import { _ as HARNESS_STATE_POINTER, a as requireHarnessPaths, b as resetHarnessStore, d as getHarnessState, f as getSessionHarnessState, g as updateHarnessState, h as snapshotHarnessState, l as createHarnessSession, m as restoreHarnessStateSnapshot, o as requireHarnessRoot, p as loadHarnessState, r as harnessRoot, u as disposeHarnessState, v as HarnessStateFile, x as LoadedHarnessState, y as HarnessStateTransactionSnapshot } from "./index-dYgF03lE.mjs";
 import { a as loadPiConfigAsync, c as piConfigPaths, d as MIN_IMAGE_MAX_DIMENSION, f as PiImageSettings, h as parsePiImageSettings, i as loadPiConfig, l as piImageSettingsPath, m as clampImageMaxDimension, o as loadPiImageSettings, p as PiImageSettingsUpdate, s as savePiImageSettings, u as DEFAULT_IMAGE_MAX_DIMENSION } from "./index-7RuIAWX1.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agimon-ai/po-config",
-  "version": "0.0.0-alpha.21",
+  "version": "0.0.0-alpha.23",
   "description": "Typed configuration loading, validation, and host services for composing Po sessions.",
   "keywords": [
     "agent-configuration",
@@ -139,15 +139,15 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@agimon-ai/po-core": "0.0.0-alpha.21",
-    "@agimon-ai/po-telemetry": "0.0.0-alpha.21",
-    "@agimon-ai/po-web-components": "0.0.0-alpha.21",
+    "@agimon-ai/po-core": "0.0.0-alpha.23",
+    "@agimon-ai/po-telemetry": "0.0.0-alpha.23",
+    "@agimon-ai/po-web-components": "0.0.0-alpha.23",
     "@deepseek-ai/cordis": "4.0.5",
     "typebox": "1.3.37",
     "yaml": "2.9.1"
   },
   "devDependencies": {
-    "@agimon-ai/po-build": "0.0.0-alpha.21",
+    "@agimon-ai/po-build": "0.0.0-alpha.23",
     "@earendil-works/pi-coding-agent": "1.3.0",
     "@modelcontextprotocol/ext-apps": "2.0.3",
     "@modelcontextprotocol/server": "2.3.1",

package/dist/completion-Ba0TiBHa.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"completion-Ba0TiBHa.d.mts","names":[],"sources":["../src/types/domains.ts","../src/services/pluginCatalog/parse.ts","../src/services/pluginCatalog/sync.ts","../src/services/pluginCatalog/index.ts","../src/services/domains/core.ts","../src/services/domains/sync.ts","../src/services/domains/index.ts","../src/services/domains/completion.ts"],"mappings":";;;UAAiB;EACf;;EAEA;;UAGe;EACf;EACA;;EAEA;EACA;EACA;;UAGe;EACf;EACA;EACA;EACA;;KAGU,eAAe,oBAAoB,kBAAkB;KACrD;UAEK;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf,QAAQ;EACR;EACA;EACA,WAAW;;UAGI;;EAEf;;EAEA;;EAEA,SAAS,eAAe;;EAExB;;;KAIU;EAEN;EAAc;EAAmB;EAAmB;EAAiB;;UAE1D;;EAEf;;EAEA;;UAGe;EACf;EACA,UAAU;EACV,MAAM;EACN;;UAGe,uBAAuB;EACtC;;UAGe;EACf,SAAS;EACT,SAAS,eAAe;EACxB,SAAS;EACT;;UAGe;;EAEf;EACA;;EAEA;;EAEA,SAAS;;EAET,WAAW;EACX,iBAAiB;EACjB;EACA;EACA;EACA;;;;cC/EW;iBAgWG,yBAAyB,QAAQ,cAAc;iBAU/C,qBACd,QAAQ,eACP,UAAU,kBAAkB,QAAQ;EAAgB;;;;;;;;iBCnVvC,uBAAuB;;;KCnBlC,UAAU,WAAW;;iBAwDJ,4BACpB,IAAI,YACJ,oBACA,SAAS,UACR;;;cC4KU;cACA;;;;;;;;iBAiBG,2BACd,mBACA,aAAa,OAAO,YACpB;;;;;;;;iBC7Pc,YAAY,kBAAkB,yBAAmD;;iBAMjF,gBAAgB,kBAAkB;;iBAKlC,oBAAoB,kBAAkB,uBAAuB;;iBAK7D,qBACd,kBACA,uBACA,+BACA,yBACC;;iBAkBa,yBACd,kBACA,uBACA,+BACA;;;KClDG,YAAY,WAAW;;;;;;;;iBAkCN,iBACpB,IAAI,YACJ,kBACA,SAAS,WACT,yBACC,QAAQ;iBAOW,qBACpB,IAAI,YACJ,kBACA,SAAS,WACT,yBACC;;;;;;;iBAUmB,yBACpB,IAAI,YACJ,kBACA,uBACA,SAAS,WACT,yBACC;;iBAKmB,0BACpB,IAAI,YACJ,kBACA,uBACA,+BACA,SAAS,WACT,yBACC,QAAQ;iBAiBW,8BACpB,IAAI,YACJ,kBACA,uBACA,+BACA,SAAS,WACT,yBACC;;;;iBCjHa,kBAAkB,UAAU,gBAAgB;iBAW5C,uBAAuB;iBAKvB,sBAAsB,uBAAuB,gBAAgB;EAAQ;EAAe"}