@agimon-ai/po-config 0.0.0-alpha.3 → 0.0.0-alpha.5

package/README.md

@@ -4,7 +4,7 @@ Typed runtime configuration and immutable session context for
 [Po](https://www.npmjs.com/package/@agimon-ai/po).
 
 This package is fixed core in the Po distribution. It loads `config.yaml`, validates supported
-runtime settings, publishes the `doom/config` Cordis service, and maintains selection state shared
+runtime settings, publishes the `po/config` Cordis service, and maintains selection state shared
 by the major-mode, domain, and profile transition flows.
 
 > **Alpha:** configuration contracts may change between releases.
@@ -66,15 +66,15 @@ the complete runtime schema and additional configuration details.
 ## Typed session context
 
 The native session server root provides
-`DOOM_CONFIG_SERVICE`. Consumers must access it under an owning service injection:
+`PO_CONFIG_SERVICE`. Consumers must access it under an owning service injection:
 
 ```ts
-import { DOOM_CONFIG_SERVICE, type DoomConfigContext, requireDoomConfigContext } from '@agimon-ai/po-config';
+import { PO_CONFIG_SERVICE, type PoConfigContext, requirePoConfigContext } from '@agimon-ai/po-config';
 import type { Context } from '@deepseek-ai/cordis';
 
-export function consumeDoomConfig(context: Context, consume: (snapshot: DoomConfigContext) => void): void {
-  context.inject([DOOM_CONFIG_SERVICE], (configContext) => {
-    consume(requireDoomConfigContext(configContext));
+export function consumePoConfig(context: Context, consume: (snapshot: PoConfigContext) => void): void {
+  context.inject([PO_CONFIG_SERVICE], (configContext) => {
+    consume(requirePoConfigContext(configContext));
   });
 }
 ```
@@ -108,9 +108,9 @@ The root and focused `/config` and `/piContext` exports provide runtime parsing,
 session integration:
 
 ```ts
-import { loadDoomConfig } from '@agimon-ai/po-config';
+import { loadPoConfig } from '@agimon-ai/po-config';
 
-const settings = loadDoomConfig(process.cwd());
+const settings = loadPoConfig(process.cwd());
 ```
 
 Pi-specific JSON settings are exposed through `/pi-config`; their types are exposed through `/config-schema`. The removed `/config/piConfig` and `/config/schema` paths have no aliases.
@@ -122,7 +122,7 @@ runtime Config authoring skill.
 ## Help
 
 The package publishes `src/prompts/po-author-config`, links it from `llms.txt`, and registers
-`po-author-config` with the `doom/help` Cordis service. The guidance is visible to the AI only
+`po-author-config` with the `po/help` Cordis service. The guidance is visible to the AI only
 while the parent Help minor mode is active.
 
 ## Remote session app

package/dist/agentPluginMcp.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"agentPluginMcp.cjs","names":["path","createHash","AGENT_PLUGIN_MCP_SCHEMA_URL","realContainedPath","fs","normalizeCommand","path","normalizeWorkingDirectory","normalizeServer","writeStagedInternalConfig","randomUUID","path","getOrThrow","nodeHost","writeFileAtomic"],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"sourcesContent":["/** Pure Agent Plugin MCP normalisation shared by the async API and the deprecated Node-only sync shim. */\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\n\nimport { AGENT_PLUGIN_MCP_SCHEMA_URL, type DoomMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\n/** Same token grammar as node:http `validateHeaderName` (RFC 9110 tchar). */\nconst HTTP_TOKEN = /^[\\^_`a-zA-Z\\-0-9!#$%&'*+.|~]+$/u;\n/** Same rejected characters as node:http `validateHeaderValue`. */\nconst INVALID_HEADER_VALUE_CHARACTER = /[^\\t\\x20-\\x7e\\x80-\\xff]/u;\nconst IPV4_OCTET = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]?\\\\d)';\nconst IPV4_ADDRESS = new RegExp(`^${IPV4_OCTET}(?:\\\\.${IPV4_OCTET}){3}$`, 'u');\n\nfunction isIPv4(value: string): boolean {\n  return IPV4_ADDRESS.test(value);\n}\n\nexport const PRIVATE_FILE_MODE = 0o600;\nexport const PRIVATE_DIRECTORY_MODE = 0o700;\nexport const RESERVED_ENVIRONMENT_KEYS = new Set(['PLUGIN_ROOT', 'PLUGIN_DATA']);\nexport const PROXY_SERVER_ALIASES = new Set(['mcp-proxy', 'agiflow-proxy']);\n\nexport type JsonObject = Record<string, unknown>;\n\nexport interface AgentPluginMcpConfigSource {\n  path: string;\n  format: 'internal';\n  cacheKey: string;\n}\n\nexport interface NormalizedAgentPluginMcpSource {\n  /** Owner-only, content-addressed layer that bypasses Claude env interpolation. */\n  configSource?: AgentPluginMcpConfigSource;\n  /** Claude-compatible definitions for an external merged config. */\n  claudeConfig: { mcpServers: Record<string, JsonObject> };\n  serverNames: string[];\n  droppedServers: string[];\n  diagnostics: string[];\n}\n\nexport interface NormalizeAgentPluginMcpOptions {\n  stagingDirectory: string;\n  /** Empty and absent lists both mean keep every server. */\n  allowedServers?: readonly string[];\n  /** Doom strips nested wrappers; external-only callers may opt out. */\n  stripProxyWrappers?: boolean;\n}\n\nexport interface NormalizedServer {\n  internal: JsonObject;\n  claude: JsonObject;\n}\n\nexport function isObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function onlyKeys(value: JsonObject, allowed: readonly string[], label: string): void {\n  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));\n  if (unexpected) throw new Error(`${label} contains unsupported field \"${unexpected}\"`);\n}\n\nexport function nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nexport function optionalStringArray(value: unknown, label: string): string[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error(`${label} must be an array of strings`);\n  return value.map((item, index) => {\n    if (typeof item !== 'string') throw new Error(`${label}[${index}] must be a string`);\n    return item;\n  });\n}\n\nfunction optionalStringRecord(value: unknown, label: string): Record<string, string> | undefined {\n  if (value === undefined) return undefined;\n  if (!isObject(value)) throw new Error(`${label} must be an object of string values`);\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => {\n      if (typeof item !== 'string') throw new Error(`${label}.${key} must be a string`);\n      return [key, item];\n    }),\n  );\n}\n\nexport function expandPluginPlaceholders(value: string, pluginRoot: string, pluginDataDirectory: string): string {\n  // The portable contract is a single, non-recursive replacement pass. An\n  // unrecognised placeholder remains literal and mcp-proxy must not reinterpret it.\n  return value.replace(/\\$\\{PLUGIN_(ROOT|DATA)\\}/gu, (placeholder) =>\n    placeholder === '${PLUGIN_ROOT}' ? pluginRoot : pluginDataDirectory,\n  );\n}\n\nexport function isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));\n}\n\nexport function normalizeEnvironment(\n  value: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): Record<string, string> {\n  const declared = optionalStringRecord(value, 'env') ?? {};\n  for (const key of Object.keys(declared)) {\n    const reservedKey = process.platform === 'win32' ? key.toUpperCase() : key;\n    if (RESERVED_ENVIRONMENT_KEYS.has(reservedKey)) {\n      throw new Error(`env key \"${key}\" is reserved by Agent Plugins`);\n    }\n  }\n  return {\n    ...Object.fromEntries(\n      Object.entries(declared).map(([key, item]) => [\n        key,\n        expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n      ]),\n    ),\n    PLUGIN_ROOT: pluginRoot,\n    PLUGIN_DATA: pluginDataDirectory,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const bareHostname = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (bareHostname.toLowerCase() === 'localhost') return true;\n  if (isIPv4(bareHostname)) return bareHostname.split('.')[0] === '127';\n  return bareHostname === '::1';\n}\n\nexport function normalizeUrl(value: unknown): string {\n  const raw = nonEmptyString(value, 'url');\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('url must be an absolute HTTP(S) URL');\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error('url must use http or https');\n  }\n  if (parsed.username || parsed.password) throw new Error('url must not contain user information');\n  if (parsed.hash) throw new Error('url must not contain a fragment');\n  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {\n    throw new Error('non-loopback MCP URLs must use https');\n  }\n  return raw;\n}\n\nexport function normalizeHeaders(value: unknown): Record<string, string> | undefined {\n  const headers = optionalStringRecord(value, 'headers');\n  if (!headers) return undefined;\n  const seen = new Set<string>();\n  for (const [name, item] of Object.entries(headers)) {\n    const canonical = name.toLowerCase();\n    if (seen.has(canonical)) throw new Error(`headers contain duplicate name \"${name}\"`);\n    seen.add(canonical);\n    if (!HTTP_TOKEN.test(name) || INVALID_HEADER_VALUE_CHARACTER.test(item)) {\n      throw new Error(`header \"${name}\" is invalid`);\n    }\n  }\n  return headers;\n}\n\nexport function stagedInternalPath(\n  source: DoomMcpAgentPluginProjectionSource,\n  contents: string,\n  stagingDirectory: string,\n): string {\n  const digest = createHash('sha256')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(contents)\n    .digest('hex')\n    .slice(0, 20);\n  return path.join(stagingDirectory, `agent-plugin-mcp-${digest}.internal.json`);\n}\n\nexport function emptyResult(diagnostic: string): NormalizedAgentPluginMcpSource {\n  return {\n    claudeConfig: { mcpServers: {} },\n    serverNames: [],\n    droppedServers: [],\n    diagnostics: [diagnostic],\n  };\n}\n\nexport function sourceLabel(source: DoomMcpAgentPluginProjectionSource): string {\n  return `Agent Plugin MCP source \"${source.sourceId}\"`;\n}\n\n/** Checks the projection identity before any file is touched. */\nexport function assertProjectionSource(source: DoomMcpAgentPluginProjectionSource): void {\n  if (source.mcpSchemaUrl !== AGENT_PLUGIN_MCP_SCHEMA_URL) {\n    throw new Error(`unsupported schema \"${String(source.mcpSchemaUrl)}\"`);\n  }\n  if (!path.isAbsolute(source.pluginRoot) || !path.isAbsolute(source.pluginDataDirectory)) {\n    throw new Error('pluginRoot and pluginDataDirectory must be absolute');\n  }\n}\n\nexport function assertRootConfigPath(configPath: string, pluginRoot: string): void {\n  if (path.dirname(configPath) !== pluginRoot || path.basename(configPath) !== 'mcp.json') {\n    throw new Error('portable plugin config must be root mcp.json');\n  }\n}\n\n/** Verifies the digest and document shape of the raw mcp.json bytes; returns its server map. */\nexport function parseMcpDocument(\n  source: DoomMcpAgentPluginProjectionSource,\n  bytes: Uint8Array,\n  label: string,\n): Record<string, unknown> {\n  const digest = createHash('sha256').update(bytes).digest('hex');\n  if (digest !== source.contentDigest) throw new Error('content digest does not match the projection');\n  const parsed: unknown = JSON.parse(new TextDecoder('utf-8', { ignoreBOM: true }).decode(bytes));\n  if (!isObject(parsed)) throw new Error('document must be an object');\n  onlyKeys(parsed, ['$schema', 'mcpServers'], label);\n  if (parsed.$schema !== source.mcpSchemaUrl) throw new Error('$schema does not match the projected schema');\n  if (!isObject(parsed.mcpServers)) throw new Error('mcpServers must be an object');\n  return parsed.mcpServers;\n}\n\n/** Whether a declared server is skipped (empty name), dropped by the allowlist or wrapper rule, or normalised. */\nexport function serverDisposition(name: string, options: NormalizeAgentPluginMcpOptions): 'empty' | 'dropped' | 'keep' {\n  if (!name) return 'empty';\n  const allowed = options.allowedServers;\n  const keepAll = !allowed || allowed.length === 0;\n  const stripProxyWrappers = options.stripProxyWrappers ?? true;\n  if ((!keepAll && !allowed.includes(name)) || (stripProxyWrappers && PROXY_SERVER_ALIASES.has(name))) return 'dropped';\n  return 'keep';\n}\n\nexport function emptyServerDiagnostic(label: string): string {\n  return `${label} contains an empty server name; that entry was skipped.`;\n}\n\nexport function skippedServerDiagnostic(label: string, name: string, error: unknown): string {\n  return `${label} skipped server \"${name}\": ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function disabledResult(label: string, error: unknown): NormalizedAgentPluginMcpSource {\n  return emptyResult(`${label} was disabled: ${error instanceof Error ? error.message : String(error)}`);\n}\n\n/** The declared transport of one server; stdio declarations are also checked for unsupported fields. */\nexport function serverType(raw: unknown, name: string): string {\n  if (!isObject(raw)) throw new Error('definition must be an object');\n  const type = nonEmptyString(raw.type, 'type');\n  if (type === 'stdio') onlyKeys(raw, ['type', 'command', 'args', 'env', 'cwd'], `server \"${name}\"`);\n  return type;\n}\n\nexport function stdioServer(\n  name: string,\n  config: { command: string; args?: string[]; env: Record<string, string>; cwd: string },\n): NormalizedServer {\n  return {\n    internal: { name, transport: 'stdio', config },\n    claude: { type: 'stdio', ...config },\n  };\n}\n\n/** A streamable-http or sse server; any other type is unsupported. */\nexport function remoteServer(raw: JsonObject, name: string, type: string): NormalizedServer {\n  if (type === 'streamable-http' || type === 'sse') {\n    onlyKeys(raw, ['type', 'url', 'headers'], `server \"${name}\"`);\n    const url = normalizeUrl(raw.url);\n    const headers = normalizeHeaders(raw.headers);\n    const transport = type === 'streamable-http' ? 'http' : 'sse';\n    const config = { url, ...(headers ? { headers } : {}) };\n    return {\n      internal: { name, transport, config },\n      claude: { type: transport, ...config },\n    };\n  }\n  throw new Error(`unsupported transport type \"${type}\"`);\n}\n\nexport function stagedContents(internalServers: Record<string, JsonObject>): string {\n  return `${JSON.stringify({ mcpServers: internalServers }, null, 2)}\\n`;\n}\n\nexport function stagedCacheKey(\n  source: DoomMcpAgentPluginProjectionSource,\n  configPath: string,\n  contents: string,\n): string {\n  return createHash('sha256')\n    .update('agent-plugin-v1\\0')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(configPath)\n    .update('\\0')\n    .update(contents)\n    .digest('hex');\n}\n\n/** The containment base and expanded path of a declared cwd, or undefined when the plugin root is the default. */\nexport function workingDirectoryCandidate(\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): { base: string; candidate: string } | undefined {\n  if (declared === undefined) return undefined;\n  const cwd = nonEmptyString(declared, 'cwd');\n  if (cwd.startsWith('./')) return { base: pluginRoot, candidate: path.resolve(pluginRoot, cwd) };\n  const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginDataDirectory);\n  if (cwd === '${PLUGIN_ROOT}' || cwd.startsWith('${PLUGIN_ROOT}/')) {\n    return { base: pluginRoot, candidate: path.resolve(expanded) };\n  }\n  if (cwd === '${PLUGIN_DATA}' || cwd.startsWith('${PLUGIN_DATA}/')) {\n    return { base: pluginDataDirectory, candidate: path.resolve(expanded) };\n  }\n  throw new Error('cwd must start with ./, ${PLUGIN_ROOT}, or ${PLUGIN_DATA}');\n}\n\n/** Rejects a command that is neither a bare executable name nor a ./ path; true when it must be resolved. */\nexport function isPluginRelativeCommand(command: string): boolean {\n  if (command.startsWith('./')) return true;\n  if (command === '.' || command === '..' || /[\\s/\\\\]/u.test(command)) {\n    throw new Error('command must be a bare executable name or a ./ path inside the plugin');\n  }\n  return false;\n}\n","import { randomUUID } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { DoomMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nfunction realContainedPath(root: string, candidate: string, label: string): string {\n  let realCandidate: string;\n  try {\n    realCandidate = fs.realpathSync(candidate);\n  } catch {\n    throw new Error(`${label} does not exist`);\n  }\n  if (!isInside(root, realCandidate)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return realCandidate;\n}\n\nfunction normalizeCommand(command: string, pluginRoot: string): string {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = realContainedPath(pluginRoot, path.resolve(pluginRoot, command), 'command');\n  if (!fs.statSync(resolved).isFile()) throw new Error('command must resolve to a regular file');\n  try {\n    fs.accessSync(resolved, fs.constants.X_OK);\n  } catch {\n    throw new Error('command must resolve to an executable file');\n  }\n  return resolved;\n}\n\nfunction normalizeWorkingDirectory(declared: unknown, pluginRoot: string, pluginDataDirectory: string): string {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = realContainedPath(declaredCwd.base, declaredCwd.candidate, 'cwd');\n  if (!fs.statSync(resolved).isDirectory()) throw new Error('cwd must resolve to a directory');\n  return resolved;\n}\n\nfunction normalizeServer(\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n): NormalizedServer {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = normalizeCommand(nonEmptyString(declaration.command, 'command'), pluginRoot);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = normalizeWorkingDirectory(declaration.cwd, pluginRoot, pluginDataDirectory);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\nfunction writeStagedInternalConfig(target: string, contents: string, stagingDirectory: string): void {\n  fs.mkdirSync(stagingDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n  fs.chmodSync(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  const temporaryPath = `${target}.${process.pid}-${randomUUID()}.tmp`;\n  try {\n    fs.writeFileSync(temporaryPath, contents, { flag: 'wx', mode: PRIVATE_FILE_MODE });\n    try {\n      fs.renameSync(temporaryPath, target);\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n      if (code !== 'EEXIST' && code !== 'EPERM') throw error;\n      const stat = fs.lstatSync(target);\n      if (stat.isSymbolicLink() || !stat.isFile() || fs.readFileSync(target, 'utf8') !== contents) {\n        throw new Error('content-addressed staging path is occupied by different content');\n      }\n    }\n    fs.chmodSync(target, PRIVATE_FILE_MODE);\n  } finally {\n    fs.rmSync(temporaryPath, { force: true });\n  }\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n *\n * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.\n */\nexport function normalizeAgentPluginMcpSource(\n  source: DoomMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n): NormalizedAgentPluginMcpSource {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = fs.realpathSync(source.pluginRoot);\n    try {\n      const dataStat = fs.lstatSync(source.pluginDataDirectory);\n      if (dataStat.isSymbolicLink() || !dataStat.isDirectory()) {\n        throw new Error('pluginDataDirectory must be a real directory');\n      }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      fs.mkdirSync(source.pluginDataDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n    }\n    fs.chmodSync(source.pluginDataDirectory, PRIVATE_DIRECTORY_MODE);\n    fs.accessSync(source.pluginDataDirectory, fs.constants.W_OK);\n    const pluginDataDirectory = fs.realpathSync(source.pluginDataDirectory);\n    const configPath = realContainedPath(pluginRoot, source.configPath, 'mcp.json');\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const servers = parseMcpDocument(source, fs.readFileSync(configPath), label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = normalizeServer(rawServer, pluginRoot, pluginDataDirectory, name);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    writeStagedInternalConfig(target, contents, options.stagingDirectory);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n","import path from 'node:path';\n\nimport type { DoomMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\nimport { type FileSystem, getOrThrow, nodeHost, writeFileAtomic } from '@agimon-ai/po-core/platform';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nexport type {\n  AgentPluginMcpConfigSource,\n  NormalizeAgentPluginMcpOptions,\n  NormalizedAgentPluginMcpSource,\n} from './normalize';\nexport { normalizeAgentPluginMcpSource } from './sync';\n\ntype Context = Parameters<FileSystem['readTextFile']>[1];\n\nasync function realContainedPath(\n  fs: FileSystem,\n  root: string,\n  candidate: string,\n  label: string,\n  context: Context,\n): Promise<string> {\n  const real = await fs.canonicalPath(candidate, context);\n  if (!real.ok) throw new Error(`${label} does not exist`);\n  if (!isInside(root, real.value)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return real.value;\n}\n\nasync function normalizeCommand(\n  fs: FileSystem,\n  command: string,\n  pluginRoot: string,\n  context: Context,\n): Promise<string> {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = await realContainedPath(fs, pluginRoot, path.resolve(pluginRoot, command), 'command', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'file') {\n    throw new Error('command must resolve to a regular file');\n  }\n  // Execute bits stand in for access(X_OK); the edge has no modes, so nodeHost reports none and the check is skipped.\n  const mode = await nodeHost.fileMode(resolved);\n  if (mode !== undefined && (mode & 0o111) === 0) throw new Error('command must resolve to an executable file');\n  return resolved;\n}\n\nasync function normalizeWorkingDirectory(\n  fs: FileSystem,\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  context: Context,\n): Promise<string> {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = await realContainedPath(fs, declaredCwd.base, declaredCwd.candidate, 'cwd', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'directory') {\n    throw new Error('cwd must resolve to a directory');\n  }\n  return resolved;\n}\n\nasync function normalizeServer(\n  fs: FileSystem,\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n  context: Context,\n): Promise<NormalizedServer> {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = await normalizeCommand(fs, nonEmptyString(declaration.command, 'command'), pluginRoot, context);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = await normalizeWorkingDirectory(fs, declaration.cwd, pluginRoot, pluginDataDirectory, context);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\n/** Owner-only plugin data directory; a symbolic link or non-directory rejects the source. */\nasync function preparePluginDataDirectory(fs: FileSystem, directory: string, context: Context): Promise<string> {\n  const info = await fs.fileInfo(directory, context);\n  if (info.ok) {\n    if (info.value.kind !== 'directory') throw new Error('pluginDataDirectory must be a real directory');\n  } else if (info.error.code === 'not_found') {\n    getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n  } else {\n    throw info.error;\n  }\n  await nodeHost.setMode(directory, PRIVATE_DIRECTORY_MODE);\n  return getOrThrow(await fs.canonicalPath(directory, context));\n}\n\n/**\n * Content-addressed and owner-only. The name hashes the contents, so replacing an\n * existing staged file through a uniquely named temporary file never changes what it holds.\n */\nasync function writeStagedInternalConfig(\n  fs: FileSystem,\n  target: string,\n  contents: string,\n  stagingDirectory: string,\n  context: Context,\n): Promise<void> {\n  getOrThrow(await fs.createDir(stagingDirectory, { recursive: true }, context));\n  await nodeHost.setMode(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  await writeFileAtomic(fs, target, contents, context);\n  await nodeHost.setMode(target, PRIVATE_FILE_MODE);\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer,\n * reading and writing through the injected file system.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n */\nexport async function normalizeAgentPluginMcpSourceAsync(\n  fs: FileSystem,\n  source: DoomMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n  context: Context,\n): Promise<NormalizedAgentPluginMcpSource> {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = getOrThrow(await fs.canonicalPath(source.pluginRoot, context));\n    const pluginDataDirectory = await preparePluginDataDirectory(fs, source.pluginDataDirectory, context);\n    const configPath = await realContainedPath(fs, pluginRoot, source.configPath, 'mcp.json', context);\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const bytes = getOrThrow(await fs.readBinaryFile(configPath, context));\n    const servers = parseMcpDocument(source, bytes, label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = await normalizeServer(fs, rawServer, pluginRoot, pluginDataDirectory, name, context);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    await writeStagedInternalConfig(fs, target, contents, options.stagingDirectory, context);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAOA,MAAM,aAAa;;AAEnB,MAAM,iCAAiC;AACvC,MAAM,aAAa;AACnB,MAAM,eAAe,IAAI,OAAO,IAAI,WAAW,QAAQ,WAAW,QAAQ,GAAG;AAE7E,SAAS,OAAO,OAAwB;CACtC,OAAO,aAAa,KAAK,KAAK;AAChC;AAIA,MAAa,4CAA4B,IAAI,IAAI,CAAC,eAAe,aAAa,CAAC;AAC/E,MAAa,uCAAuB,IAAI,IAAI,CAAC,aAAa,eAAe,CAAC;AAiC1E,SAAgB,SAAS,OAAqC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAgB,SAAS,OAAmB,SAA4B,OAAqB;CAC3F,MAAM,aAAa,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC1E,IAAI,YAAY,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,WAAW,EAAE;AACvF;AAEA,SAAgB,eAAe,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAC1G,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAqC;CACvF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;CACjF,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;EACnF,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,OAAmD;CAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;CACnF,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU;EACzC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,kBAAkB;EAChF,OAAO,CAAC,KAAK,IAAI;CACnB,CAAC,CACH;AACF;AAEA,SAAgB,yBAAyB,OAAe,YAAoB,qBAAqC;CAG/G,OAAO,MAAM,QAAQ,+BAA+B,gBAClD,gBAAgB,mBAAmB,aAAa,mBAClD;AACF;AAEA,SAAgB,SAAS,MAAc,WAA4B;CACjE,MAAM,WAAWA,UAAAA,QAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAKA,UAAAA,QAAK,KAAK,KAAK,aAAa,QAAQ,CAACA,UAAAA,QAAK,WAAW,QAAQ;AACpH;AAEA,SAAgB,qBACd,OACA,YACA,qBACwB;CACxB,MAAM,WAAW,qBAAqB,OAAO,KAAK,KAAK,CAAC;CACxD,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GAAG;EACvC,MAAM,cAAc,QAAQ,aAAa,UAAU,IAAI,YAAY,IAAI;EACvE,IAAI,0BAA0B,IAAI,WAAW,GAC3C,MAAM,IAAI,MAAM,YAAY,IAAI,+BAA+B;CAEnE;CACA,OAAO;EACL,GAAG,OAAO,YACR,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAC5C,KACA,yBAAyB,MAAM,YAAY,mBAAmB,CAChE,CAAC,CACH;EACA,aAAa;EACb,aAAa;CACf;AACF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,eAAe,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAClG,IAAI,aAAa,YAAY,MAAM,aAAa,OAAO;CACvD,IAAI,OAAO,YAAY,GAAG,OAAO,aAAa,MAAM,GAAG,CAAC,CAAC,OAAO;CAChE,OAAO,iBAAiB;AAC1B;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,MAAM,eAAe,OAAO,KAAK;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,qCAAqC;CACvD;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,OAAO,YAAY,OAAO,UAAU,MAAM,IAAI,MAAM,uCAAuC;CAC/F,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,iCAAiC;CAClE,IAAI,OAAO,aAAa,WAAW,CAAC,eAAe,OAAO,QAAQ,GAChE,MAAM,IAAI,MAAM,sCAAsC;CAExD,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAAoD;CACnF,MAAM,UAAU,qBAAqB,OAAO,SAAS;CACrD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,YAAY,KAAK,YAAY;EACnC,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;EACnF,KAAK,IAAI,SAAS;EAClB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,+BAA+B,KAAK,IAAI,GACpE,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;CAEjD;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,UACA,kBACQ;CACR,MAAM,UAAA,GAASC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAChC,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAOD,UAAAA,QAAK,KAAK,kBAAkB,oBAAoB,OAAO,eAAe;AAC/E;AAEA,SAAgB,YAAY,YAAoD;CAC9E,OAAO;EACL,cAAc,EAAE,YAAY,CAAC,EAAE;EAC/B,aAAa,CAAC;EACd,gBAAgB,CAAC;EACjB,aAAa,CAAC,UAAU;CAC1B;AACF;AAEA,SAAgB,YAAY,QAAoD;CAC9E,OAAO,4BAA4B,OAAO,SAAS;AACrD;;AAGA,SAAgB,uBAAuB,QAAkD;CACvF,IAAI,OAAO,iBAAiBE,iCAAAA,6BAC1B,MAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,YAAY,EAAE,EAAE;CAEvE,IAAI,CAACF,UAAAA,QAAK,WAAW,OAAO,UAAU,KAAK,CAACA,UAAAA,QAAK,WAAW,OAAO,mBAAmB,GACpF,MAAM,IAAI,MAAM,qDAAqD;AAEzE;AAEA,SAAgB,qBAAqB,YAAoB,YAA0B;CACjF,IAAIA,UAAAA,QAAK,QAAQ,UAAU,MAAM,cAAcA,UAAAA,QAAK,SAAS,UAAU,MAAM,YAC3E,MAAM,IAAI,MAAM,8CAA8C;AAElE;;AAGA,SAAgB,iBACd,QACA,OACA,OACyB;CAEzB,KAAA,GADeC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAChD,MAAM,OAAO,eAAe,MAAM,IAAI,MAAM,8CAA8C;CACnG,MAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC9F,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B;CACnE,SAAS,QAAQ,CAAC,WAAW,YAAY,GAAG,KAAK;CACjD,IAAI,OAAO,YAAY,OAAO,cAAc,MAAM,IAAI,MAAM,6CAA6C;CACzG,IAAI,CAAC,SAAS,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAChF,OAAO,OAAO;AAChB;;AAGA,SAAgB,kBAAkB,MAAc,SAAuE;CACrH,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,CAAC,WAAW,QAAQ,WAAW;CAC/C,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,IAAK,CAAC,WAAW,CAAC,QAAQ,SAAS,IAAI,KAAO,sBAAsB,qBAAqB,IAAI,IAAI,GAAI,OAAO;CAC5G,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAuB;CAC3D,OAAO,GAAG,MAAM;AAClB;AAEA,SAAgB,wBAAwB,OAAe,MAAc,OAAwB;CAC3F,OAAO,GAAG,MAAM,mBAAmB,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpG;AAEA,SAAgB,eAAe,OAAe,OAAgD;CAC5F,OAAO,YAAY,GAAG,MAAM,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;AACvG;;AAGA,SAAgB,WAAW,KAAc,MAAsB;CAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAClE,MAAM,OAAO,eAAe,IAAI,MAAM,MAAM;CAC5C,IAAI,SAAS,SAAS,SAAS,KAAK;EAAC;EAAQ;EAAW;EAAQ;EAAO;CAAK,GAAG,WAAW,KAAK,EAAE;CACjG,OAAO;AACT;AAEA,SAAgB,YACd,MACA,QACkB;CAClB,OAAO;EACL,UAAU;GAAE;GAAM,WAAW;GAAS;EAAO;EAC7C,QAAQ;GAAE,MAAM;GAAS,GAAG;EAAO;CACrC;AACF;;AAGA,SAAgB,aAAa,KAAiB,MAAc,MAAgC;CAC1F,IAAI,SAAS,qBAAqB,SAAS,OAAO;EAChD,SAAS,KAAK;GAAC;GAAQ;GAAO;EAAS,GAAG,WAAW,KAAK,EAAE;EAC5D,MAAM,MAAM,aAAa,IAAI,GAAG;EAChC,MAAM,UAAU,iBAAiB,IAAI,OAAO;EAC5C,MAAM,YAAY,SAAS,oBAAoB,SAAS;EACxD,MAAM,SAAS;GAAE;GAAK,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAG;EACtD,OAAO;GACL,UAAU;IAAE;IAAM;IAAW;GAAO;GACpC,QAAQ;IAAE,MAAM;IAAW,GAAG;GAAO;EACvC;CACF;CACA,MAAM,IAAI,MAAM,+BAA+B,KAAK,EAAE;AACxD;AAEA,SAAgB,eAAe,iBAAqD;CAClF,OAAO,GAAG,KAAK,UAAU,EAAE,YAAY,gBAAgB,GAAG,MAAM,CAAC,EAAE;AACrE;AAEA,SAAgB,eACd,QACA,YACA,UACQ;CACR,QAAA,GAAOA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CACxB,OAAO,mBAAmB,CAAC,CAC3B,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,UAAU,CAAC,CAClB,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK;AACjB;;AAGA,SAAgB,0BACd,UACA,YACA,qBACiD;CACjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,MAAM,eAAe,UAAU,KAAK;CAC1C,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EAAE,MAAM;EAAY,WAAWD,UAAAA,QAAK,QAAQ,YAAY,GAAG;CAAE;CAC9F,MAAM,WAAW,yBAAyB,KAAK,YAAY,mBAAmB;CAC9E,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAY,WAAWA,UAAAA,QAAK,QAAQ,QAAQ;CAAE;CAE/D,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAqB,WAAWA,UAAAA,QAAK,QAAQ,QAAQ;CAAE;CAExE,MAAM,IAAI,MAAM,2DAA2D;AAC7E;;AAGA,SAAgB,wBAAwB,SAA0B;CAChE,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,YAAY,OAAO,YAAY,QAAQ,WAAW,KAAK,OAAO,GAChE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;;;ACrSA,SAASG,oBAAkB,MAAc,WAAmB,OAAuB;CACjF,IAAI;CACJ,IAAI;EACF,gBAAgBC,QAAAA,QAAG,aAAa,SAAS;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CAC3C;CACA,IAAI,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CACnG,OAAO;AACT;AAEA,SAASC,mBAAiB,SAAiB,YAA4B;CACrE,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAWF,oBAAkB,YAAYG,UAAAA,QAAK,QAAQ,YAAY,OAAO,GAAG,SAAS;CAC3F,IAAI,CAACF,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC7F,IAAI;EACF,QAAA,QAAG,WAAW,UAAUA,QAAAA,QAAG,UAAU,IAAI;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,OAAO;AACT;AAEA,SAASG,4BAA0B,UAAmB,YAAoB,qBAAqC;CAC7G,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAWJ,oBAAkB,YAAY,MAAM,YAAY,WAAW,KAAK;CACjF,IAAI,CAACC,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,iCAAiC;CAC3F,OAAO;AACT;AAEA,SAASI,kBACP,KACA,YACA,qBACA,MACkB;CAClB,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAUH,mBAAiB,eAAe,YAAY,SAAS,SAAS,GAAG,UAAU;CAC3F,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAME,4BAA0B,YAAY,KAAK,YAAY,mBAAmB;CACtF,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;AAEA,SAASE,4BAA0B,QAAgB,UAAkB,kBAAgC;CACnG,QAAA,QAAG,UAAU,kBAAkB;EAAE,MAAA;EAA8B,WAAW;CAAK,CAAC;CAChF,QAAA,QAAG,UAAU,kBAAA,GAAwC;CACrD,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,IAAI,IAAA,GAAGC,YAAAA,WAAAA,CAAW,EAAE;CAC/D,IAAI;EACF,QAAA,QAAG,cAAc,eAAe,UAAU;GAAE,MAAM;GAAM,MAAA;EAAwB,CAAC;EACjF,IAAI;GACF,QAAA,QAAG,WAAW,eAAe,MAAM;EACrC,SAAS,OAAO;GACd,MAAM,OAAQ,MAAgC;GAC9C,IAAI,SAAS,YAAY,SAAS,SAAS,MAAM;GACjD,MAAM,OAAON,QAAAA,QAAG,UAAU,MAAM;GAChC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAKA,QAAAA,QAAG,aAAa,QAAQ,MAAM,MAAM,UACjF,MAAM,IAAI,MAAM,iEAAiE;EAErF;EACA,QAAA,QAAG,UAAU,QAAA,GAAyB;CACxC,UAAU;EACR,QAAA,QAAG,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;CAC1C;AACF;;;;;;;;;;;AAYA,SAAgB,8BACd,QACA,SACgC;CAChC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAaA,QAAAA,QAAG,aAAa,OAAO,UAAU;EACpD,IAAI;GACF,MAAM,WAAWA,QAAAA,QAAG,UAAU,OAAO,mBAAmB;GACxD,IAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAElE,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAC9D,QAAA,QAAG,UAAU,OAAO,qBAAqB;IAAE,MAAA;IAA8B,WAAW;GAAK,CAAC;EAC5F;EACA,QAAA,QAAG,UAAU,OAAO,qBAAA,GAA2C;EAC/D,QAAA,QAAG,WAAW,OAAO,qBAAqBA,QAAAA,QAAG,UAAU,IAAI;EAC3D,MAAM,sBAAsBA,QAAAA,QAAG,aAAa,OAAO,mBAAmB;EACtE,MAAM,aAAaD,oBAAkB,YAAY,OAAO,YAAY,UAAU;EAC9E,qBAAqB,YAAY,UAAU;EAE3C,MAAM,UAAU,iBAAiB,QAAQC,QAAAA,QAAG,aAAa,UAAU,GAAG,KAAK;EAC3E,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAaI,kBAAgB,WAAW,YAAY,qBAAqB,IAAI;IACnF,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,4BAA0B,QAAQ,UAAU,QAAQ,gBAAgB;EACpE,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF;;;ACvIA,eAAe,kBACb,IACA,MACA,WACA,OACA,SACiB;CACjB,MAAM,OAAO,MAAM,GAAG,cAAc,WAAW,OAAO;CACtD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CACvD,IAAI,CAAC,SAAS,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CAChG,OAAO,KAAK;AACd;AAEA,eAAe,iBACb,IACA,SACA,YACA,SACiB;CACjB,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAYG,UAAAA,QAAK,QAAQ,YAAY,OAAO,GAAG,WAAW,OAAO;CAC9G,KAAA,GAAIC,4BAAAA,WAAAA,CAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,QAC5D,MAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,OAAO,MAAMC,4BAAAA,SAAS,SAAS,QAAQ;CAC7C,IAAI,SAAS,KAAA,MAAc,OAAO,QAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5G,OAAO;AACT;AAEA,eAAe,0BACb,IACA,UACA,YACA,qBACA,SACiB;CACjB,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,MAAM,YAAY,WAAW,OAAO,OAAO;CACpG,KAAA,GAAID,4BAAAA,WAAAA,CAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,aAC5D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO;AACT;AAEA,eAAe,gBACb,IACA,KACA,YACA,qBACA,MACA,SAC2B;CAC3B,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAU,MAAM,iBAAiB,IAAI,eAAe,YAAY,SAAS,SAAS,GAAG,YAAY,OAAO;CAC9G,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAM,MAAM,0BAA0B,IAAI,YAAY,KAAK,YAAY,qBAAqB,OAAO;CACzG,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;;AAGA,eAAe,2BAA2B,IAAgB,WAAmB,SAAmC;CAC9G,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,OAAO;CACjD,IAAI,KAAK,IACH;MAAA,KAAK,MAAM,SAAS,aAAa,MAAM,IAAI,MAAM,8CAA8C;CAAA,OAC9F,IAAI,KAAK,MAAM,SAAS,aAC7B,CAAA,GAAA,4BAAA,WAAA,CAAW,MAAM,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;MAEtE,MAAM,KAAK;CAEb,MAAMC,4BAAAA,SAAS,QAAQ,WAAA,GAAiC;CACxD,QAAA,GAAOD,4BAAAA,WAAAA,CAAW,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC;AAC9D;;;;;AAMA,eAAe,0BACb,IACA,QACA,UACA,kBACA,SACe;CACf,CAAA,GAAA,4BAAA,WAAA,CAAW,MAAM,GAAG,UAAU,kBAAkB,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;CAC7E,MAAMC,4BAAAA,SAAS,QAAQ,kBAAA,GAAwC;CAC/D,OAAA,GAAMC,4BAAAA,gBAAAA,CAAgB,IAAI,QAAQ,UAAU,OAAO;CACnD,MAAMD,4BAAAA,SAAS,QAAQ,QAAA,GAAyB;AAClD;;;;;;;;;;AAWA,eAAsB,mCACpB,IACA,QACA,SACA,SACyC;CACzC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,cAAA,GAAaD,4BAAAA,WAAAA,CAAW,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,CAAC;EAChF,MAAM,sBAAsB,MAAM,2BAA2B,IAAI,OAAO,qBAAqB,OAAO;EACpG,MAAM,aAAa,MAAM,kBAAkB,IAAI,YAAY,OAAO,YAAY,YAAY,OAAO;EACjG,qBAAqB,YAAY,UAAU;EAG3C,MAAM,UAAU,iBAAiB,SAD3B,GAAQA,4BAAAA,WAAAA,CAAW,MAAM,GAAG,eAAe,YAAY,OAAO,CAC3B,GAAO,KAAK;EACrD,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAa,MAAM,gBAAgB,IAAI,WAAW,YAAY,qBAAqB,MAAM,OAAO;IACtG,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,MAAM,0BAA0B,IAAI,QAAQ,UAAU,QAAQ,kBAAkB,OAAO;EACvF,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF"}
+{"version":3,"file":"agentPluginMcp.cjs","names":["path","createHash","AGENT_PLUGIN_MCP_SCHEMA_URL","realContainedPath","fs","normalizeCommand","path","normalizeWorkingDirectory","normalizeServer","writeStagedInternalConfig","randomUUID","path","getOrThrow","nodeHost","writeFileAtomic"],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"sourcesContent":["/** Pure Agent Plugin MCP normalisation shared by the async API and the deprecated Node-only sync shim. */\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\n\nimport { AGENT_PLUGIN_MCP_SCHEMA_URL, type PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\n/** Same token grammar as node:http `validateHeaderName` (RFC 9110 tchar). */\nconst HTTP_TOKEN = /^[\\^_`a-zA-Z\\-0-9!#$%&'*+.|~]+$/u;\n/** Same rejected characters as node:http `validateHeaderValue`. */\nconst INVALID_HEADER_VALUE_CHARACTER = /[^\\t\\x20-\\x7e\\x80-\\xff]/u;\nconst IPV4_OCTET = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]?\\\\d)';\nconst IPV4_ADDRESS = new RegExp(`^${IPV4_OCTET}(?:\\\\.${IPV4_OCTET}){3}$`, 'u');\n\nfunction isIPv4(value: string): boolean {\n  return IPV4_ADDRESS.test(value);\n}\n\nexport const PRIVATE_FILE_MODE = 0o600;\nexport const PRIVATE_DIRECTORY_MODE = 0o700;\nexport const RESERVED_ENVIRONMENT_KEYS = new Set(['PLUGIN_ROOT', 'PLUGIN_DATA']);\nexport const PROXY_SERVER_ALIASES = new Set(['mcp-proxy', 'agiflow-proxy']);\n\nexport type JsonObject = Record<string, unknown>;\n\nexport interface AgentPluginMcpConfigSource {\n  path: string;\n  format: 'internal';\n  cacheKey: string;\n}\n\nexport interface NormalizedAgentPluginMcpSource {\n  /** Owner-only, content-addressed layer that bypasses Claude env interpolation. */\n  configSource?: AgentPluginMcpConfigSource;\n  /** Claude-compatible definitions for an external merged config. */\n  claudeConfig: { mcpServers: Record<string, JsonObject> };\n  serverNames: string[];\n  droppedServers: string[];\n  diagnostics: string[];\n}\n\nexport interface NormalizeAgentPluginMcpOptions {\n  stagingDirectory: string;\n  /** Empty and absent lists both mean keep every server. */\n  allowedServers?: readonly string[];\n  /** Po strips nested wrappers; external-only callers may opt out. */\n  stripProxyWrappers?: boolean;\n}\n\nexport interface NormalizedServer {\n  internal: JsonObject;\n  claude: JsonObject;\n}\n\nexport function isObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function onlyKeys(value: JsonObject, allowed: readonly string[], label: string): void {\n  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));\n  if (unexpected) throw new Error(`${label} contains unsupported field \"${unexpected}\"`);\n}\n\nexport function nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nexport function optionalStringArray(value: unknown, label: string): string[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error(`${label} must be an array of strings`);\n  return value.map((item, index) => {\n    if (typeof item !== 'string') throw new Error(`${label}[${index}] must be a string`);\n    return item;\n  });\n}\n\nfunction optionalStringRecord(value: unknown, label: string): Record<string, string> | undefined {\n  if (value === undefined) return undefined;\n  if (!isObject(value)) throw new Error(`${label} must be an object of string values`);\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => {\n      if (typeof item !== 'string') throw new Error(`${label}.${key} must be a string`);\n      return [key, item];\n    }),\n  );\n}\n\nexport function expandPluginPlaceholders(value: string, pluginRoot: string, pluginDataDirectory: string): string {\n  // The portable contract is a single, non-recursive replacement pass. An\n  // unrecognised placeholder remains literal and mcp-proxy must not reinterpret it.\n  return value.replace(/\\$\\{PLUGIN_(ROOT|DATA)\\}/gu, (placeholder) =>\n    placeholder === '${PLUGIN_ROOT}' ? pluginRoot : pluginDataDirectory,\n  );\n}\n\nexport function isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));\n}\n\nexport function normalizeEnvironment(\n  value: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): Record<string, string> {\n  const declared = optionalStringRecord(value, 'env') ?? {};\n  for (const key of Object.keys(declared)) {\n    const reservedKey = process.platform === 'win32' ? key.toUpperCase() : key;\n    if (RESERVED_ENVIRONMENT_KEYS.has(reservedKey)) {\n      throw new Error(`env key \"${key}\" is reserved by Agent Plugins`);\n    }\n  }\n  return {\n    ...Object.fromEntries(\n      Object.entries(declared).map(([key, item]) => [\n        key,\n        expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n      ]),\n    ),\n    PLUGIN_ROOT: pluginRoot,\n    PLUGIN_DATA: pluginDataDirectory,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const bareHostname = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (bareHostname.toLowerCase() === 'localhost') return true;\n  if (isIPv4(bareHostname)) return bareHostname.split('.')[0] === '127';\n  return bareHostname === '::1';\n}\n\nexport function normalizeUrl(value: unknown): string {\n  const raw = nonEmptyString(value, 'url');\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('url must be an absolute HTTP(S) URL');\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error('url must use http or https');\n  }\n  if (parsed.username || parsed.password) throw new Error('url must not contain user information');\n  if (parsed.hash) throw new Error('url must not contain a fragment');\n  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {\n    throw new Error('non-loopback MCP URLs must use https');\n  }\n  return raw;\n}\n\nexport function normalizeHeaders(value: unknown): Record<string, string> | undefined {\n  const headers = optionalStringRecord(value, 'headers');\n  if (!headers) return undefined;\n  const seen = new Set<string>();\n  for (const [name, item] of Object.entries(headers)) {\n    const canonical = name.toLowerCase();\n    if (seen.has(canonical)) throw new Error(`headers contain duplicate name \"${name}\"`);\n    seen.add(canonical);\n    if (!HTTP_TOKEN.test(name) || INVALID_HEADER_VALUE_CHARACTER.test(item)) {\n      throw new Error(`header \"${name}\" is invalid`);\n    }\n  }\n  return headers;\n}\n\nexport function stagedInternalPath(\n  source: PoMcpAgentPluginProjectionSource,\n  contents: string,\n  stagingDirectory: string,\n): string {\n  const digest = createHash('sha256')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(contents)\n    .digest('hex')\n    .slice(0, 20);\n  return path.join(stagingDirectory, `agent-plugin-mcp-${digest}.internal.json`);\n}\n\nexport function emptyResult(diagnostic: string): NormalizedAgentPluginMcpSource {\n  return {\n    claudeConfig: { mcpServers: {} },\n    serverNames: [],\n    droppedServers: [],\n    diagnostics: [diagnostic],\n  };\n}\n\nexport function sourceLabel(source: PoMcpAgentPluginProjectionSource): string {\n  return `Agent Plugin MCP source \"${source.sourceId}\"`;\n}\n\n/** Checks the projection identity before any file is touched. */\nexport function assertProjectionSource(source: PoMcpAgentPluginProjectionSource): void {\n  if (source.mcpSchemaUrl !== AGENT_PLUGIN_MCP_SCHEMA_URL) {\n    throw new Error(`unsupported schema \"${String(source.mcpSchemaUrl)}\"`);\n  }\n  if (!path.isAbsolute(source.pluginRoot) || !path.isAbsolute(source.pluginDataDirectory)) {\n    throw new Error('pluginRoot and pluginDataDirectory must be absolute');\n  }\n}\n\nexport function assertRootConfigPath(configPath: string, pluginRoot: string): void {\n  if (path.dirname(configPath) !== pluginRoot || path.basename(configPath) !== 'mcp.json') {\n    throw new Error('portable plugin config must be root mcp.json');\n  }\n}\n\n/** Verifies the digest and document shape of the raw mcp.json bytes; returns its server map. */\nexport function parseMcpDocument(\n  source: PoMcpAgentPluginProjectionSource,\n  bytes: Uint8Array,\n  label: string,\n): Record<string, unknown> {\n  const digest = createHash('sha256').update(bytes).digest('hex');\n  if (digest !== source.contentDigest) throw new Error('content digest does not match the projection');\n  const parsed: unknown = JSON.parse(new TextDecoder('utf-8', { ignoreBOM: true }).decode(bytes));\n  if (!isObject(parsed)) throw new Error('document must be an object');\n  onlyKeys(parsed, ['$schema', 'mcpServers'], label);\n  if (parsed.$schema !== source.mcpSchemaUrl) throw new Error('$schema does not match the projected schema');\n  if (!isObject(parsed.mcpServers)) throw new Error('mcpServers must be an object');\n  return parsed.mcpServers;\n}\n\n/** Whether a declared server is skipped (empty name), dropped by the allowlist or wrapper rule, or normalised. */\nexport function serverDisposition(name: string, options: NormalizeAgentPluginMcpOptions): 'empty' | 'dropped' | 'keep' {\n  if (!name) return 'empty';\n  const allowed = options.allowedServers;\n  const keepAll = !allowed || allowed.length === 0;\n  const stripProxyWrappers = options.stripProxyWrappers ?? true;\n  if ((!keepAll && !allowed.includes(name)) || (stripProxyWrappers && PROXY_SERVER_ALIASES.has(name))) return 'dropped';\n  return 'keep';\n}\n\nexport function emptyServerDiagnostic(label: string): string {\n  return `${label} contains an empty server name; that entry was skipped.`;\n}\n\nexport function skippedServerDiagnostic(label: string, name: string, error: unknown): string {\n  return `${label} skipped server \"${name}\": ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function disabledResult(label: string, error: unknown): NormalizedAgentPluginMcpSource {\n  return emptyResult(`${label} was disabled: ${error instanceof Error ? error.message : String(error)}`);\n}\n\n/** The declared transport of one server; stdio declarations are also checked for unsupported fields. */\nexport function serverType(raw: unknown, name: string): string {\n  if (!isObject(raw)) throw new Error('definition must be an object');\n  const type = nonEmptyString(raw.type, 'type');\n  if (type === 'stdio') onlyKeys(raw, ['type', 'command', 'args', 'env', 'cwd'], `server \"${name}\"`);\n  return type;\n}\n\nexport function stdioServer(\n  name: string,\n  config: { command: string; args?: string[]; env: Record<string, string>; cwd: string },\n): NormalizedServer {\n  return {\n    internal: { name, transport: 'stdio', config },\n    claude: { type: 'stdio', ...config },\n  };\n}\n\n/** A streamable-http or sse server; any other type is unsupported. */\nexport function remoteServer(raw: JsonObject, name: string, type: string): NormalizedServer {\n  if (type === 'streamable-http' || type === 'sse') {\n    onlyKeys(raw, ['type', 'url', 'headers'], `server \"${name}\"`);\n    const url = normalizeUrl(raw.url);\n    const headers = normalizeHeaders(raw.headers);\n    const transport = type === 'streamable-http' ? 'http' : 'sse';\n    const config = { url, ...(headers ? { headers } : {}) };\n    return {\n      internal: { name, transport, config },\n      claude: { type: transport, ...config },\n    };\n  }\n  throw new Error(`unsupported transport type \"${type}\"`);\n}\n\nexport function stagedContents(internalServers: Record<string, JsonObject>): string {\n  return `${JSON.stringify({ mcpServers: internalServers }, null, 2)}\\n`;\n}\n\nexport function stagedCacheKey(source: PoMcpAgentPluginProjectionSource, configPath: string, contents: string): string {\n  return createHash('sha256')\n    .update('agent-plugin-v1\\0')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(configPath)\n    .update('\\0')\n    .update(contents)\n    .digest('hex');\n}\n\n/** The containment base and expanded path of a declared cwd, or undefined when the plugin root is the default. */\nexport function workingDirectoryCandidate(\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): { base: string; candidate: string } | undefined {\n  if (declared === undefined) return undefined;\n  const cwd = nonEmptyString(declared, 'cwd');\n  if (cwd.startsWith('./')) return { base: pluginRoot, candidate: path.resolve(pluginRoot, cwd) };\n  const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginDataDirectory);\n  if (cwd === '${PLUGIN_ROOT}' || cwd.startsWith('${PLUGIN_ROOT}/')) {\n    return { base: pluginRoot, candidate: path.resolve(expanded) };\n  }\n  if (cwd === '${PLUGIN_DATA}' || cwd.startsWith('${PLUGIN_DATA}/')) {\n    return { base: pluginDataDirectory, candidate: path.resolve(expanded) };\n  }\n  throw new Error('cwd must start with ./, ${PLUGIN_ROOT}, or ${PLUGIN_DATA}');\n}\n\n/** Rejects a command that is neither a bare executable name nor a ./ path; true when it must be resolved. */\nexport function isPluginRelativeCommand(command: string): boolean {\n  if (command.startsWith('./')) return true;\n  if (command === '.' || command === '..' || /[\\s/\\\\]/u.test(command)) {\n    throw new Error('command must be a bare executable name or a ./ path inside the plugin');\n  }\n  return false;\n}\n","import { randomUUID } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nfunction realContainedPath(root: string, candidate: string, label: string): string {\n  let realCandidate: string;\n  try {\n    realCandidate = fs.realpathSync(candidate);\n  } catch {\n    throw new Error(`${label} does not exist`);\n  }\n  if (!isInside(root, realCandidate)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return realCandidate;\n}\n\nfunction normalizeCommand(command: string, pluginRoot: string): string {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = realContainedPath(pluginRoot, path.resolve(pluginRoot, command), 'command');\n  if (!fs.statSync(resolved).isFile()) throw new Error('command must resolve to a regular file');\n  try {\n    fs.accessSync(resolved, fs.constants.X_OK);\n  } catch {\n    throw new Error('command must resolve to an executable file');\n  }\n  return resolved;\n}\n\nfunction normalizeWorkingDirectory(declared: unknown, pluginRoot: string, pluginDataDirectory: string): string {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = realContainedPath(declaredCwd.base, declaredCwd.candidate, 'cwd');\n  if (!fs.statSync(resolved).isDirectory()) throw new Error('cwd must resolve to a directory');\n  return resolved;\n}\n\nfunction normalizeServer(\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n): NormalizedServer {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = normalizeCommand(nonEmptyString(declaration.command, 'command'), pluginRoot);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = normalizeWorkingDirectory(declaration.cwd, pluginRoot, pluginDataDirectory);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\nfunction writeStagedInternalConfig(target: string, contents: string, stagingDirectory: string): void {\n  fs.mkdirSync(stagingDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n  fs.chmodSync(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  const temporaryPath = `${target}.${process.pid}-${randomUUID()}.tmp`;\n  try {\n    fs.writeFileSync(temporaryPath, contents, { flag: 'wx', mode: PRIVATE_FILE_MODE });\n    try {\n      fs.renameSync(temporaryPath, target);\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n      if (code !== 'EEXIST' && code !== 'EPERM') throw error;\n      const stat = fs.lstatSync(target);\n      if (stat.isSymbolicLink() || !stat.isFile() || fs.readFileSync(target, 'utf8') !== contents) {\n        throw new Error('content-addressed staging path is occupied by different content');\n      }\n    }\n    fs.chmodSync(target, PRIVATE_FILE_MODE);\n  } finally {\n    fs.rmSync(temporaryPath, { force: true });\n  }\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n *\n * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.\n */\nexport function normalizeAgentPluginMcpSource(\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n): NormalizedAgentPluginMcpSource {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = fs.realpathSync(source.pluginRoot);\n    try {\n      const dataStat = fs.lstatSync(source.pluginDataDirectory);\n      if (dataStat.isSymbolicLink() || !dataStat.isDirectory()) {\n        throw new Error('pluginDataDirectory must be a real directory');\n      }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      fs.mkdirSync(source.pluginDataDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n    }\n    fs.chmodSync(source.pluginDataDirectory, PRIVATE_DIRECTORY_MODE);\n    fs.accessSync(source.pluginDataDirectory, fs.constants.W_OK);\n    const pluginDataDirectory = fs.realpathSync(source.pluginDataDirectory);\n    const configPath = realContainedPath(pluginRoot, source.configPath, 'mcp.json');\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const servers = parseMcpDocument(source, fs.readFileSync(configPath), label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = normalizeServer(rawServer, pluginRoot, pluginDataDirectory, name);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    writeStagedInternalConfig(target, contents, options.stagingDirectory);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n","import path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\nimport { type FileSystem, getOrThrow, nodeHost, writeFileAtomic } from '@agimon-ai/po-core/platform';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nexport type {\n  AgentPluginMcpConfigSource,\n  NormalizeAgentPluginMcpOptions,\n  NormalizedAgentPluginMcpSource,\n} from './normalize';\nexport { normalizeAgentPluginMcpSource } from './sync';\n\ntype Context = Parameters<FileSystem['readTextFile']>[1];\n\nasync function realContainedPath(\n  fs: FileSystem,\n  root: string,\n  candidate: string,\n  label: string,\n  context: Context,\n): Promise<string> {\n  const real = await fs.canonicalPath(candidate, context);\n  if (!real.ok) throw new Error(`${label} does not exist`);\n  if (!isInside(root, real.value)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return real.value;\n}\n\nasync function normalizeCommand(\n  fs: FileSystem,\n  command: string,\n  pluginRoot: string,\n  context: Context,\n): Promise<string> {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = await realContainedPath(fs, pluginRoot, path.resolve(pluginRoot, command), 'command', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'file') {\n    throw new Error('command must resolve to a regular file');\n  }\n  // Execute bits stand in for access(X_OK); the edge has no modes, so nodeHost reports none and the check is skipped.\n  const mode = await nodeHost.fileMode(resolved);\n  if (mode !== undefined && (mode & 0o111) === 0) throw new Error('command must resolve to an executable file');\n  return resolved;\n}\n\nasync function normalizeWorkingDirectory(\n  fs: FileSystem,\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  context: Context,\n): Promise<string> {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = await realContainedPath(fs, declaredCwd.base, declaredCwd.candidate, 'cwd', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'directory') {\n    throw new Error('cwd must resolve to a directory');\n  }\n  return resolved;\n}\n\nasync function normalizeServer(\n  fs: FileSystem,\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n  context: Context,\n): Promise<NormalizedServer> {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = await normalizeCommand(fs, nonEmptyString(declaration.command, 'command'), pluginRoot, context);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = await normalizeWorkingDirectory(fs, declaration.cwd, pluginRoot, pluginDataDirectory, context);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\n/** Owner-only plugin data directory; a symbolic link or non-directory rejects the source. */\nasync function preparePluginDataDirectory(fs: FileSystem, directory: string, context: Context): Promise<string> {\n  const info = await fs.fileInfo(directory, context);\n  if (info.ok) {\n    if (info.value.kind !== 'directory') throw new Error('pluginDataDirectory must be a real directory');\n  } else if (info.error.code === 'not_found') {\n    getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n  } else {\n    throw info.error;\n  }\n  await nodeHost.setMode(directory, PRIVATE_DIRECTORY_MODE);\n  return getOrThrow(await fs.canonicalPath(directory, context));\n}\n\n/**\n * Content-addressed and owner-only. The name hashes the contents, so replacing an\n * existing staged file through a uniquely named temporary file never changes what it holds.\n */\nasync function writeStagedInternalConfig(\n  fs: FileSystem,\n  target: string,\n  contents: string,\n  stagingDirectory: string,\n  context: Context,\n): Promise<void> {\n  getOrThrow(await fs.createDir(stagingDirectory, { recursive: true }, context));\n  await nodeHost.setMode(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  await writeFileAtomic(fs, target, contents, context);\n  await nodeHost.setMode(target, PRIVATE_FILE_MODE);\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer,\n * reading and writing through the injected file system.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n */\nexport async function normalizeAgentPluginMcpSourceAsync(\n  fs: FileSystem,\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n  context: Context,\n): Promise<NormalizedAgentPluginMcpSource> {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = getOrThrow(await fs.canonicalPath(source.pluginRoot, context));\n    const pluginDataDirectory = await preparePluginDataDirectory(fs, source.pluginDataDirectory, context);\n    const configPath = await realContainedPath(fs, pluginRoot, source.configPath, 'mcp.json', context);\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const bytes = getOrThrow(await fs.readBinaryFile(configPath, context));\n    const servers = parseMcpDocument(source, bytes, label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = await normalizeServer(fs, rawServer, pluginRoot, pluginDataDirectory, name, context);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    await writeStagedInternalConfig(fs, target, contents, options.stagingDirectory, context);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAOA,MAAM,aAAa;;AAEnB,MAAM,iCAAiC;AACvC,MAAM,aAAa;AACnB,MAAM,eAAe,IAAI,OAAO,IAAI,WAAW,QAAQ,WAAW,QAAQ,GAAG;AAE7E,SAAS,OAAO,OAAwB;CACtC,OAAO,aAAa,KAAK,KAAK;AAChC;AAIA,MAAa,4CAA4B,IAAI,IAAI,CAAC,eAAe,aAAa,CAAC;AAC/E,MAAa,uCAAuB,IAAI,IAAI,CAAC,aAAa,eAAe,CAAC;AAiC1E,SAAgB,SAAS,OAAqC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAgB,SAAS,OAAmB,SAA4B,OAAqB;CAC3F,MAAM,aAAa,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC1E,IAAI,YAAY,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,WAAW,EAAE;AACvF;AAEA,SAAgB,eAAe,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAC1G,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAqC;CACvF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;CACjF,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;EACnF,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,OAAmD;CAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;CACnF,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU;EACzC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,kBAAkB;EAChF,OAAO,CAAC,KAAK,IAAI;CACnB,CAAC,CACH;AACF;AAEA,SAAgB,yBAAyB,OAAe,YAAoB,qBAAqC;CAG/G,OAAO,MAAM,QAAQ,+BAA+B,gBAClD,gBAAgB,mBAAmB,aAAa,mBAClD;AACF;AAEA,SAAgB,SAAS,MAAc,WAA4B;CACjE,MAAM,WAAWA,UAAAA,QAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAKA,UAAAA,QAAK,KAAK,KAAK,aAAa,QAAQ,CAACA,UAAAA,QAAK,WAAW,QAAQ;AACpH;AAEA,SAAgB,qBACd,OACA,YACA,qBACwB;CACxB,MAAM,WAAW,qBAAqB,OAAO,KAAK,KAAK,CAAC;CACxD,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GAAG;EACvC,MAAM,cAAc,QAAQ,aAAa,UAAU,IAAI,YAAY,IAAI;EACvE,IAAI,0BAA0B,IAAI,WAAW,GAC3C,MAAM,IAAI,MAAM,YAAY,IAAI,+BAA+B;CAEnE;CACA,OAAO;EACL,GAAG,OAAO,YACR,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAC5C,KACA,yBAAyB,MAAM,YAAY,mBAAmB,CAChE,CAAC,CACH;EACA,aAAa;EACb,aAAa;CACf;AACF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,eAAe,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAClG,IAAI,aAAa,YAAY,MAAM,aAAa,OAAO;CACvD,IAAI,OAAO,YAAY,GAAG,OAAO,aAAa,MAAM,GAAG,CAAC,CAAC,OAAO;CAChE,OAAO,iBAAiB;AAC1B;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,MAAM,eAAe,OAAO,KAAK;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,qCAAqC;CACvD;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,OAAO,YAAY,OAAO,UAAU,MAAM,IAAI,MAAM,uCAAuC;CAC/F,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,iCAAiC;CAClE,IAAI,OAAO,aAAa,WAAW,CAAC,eAAe,OAAO,QAAQ,GAChE,MAAM,IAAI,MAAM,sCAAsC;CAExD,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAAoD;CACnF,MAAM,UAAU,qBAAqB,OAAO,SAAS;CACrD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,YAAY,KAAK,YAAY;EACnC,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;EACnF,KAAK,IAAI,SAAS;EAClB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,+BAA+B,KAAK,IAAI,GACpE,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;CAEjD;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,UACA,kBACQ;CACR,MAAM,UAAA,GAASC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAChC,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAOD,UAAAA,QAAK,KAAK,kBAAkB,oBAAoB,OAAO,eAAe;AAC/E;AAEA,SAAgB,YAAY,YAAoD;CAC9E,OAAO;EACL,cAAc,EAAE,YAAY,CAAC,EAAE;EAC/B,aAAa,CAAC;EACd,gBAAgB,CAAC;EACjB,aAAa,CAAC,UAAU;CAC1B;AACF;AAEA,SAAgB,YAAY,QAAkD;CAC5E,OAAO,4BAA4B,OAAO,SAAS;AACrD;;AAGA,SAAgB,uBAAuB,QAAgD;CACrF,IAAI,OAAO,iBAAiBE,iCAAAA,6BAC1B,MAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,YAAY,EAAE,EAAE;CAEvE,IAAI,CAACF,UAAAA,QAAK,WAAW,OAAO,UAAU,KAAK,CAACA,UAAAA,QAAK,WAAW,OAAO,mBAAmB,GACpF,MAAM,IAAI,MAAM,qDAAqD;AAEzE;AAEA,SAAgB,qBAAqB,YAAoB,YAA0B;CACjF,IAAIA,UAAAA,QAAK,QAAQ,UAAU,MAAM,cAAcA,UAAAA,QAAK,SAAS,UAAU,MAAM,YAC3E,MAAM,IAAI,MAAM,8CAA8C;AAElE;;AAGA,SAAgB,iBACd,QACA,OACA,OACyB;CAEzB,KAAA,GADeC,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAChD,MAAM,OAAO,eAAe,MAAM,IAAI,MAAM,8CAA8C;CACnG,MAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC9F,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B;CACnE,SAAS,QAAQ,CAAC,WAAW,YAAY,GAAG,KAAK;CACjD,IAAI,OAAO,YAAY,OAAO,cAAc,MAAM,IAAI,MAAM,6CAA6C;CACzG,IAAI,CAAC,SAAS,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAChF,OAAO,OAAO;AAChB;;AAGA,SAAgB,kBAAkB,MAAc,SAAuE;CACrH,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,CAAC,WAAW,QAAQ,WAAW;CAC/C,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,IAAK,CAAC,WAAW,CAAC,QAAQ,SAAS,IAAI,KAAO,sBAAsB,qBAAqB,IAAI,IAAI,GAAI,OAAO;CAC5G,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAuB;CAC3D,OAAO,GAAG,MAAM;AAClB;AAEA,SAAgB,wBAAwB,OAAe,MAAc,OAAwB;CAC3F,OAAO,GAAG,MAAM,mBAAmB,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpG;AAEA,SAAgB,eAAe,OAAe,OAAgD;CAC5F,OAAO,YAAY,GAAG,MAAM,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;AACvG;;AAGA,SAAgB,WAAW,KAAc,MAAsB;CAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAClE,MAAM,OAAO,eAAe,IAAI,MAAM,MAAM;CAC5C,IAAI,SAAS,SAAS,SAAS,KAAK;EAAC;EAAQ;EAAW;EAAQ;EAAO;CAAK,GAAG,WAAW,KAAK,EAAE;CACjG,OAAO;AACT;AAEA,SAAgB,YACd,MACA,QACkB;CAClB,OAAO;EACL,UAAU;GAAE;GAAM,WAAW;GAAS;EAAO;EAC7C,QAAQ;GAAE,MAAM;GAAS,GAAG;EAAO;CACrC;AACF;;AAGA,SAAgB,aAAa,KAAiB,MAAc,MAAgC;CAC1F,IAAI,SAAS,qBAAqB,SAAS,OAAO;EAChD,SAAS,KAAK;GAAC;GAAQ;GAAO;EAAS,GAAG,WAAW,KAAK,EAAE;EAC5D,MAAM,MAAM,aAAa,IAAI,GAAG;EAChC,MAAM,UAAU,iBAAiB,IAAI,OAAO;EAC5C,MAAM,YAAY,SAAS,oBAAoB,SAAS;EACxD,MAAM,SAAS;GAAE;GAAK,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAG;EACtD,OAAO;GACL,UAAU;IAAE;IAAM;IAAW;GAAO;GACpC,QAAQ;IAAE,MAAM;IAAW,GAAG;GAAO;EACvC;CACF;CACA,MAAM,IAAI,MAAM,+BAA+B,KAAK,EAAE;AACxD;AAEA,SAAgB,eAAe,iBAAqD;CAClF,OAAO,GAAG,KAAK,UAAU,EAAE,YAAY,gBAAgB,GAAG,MAAM,CAAC,EAAE;AACrE;AAEA,SAAgB,eAAe,QAA0C,YAAoB,UAA0B;CACrH,QAAA,GAAOA,YAAAA,WAAAA,CAAW,QAAQ,CAAC,CACxB,OAAO,mBAAmB,CAAC,CAC3B,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,UAAU,CAAC,CAClB,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK;AACjB;;AAGA,SAAgB,0BACd,UACA,YACA,qBACiD;CACjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,MAAM,eAAe,UAAU,KAAK;CAC1C,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EAAE,MAAM;EAAY,WAAWD,UAAAA,QAAK,QAAQ,YAAY,GAAG;CAAE;CAC9F,MAAM,WAAW,yBAAyB,KAAK,YAAY,mBAAmB;CAC9E,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAY,WAAWA,UAAAA,QAAK,QAAQ,QAAQ;CAAE;CAE/D,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAqB,WAAWA,UAAAA,QAAK,QAAQ,QAAQ;CAAE;CAExE,MAAM,IAAI,MAAM,2DAA2D;AAC7E;;AAGA,SAAgB,wBAAwB,SAA0B;CAChE,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,YAAY,OAAO,YAAY,QAAQ,WAAW,KAAK,OAAO,GAChE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;;;ACjSA,SAASG,oBAAkB,MAAc,WAAmB,OAAuB;CACjF,IAAI;CACJ,IAAI;EACF,gBAAgBC,QAAAA,QAAG,aAAa,SAAS;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CAC3C;CACA,IAAI,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CACnG,OAAO;AACT;AAEA,SAASC,mBAAiB,SAAiB,YAA4B;CACrE,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAWF,oBAAkB,YAAYG,UAAAA,QAAK,QAAQ,YAAY,OAAO,GAAG,SAAS;CAC3F,IAAI,CAACF,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC7F,IAAI;EACF,QAAA,QAAG,WAAW,UAAUA,QAAAA,QAAG,UAAU,IAAI;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,OAAO;AACT;AAEA,SAASG,4BAA0B,UAAmB,YAAoB,qBAAqC;CAC7G,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAWJ,oBAAkB,YAAY,MAAM,YAAY,WAAW,KAAK;CACjF,IAAI,CAACC,QAAAA,QAAG,SAAS,QAAQ,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,iCAAiC;CAC3F,OAAO;AACT;AAEA,SAASI,kBACP,KACA,YACA,qBACA,MACkB;CAClB,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAUH,mBAAiB,eAAe,YAAY,SAAS,SAAS,GAAG,UAAU;CAC3F,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAME,4BAA0B,YAAY,KAAK,YAAY,mBAAmB;CACtF,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;AAEA,SAASE,4BAA0B,QAAgB,UAAkB,kBAAgC;CACnG,QAAA,QAAG,UAAU,kBAAkB;EAAE,MAAA;EAA8B,WAAW;CAAK,CAAC;CAChF,QAAA,QAAG,UAAU,kBAAA,GAAwC;CACrD,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,IAAI,IAAA,GAAGC,YAAAA,WAAAA,CAAW,EAAE;CAC/D,IAAI;EACF,QAAA,QAAG,cAAc,eAAe,UAAU;GAAE,MAAM;GAAM,MAAA;EAAwB,CAAC;EACjF,IAAI;GACF,QAAA,QAAG,WAAW,eAAe,MAAM;EACrC,SAAS,OAAO;GACd,MAAM,OAAQ,MAAgC;GAC9C,IAAI,SAAS,YAAY,SAAS,SAAS,MAAM;GACjD,MAAM,OAAON,QAAAA,QAAG,UAAU,MAAM;GAChC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAKA,QAAAA,QAAG,aAAa,QAAQ,MAAM,MAAM,UACjF,MAAM,IAAI,MAAM,iEAAiE;EAErF;EACA,QAAA,QAAG,UAAU,QAAA,GAAyB;CACxC,UAAU;EACR,QAAA,QAAG,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;CAC1C;AACF;;;;;;;;;;;AAYA,SAAgB,8BACd,QACA,SACgC;CAChC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAaA,QAAAA,QAAG,aAAa,OAAO,UAAU;EACpD,IAAI;GACF,MAAM,WAAWA,QAAAA,QAAG,UAAU,OAAO,mBAAmB;GACxD,IAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAElE,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAC9D,QAAA,QAAG,UAAU,OAAO,qBAAqB;IAAE,MAAA;IAA8B,WAAW;GAAK,CAAC;EAC5F;EACA,QAAA,QAAG,UAAU,OAAO,qBAAA,GAA2C;EAC/D,QAAA,QAAG,WAAW,OAAO,qBAAqBA,QAAAA,QAAG,UAAU,IAAI;EAC3D,MAAM,sBAAsBA,QAAAA,QAAG,aAAa,OAAO,mBAAmB;EACtE,MAAM,aAAaD,oBAAkB,YAAY,OAAO,YAAY,UAAU;EAC9E,qBAAqB,YAAY,UAAU;EAE3C,MAAM,UAAU,iBAAiB,QAAQC,QAAAA,QAAG,aAAa,UAAU,GAAG,KAAK;EAC3E,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAaI,kBAAgB,WAAW,YAAY,qBAAqB,IAAI;IACnF,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,4BAA0B,QAAQ,UAAU,QAAQ,gBAAgB;EACpE,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF;;;ACvIA,eAAe,kBACb,IACA,MACA,WACA,OACA,SACiB;CACjB,MAAM,OAAO,MAAM,GAAG,cAAc,WAAW,OAAO;CACtD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CACvD,IAAI,CAAC,SAAS,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CAChG,OAAO,KAAK;AACd;AAEA,eAAe,iBACb,IACA,SACA,YACA,SACiB;CACjB,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAYG,UAAAA,QAAK,QAAQ,YAAY,OAAO,GAAG,WAAW,OAAO;CAC9G,KAAA,GAAIC,4BAAAA,WAAAA,CAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,QAC5D,MAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,OAAO,MAAMC,4BAAAA,SAAS,SAAS,QAAQ;CAC7C,IAAI,SAAS,KAAA,MAAc,OAAO,QAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5G,OAAO;AACT;AAEA,eAAe,0BACb,IACA,UACA,YACA,qBACA,SACiB;CACjB,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,MAAM,YAAY,WAAW,OAAO,OAAO;CACpG,KAAA,GAAID,4BAAAA,WAAAA,CAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,aAC5D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO;AACT;AAEA,eAAe,gBACb,IACA,KACA,YACA,qBACA,MACA,SAC2B;CAC3B,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAU,MAAM,iBAAiB,IAAI,eAAe,YAAY,SAAS,SAAS,GAAG,YAAY,OAAO;CAC9G,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAM,MAAM,0BAA0B,IAAI,YAAY,KAAK,YAAY,qBAAqB,OAAO;CACzG,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;;AAGA,eAAe,2BAA2B,IAAgB,WAAmB,SAAmC;CAC9G,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,OAAO;CACjD,IAAI,KAAK,IACH;MAAA,KAAK,MAAM,SAAS,aAAa,MAAM,IAAI,MAAM,8CAA8C;CAAA,OAC9F,IAAI,KAAK,MAAM,SAAS,aAC7B,CAAA,GAAA,4BAAA,WAAA,CAAW,MAAM,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;MAEtE,MAAM,KAAK;CAEb,MAAMC,4BAAAA,SAAS,QAAQ,WAAA,GAAiC;CACxD,QAAA,GAAOD,4BAAAA,WAAAA,CAAW,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC;AAC9D;;;;;AAMA,eAAe,0BACb,IACA,QACA,UACA,kBACA,SACe;CACf,CAAA,GAAA,4BAAA,WAAA,CAAW,MAAM,GAAG,UAAU,kBAAkB,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;CAC7E,MAAMC,4BAAAA,SAAS,QAAQ,kBAAA,GAAwC;CAC/D,OAAA,GAAMC,4BAAAA,gBAAAA,CAAgB,IAAI,QAAQ,UAAU,OAAO;CACnD,MAAMD,4BAAAA,SAAS,QAAQ,QAAA,GAAyB;AAClD;;;;;;;;;;AAWA,eAAsB,mCACpB,IACA,QACA,SACA,SACyC;CACzC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,cAAA,GAAaD,4BAAAA,WAAAA,CAAW,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,CAAC;EAChF,MAAM,sBAAsB,MAAM,2BAA2B,IAAI,OAAO,qBAAqB,OAAO;EACpG,MAAM,aAAa,MAAM,kBAAkB,IAAI,YAAY,OAAO,YAAY,YAAY,OAAO;EACjG,qBAAqB,YAAY,UAAU;EAG3C,MAAM,UAAU,iBAAiB,SAD3B,GAAQA,4BAAAA,WAAAA,CAAW,MAAM,GAAG,eAAe,YAAY,OAAO,CAC3B,GAAO,KAAK;EACrD,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAa,MAAM,gBAAgB,IAAI,WAAW,YAAY,qBAAqB,MAAM,OAAO;IACtG,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,MAAM,0BAA0B,IAAI,QAAQ,UAAU,QAAQ,kBAAkB,OAAO;EACvF,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF"}

package/dist/agentPluginMcp.d.mts

@@ -1,5 +1,5 @@
 import { FileSystem } from "@agimon-ai/po-core/platform";
-import { DoomMcpAgentPluginProjectionSource } from "@agimon-ai/po-core/mcpProjection";
+import { PoMcpAgentPluginProjectionSource } from "@agimon-ai/po-core/mcpProjection";
 //#region src/services/agentPluginMcp/normalize.d.ts
 type JsonObject = Record<string, unknown>;
 interface AgentPluginMcpConfigSource {
@@ -22,7 +22,7 @@ interface NormalizeAgentPluginMcpOptions {
   stagingDirectory: string;
   /** Empty and absent lists both mean keep every server. */
   allowedServers?: readonly string[];
-  /** Doom strips nested wrappers; external-only callers may opt out. */
+  /** Po strips nested wrappers; external-only callers may opt out. */
   stripProxyWrappers?: boolean;
 }
 //#endregion
@@ -37,7 +37,7 @@ interface NormalizeAgentPluginMcpOptions {
  *
  * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.
  */
-export declare function normalizeAgentPluginMcpSource(source: DoomMcpAgentPluginProjectionSource, options: NormalizeAgentPluginMcpOptions): NormalizedAgentPluginMcpSource;
+export declare function normalizeAgentPluginMcpSource(source: PoMcpAgentPluginProjectionSource, options: NormalizeAgentPluginMcpOptions): NormalizedAgentPluginMcpSource;
 //#endregion
 //#region src/services/agentPluginMcp/index.d.ts
 type Context = Parameters<FileSystem['readTextFile']>[1];
@@ -50,7 +50,7 @@ type Context = Parameters<FileSystem['readTextFile']>[1];
  * source. Only the two portable plugin placeholders are expanded; the staged
  * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.
  */
-export declare function normalizeAgentPluginMcpSourceAsync(fs: FileSystem, source: DoomMcpAgentPluginProjectionSource, options: NormalizeAgentPluginMcpOptions, context: Context): Promise<NormalizedAgentPluginMcpSource>;
+export declare function normalizeAgentPluginMcpSourceAsync(fs: FileSystem, source: PoMcpAgentPluginProjectionSource, options: NormalizeAgentPluginMcpOptions, context: Context): Promise<NormalizedAgentPluginMcpSource>;
 //#endregion
 export type { AgentPluginMcpConfigSource, NormalizeAgentPluginMcpOptions, NormalizedAgentPluginMcpSource };
 //# sourceMappingURL=agentPluginMcp.d.mts.map

package/dist/agentPluginMcp.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"agentPluginMcp.d.mts","names":[],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"mappings":";;;KAsBY,aAAa;UAER;EACf;EACA;EACA;;UAGe;;EAEf,eAAe;;EAEf;IAAgB,YAAY,eAAe;;EAC3C;EACA;EACA;;UAGe;EACf;;EAEA;;EAEA;;;;;;;;;;;;;;wBCwEc,8BACd,QAAQ,oCACR,SAAS,iCACR;;;KC9EE,UAAU,WAAW;;;;;;;;;;wBA4GJ,mCACpB,IAAI,YACJ,QAAQ,oCACR,SAAS,gCACT,SAAS,UACR,QAAQ"}
+{"version":3,"file":"agentPluginMcp.d.mts","names":[],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"mappings":";;;KAsBY,aAAa;UAER;EACf;EACA;EACA;;UAGe;;EAEf,eAAe;;EAEf;IAAgB,YAAY,eAAe;;EAC3C;EACA;EACA;;UAGe;EACf;;EAEA;;EAEA;;;;;;;;;;;;;;wBCwEc,8BACd,QAAQ,kCACR,SAAS,iCACR;;;KC9EE,UAAU,WAAW;;;;;;;;;;wBA4GJ,mCACpB,IAAI,YACJ,QAAQ,kCACR,SAAS,gCACT,SAAS,UACR,QAAQ"}

package/dist/agentPluginMcp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"agentPluginMcp.mjs","names":["realContainedPath","normalizeCommand","normalizeWorkingDirectory","normalizeServer","writeStagedInternalConfig"],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"sourcesContent":["/** Pure Agent Plugin MCP normalisation shared by the async API and the deprecated Node-only sync shim. */\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\n\nimport { AGENT_PLUGIN_MCP_SCHEMA_URL, type DoomMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\n/** Same token grammar as node:http `validateHeaderName` (RFC 9110 tchar). */\nconst HTTP_TOKEN = /^[\\^_`a-zA-Z\\-0-9!#$%&'*+.|~]+$/u;\n/** Same rejected characters as node:http `validateHeaderValue`. */\nconst INVALID_HEADER_VALUE_CHARACTER = /[^\\t\\x20-\\x7e\\x80-\\xff]/u;\nconst IPV4_OCTET = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]?\\\\d)';\nconst IPV4_ADDRESS = new RegExp(`^${IPV4_OCTET}(?:\\\\.${IPV4_OCTET}){3}$`, 'u');\n\nfunction isIPv4(value: string): boolean {\n  return IPV4_ADDRESS.test(value);\n}\n\nexport const PRIVATE_FILE_MODE = 0o600;\nexport const PRIVATE_DIRECTORY_MODE = 0o700;\nexport const RESERVED_ENVIRONMENT_KEYS = new Set(['PLUGIN_ROOT', 'PLUGIN_DATA']);\nexport const PROXY_SERVER_ALIASES = new Set(['mcp-proxy', 'agiflow-proxy']);\n\nexport type JsonObject = Record<string, unknown>;\n\nexport interface AgentPluginMcpConfigSource {\n  path: string;\n  format: 'internal';\n  cacheKey: string;\n}\n\nexport interface NormalizedAgentPluginMcpSource {\n  /** Owner-only, content-addressed layer that bypasses Claude env interpolation. */\n  configSource?: AgentPluginMcpConfigSource;\n  /** Claude-compatible definitions for an external merged config. */\n  claudeConfig: { mcpServers: Record<string, JsonObject> };\n  serverNames: string[];\n  droppedServers: string[];\n  diagnostics: string[];\n}\n\nexport interface NormalizeAgentPluginMcpOptions {\n  stagingDirectory: string;\n  /** Empty and absent lists both mean keep every server. */\n  allowedServers?: readonly string[];\n  /** Doom strips nested wrappers; external-only callers may opt out. */\n  stripProxyWrappers?: boolean;\n}\n\nexport interface NormalizedServer {\n  internal: JsonObject;\n  claude: JsonObject;\n}\n\nexport function isObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function onlyKeys(value: JsonObject, allowed: readonly string[], label: string): void {\n  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));\n  if (unexpected) throw new Error(`${label} contains unsupported field \"${unexpected}\"`);\n}\n\nexport function nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nexport function optionalStringArray(value: unknown, label: string): string[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error(`${label} must be an array of strings`);\n  return value.map((item, index) => {\n    if (typeof item !== 'string') throw new Error(`${label}[${index}] must be a string`);\n    return item;\n  });\n}\n\nfunction optionalStringRecord(value: unknown, label: string): Record<string, string> | undefined {\n  if (value === undefined) return undefined;\n  if (!isObject(value)) throw new Error(`${label} must be an object of string values`);\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => {\n      if (typeof item !== 'string') throw new Error(`${label}.${key} must be a string`);\n      return [key, item];\n    }),\n  );\n}\n\nexport function expandPluginPlaceholders(value: string, pluginRoot: string, pluginDataDirectory: string): string {\n  // The portable contract is a single, non-recursive replacement pass. An\n  // unrecognised placeholder remains literal and mcp-proxy must not reinterpret it.\n  return value.replace(/\\$\\{PLUGIN_(ROOT|DATA)\\}/gu, (placeholder) =>\n    placeholder === '${PLUGIN_ROOT}' ? pluginRoot : pluginDataDirectory,\n  );\n}\n\nexport function isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));\n}\n\nexport function normalizeEnvironment(\n  value: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): Record<string, string> {\n  const declared = optionalStringRecord(value, 'env') ?? {};\n  for (const key of Object.keys(declared)) {\n    const reservedKey = process.platform === 'win32' ? key.toUpperCase() : key;\n    if (RESERVED_ENVIRONMENT_KEYS.has(reservedKey)) {\n      throw new Error(`env key \"${key}\" is reserved by Agent Plugins`);\n    }\n  }\n  return {\n    ...Object.fromEntries(\n      Object.entries(declared).map(([key, item]) => [\n        key,\n        expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n      ]),\n    ),\n    PLUGIN_ROOT: pluginRoot,\n    PLUGIN_DATA: pluginDataDirectory,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const bareHostname = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (bareHostname.toLowerCase() === 'localhost') return true;\n  if (isIPv4(bareHostname)) return bareHostname.split('.')[0] === '127';\n  return bareHostname === '::1';\n}\n\nexport function normalizeUrl(value: unknown): string {\n  const raw = nonEmptyString(value, 'url');\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('url must be an absolute HTTP(S) URL');\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error('url must use http or https');\n  }\n  if (parsed.username || parsed.password) throw new Error('url must not contain user information');\n  if (parsed.hash) throw new Error('url must not contain a fragment');\n  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {\n    throw new Error('non-loopback MCP URLs must use https');\n  }\n  return raw;\n}\n\nexport function normalizeHeaders(value: unknown): Record<string, string> | undefined {\n  const headers = optionalStringRecord(value, 'headers');\n  if (!headers) return undefined;\n  const seen = new Set<string>();\n  for (const [name, item] of Object.entries(headers)) {\n    const canonical = name.toLowerCase();\n    if (seen.has(canonical)) throw new Error(`headers contain duplicate name \"${name}\"`);\n    seen.add(canonical);\n    if (!HTTP_TOKEN.test(name) || INVALID_HEADER_VALUE_CHARACTER.test(item)) {\n      throw new Error(`header \"${name}\" is invalid`);\n    }\n  }\n  return headers;\n}\n\nexport function stagedInternalPath(\n  source: DoomMcpAgentPluginProjectionSource,\n  contents: string,\n  stagingDirectory: string,\n): string {\n  const digest = createHash('sha256')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(contents)\n    .digest('hex')\n    .slice(0, 20);\n  return path.join(stagingDirectory, `agent-plugin-mcp-${digest}.internal.json`);\n}\n\nexport function emptyResult(diagnostic: string): NormalizedAgentPluginMcpSource {\n  return {\n    claudeConfig: { mcpServers: {} },\n    serverNames: [],\n    droppedServers: [],\n    diagnostics: [diagnostic],\n  };\n}\n\nexport function sourceLabel(source: DoomMcpAgentPluginProjectionSource): string {\n  return `Agent Plugin MCP source \"${source.sourceId}\"`;\n}\n\n/** Checks the projection identity before any file is touched. */\nexport function assertProjectionSource(source: DoomMcpAgentPluginProjectionSource): void {\n  if (source.mcpSchemaUrl !== AGENT_PLUGIN_MCP_SCHEMA_URL) {\n    throw new Error(`unsupported schema \"${String(source.mcpSchemaUrl)}\"`);\n  }\n  if (!path.isAbsolute(source.pluginRoot) || !path.isAbsolute(source.pluginDataDirectory)) {\n    throw new Error('pluginRoot and pluginDataDirectory must be absolute');\n  }\n}\n\nexport function assertRootConfigPath(configPath: string, pluginRoot: string): void {\n  if (path.dirname(configPath) !== pluginRoot || path.basename(configPath) !== 'mcp.json') {\n    throw new Error('portable plugin config must be root mcp.json');\n  }\n}\n\n/** Verifies the digest and document shape of the raw mcp.json bytes; returns its server map. */\nexport function parseMcpDocument(\n  source: DoomMcpAgentPluginProjectionSource,\n  bytes: Uint8Array,\n  label: string,\n): Record<string, unknown> {\n  const digest = createHash('sha256').update(bytes).digest('hex');\n  if (digest !== source.contentDigest) throw new Error('content digest does not match the projection');\n  const parsed: unknown = JSON.parse(new TextDecoder('utf-8', { ignoreBOM: true }).decode(bytes));\n  if (!isObject(parsed)) throw new Error('document must be an object');\n  onlyKeys(parsed, ['$schema', 'mcpServers'], label);\n  if (parsed.$schema !== source.mcpSchemaUrl) throw new Error('$schema does not match the projected schema');\n  if (!isObject(parsed.mcpServers)) throw new Error('mcpServers must be an object');\n  return parsed.mcpServers;\n}\n\n/** Whether a declared server is skipped (empty name), dropped by the allowlist or wrapper rule, or normalised. */\nexport function serverDisposition(name: string, options: NormalizeAgentPluginMcpOptions): 'empty' | 'dropped' | 'keep' {\n  if (!name) return 'empty';\n  const allowed = options.allowedServers;\n  const keepAll = !allowed || allowed.length === 0;\n  const stripProxyWrappers = options.stripProxyWrappers ?? true;\n  if ((!keepAll && !allowed.includes(name)) || (stripProxyWrappers && PROXY_SERVER_ALIASES.has(name))) return 'dropped';\n  return 'keep';\n}\n\nexport function emptyServerDiagnostic(label: string): string {\n  return `${label} contains an empty server name; that entry was skipped.`;\n}\n\nexport function skippedServerDiagnostic(label: string, name: string, error: unknown): string {\n  return `${label} skipped server \"${name}\": ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function disabledResult(label: string, error: unknown): NormalizedAgentPluginMcpSource {\n  return emptyResult(`${label} was disabled: ${error instanceof Error ? error.message : String(error)}`);\n}\n\n/** The declared transport of one server; stdio declarations are also checked for unsupported fields. */\nexport function serverType(raw: unknown, name: string): string {\n  if (!isObject(raw)) throw new Error('definition must be an object');\n  const type = nonEmptyString(raw.type, 'type');\n  if (type === 'stdio') onlyKeys(raw, ['type', 'command', 'args', 'env', 'cwd'], `server \"${name}\"`);\n  return type;\n}\n\nexport function stdioServer(\n  name: string,\n  config: { command: string; args?: string[]; env: Record<string, string>; cwd: string },\n): NormalizedServer {\n  return {\n    internal: { name, transport: 'stdio', config },\n    claude: { type: 'stdio', ...config },\n  };\n}\n\n/** A streamable-http or sse server; any other type is unsupported. */\nexport function remoteServer(raw: JsonObject, name: string, type: string): NormalizedServer {\n  if (type === 'streamable-http' || type === 'sse') {\n    onlyKeys(raw, ['type', 'url', 'headers'], `server \"${name}\"`);\n    const url = normalizeUrl(raw.url);\n    const headers = normalizeHeaders(raw.headers);\n    const transport = type === 'streamable-http' ? 'http' : 'sse';\n    const config = { url, ...(headers ? { headers } : {}) };\n    return {\n      internal: { name, transport, config },\n      claude: { type: transport, ...config },\n    };\n  }\n  throw new Error(`unsupported transport type \"${type}\"`);\n}\n\nexport function stagedContents(internalServers: Record<string, JsonObject>): string {\n  return `${JSON.stringify({ mcpServers: internalServers }, null, 2)}\\n`;\n}\n\nexport function stagedCacheKey(\n  source: DoomMcpAgentPluginProjectionSource,\n  configPath: string,\n  contents: string,\n): string {\n  return createHash('sha256')\n    .update('agent-plugin-v1\\0')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(configPath)\n    .update('\\0')\n    .update(contents)\n    .digest('hex');\n}\n\n/** The containment base and expanded path of a declared cwd, or undefined when the plugin root is the default. */\nexport function workingDirectoryCandidate(\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): { base: string; candidate: string } | undefined {\n  if (declared === undefined) return undefined;\n  const cwd = nonEmptyString(declared, 'cwd');\n  if (cwd.startsWith('./')) return { base: pluginRoot, candidate: path.resolve(pluginRoot, cwd) };\n  const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginDataDirectory);\n  if (cwd === '${PLUGIN_ROOT}' || cwd.startsWith('${PLUGIN_ROOT}/')) {\n    return { base: pluginRoot, candidate: path.resolve(expanded) };\n  }\n  if (cwd === '${PLUGIN_DATA}' || cwd.startsWith('${PLUGIN_DATA}/')) {\n    return { base: pluginDataDirectory, candidate: path.resolve(expanded) };\n  }\n  throw new Error('cwd must start with ./, ${PLUGIN_ROOT}, or ${PLUGIN_DATA}');\n}\n\n/** Rejects a command that is neither a bare executable name nor a ./ path; true when it must be resolved. */\nexport function isPluginRelativeCommand(command: string): boolean {\n  if (command.startsWith('./')) return true;\n  if (command === '.' || command === '..' || /[\\s/\\\\]/u.test(command)) {\n    throw new Error('command must be a bare executable name or a ./ path inside the plugin');\n  }\n  return false;\n}\n","import { randomUUID } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { DoomMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nfunction realContainedPath(root: string, candidate: string, label: string): string {\n  let realCandidate: string;\n  try {\n    realCandidate = fs.realpathSync(candidate);\n  } catch {\n    throw new Error(`${label} does not exist`);\n  }\n  if (!isInside(root, realCandidate)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return realCandidate;\n}\n\nfunction normalizeCommand(command: string, pluginRoot: string): string {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = realContainedPath(pluginRoot, path.resolve(pluginRoot, command), 'command');\n  if (!fs.statSync(resolved).isFile()) throw new Error('command must resolve to a regular file');\n  try {\n    fs.accessSync(resolved, fs.constants.X_OK);\n  } catch {\n    throw new Error('command must resolve to an executable file');\n  }\n  return resolved;\n}\n\nfunction normalizeWorkingDirectory(declared: unknown, pluginRoot: string, pluginDataDirectory: string): string {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = realContainedPath(declaredCwd.base, declaredCwd.candidate, 'cwd');\n  if (!fs.statSync(resolved).isDirectory()) throw new Error('cwd must resolve to a directory');\n  return resolved;\n}\n\nfunction normalizeServer(\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n): NormalizedServer {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = normalizeCommand(nonEmptyString(declaration.command, 'command'), pluginRoot);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = normalizeWorkingDirectory(declaration.cwd, pluginRoot, pluginDataDirectory);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\nfunction writeStagedInternalConfig(target: string, contents: string, stagingDirectory: string): void {\n  fs.mkdirSync(stagingDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n  fs.chmodSync(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  const temporaryPath = `${target}.${process.pid}-${randomUUID()}.tmp`;\n  try {\n    fs.writeFileSync(temporaryPath, contents, { flag: 'wx', mode: PRIVATE_FILE_MODE });\n    try {\n      fs.renameSync(temporaryPath, target);\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n      if (code !== 'EEXIST' && code !== 'EPERM') throw error;\n      const stat = fs.lstatSync(target);\n      if (stat.isSymbolicLink() || !stat.isFile() || fs.readFileSync(target, 'utf8') !== contents) {\n        throw new Error('content-addressed staging path is occupied by different content');\n      }\n    }\n    fs.chmodSync(target, PRIVATE_FILE_MODE);\n  } finally {\n    fs.rmSync(temporaryPath, { force: true });\n  }\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n *\n * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.\n */\nexport function normalizeAgentPluginMcpSource(\n  source: DoomMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n): NormalizedAgentPluginMcpSource {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = fs.realpathSync(source.pluginRoot);\n    try {\n      const dataStat = fs.lstatSync(source.pluginDataDirectory);\n      if (dataStat.isSymbolicLink() || !dataStat.isDirectory()) {\n        throw new Error('pluginDataDirectory must be a real directory');\n      }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      fs.mkdirSync(source.pluginDataDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n    }\n    fs.chmodSync(source.pluginDataDirectory, PRIVATE_DIRECTORY_MODE);\n    fs.accessSync(source.pluginDataDirectory, fs.constants.W_OK);\n    const pluginDataDirectory = fs.realpathSync(source.pluginDataDirectory);\n    const configPath = realContainedPath(pluginRoot, source.configPath, 'mcp.json');\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const servers = parseMcpDocument(source, fs.readFileSync(configPath), label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = normalizeServer(rawServer, pluginRoot, pluginDataDirectory, name);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    writeStagedInternalConfig(target, contents, options.stagingDirectory);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n","import path from 'node:path';\n\nimport type { DoomMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\nimport { type FileSystem, getOrThrow, nodeHost, writeFileAtomic } from '@agimon-ai/po-core/platform';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nexport type {\n  AgentPluginMcpConfigSource,\n  NormalizeAgentPluginMcpOptions,\n  NormalizedAgentPluginMcpSource,\n} from './normalize';\nexport { normalizeAgentPluginMcpSource } from './sync';\n\ntype Context = Parameters<FileSystem['readTextFile']>[1];\n\nasync function realContainedPath(\n  fs: FileSystem,\n  root: string,\n  candidate: string,\n  label: string,\n  context: Context,\n): Promise<string> {\n  const real = await fs.canonicalPath(candidate, context);\n  if (!real.ok) throw new Error(`${label} does not exist`);\n  if (!isInside(root, real.value)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return real.value;\n}\n\nasync function normalizeCommand(\n  fs: FileSystem,\n  command: string,\n  pluginRoot: string,\n  context: Context,\n): Promise<string> {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = await realContainedPath(fs, pluginRoot, path.resolve(pluginRoot, command), 'command', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'file') {\n    throw new Error('command must resolve to a regular file');\n  }\n  // Execute bits stand in for access(X_OK); the edge has no modes, so nodeHost reports none and the check is skipped.\n  const mode = await nodeHost.fileMode(resolved);\n  if (mode !== undefined && (mode & 0o111) === 0) throw new Error('command must resolve to an executable file');\n  return resolved;\n}\n\nasync function normalizeWorkingDirectory(\n  fs: FileSystem,\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  context: Context,\n): Promise<string> {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = await realContainedPath(fs, declaredCwd.base, declaredCwd.candidate, 'cwd', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'directory') {\n    throw new Error('cwd must resolve to a directory');\n  }\n  return resolved;\n}\n\nasync function normalizeServer(\n  fs: FileSystem,\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n  context: Context,\n): Promise<NormalizedServer> {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = await normalizeCommand(fs, nonEmptyString(declaration.command, 'command'), pluginRoot, context);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = await normalizeWorkingDirectory(fs, declaration.cwd, pluginRoot, pluginDataDirectory, context);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\n/** Owner-only plugin data directory; a symbolic link or non-directory rejects the source. */\nasync function preparePluginDataDirectory(fs: FileSystem, directory: string, context: Context): Promise<string> {\n  const info = await fs.fileInfo(directory, context);\n  if (info.ok) {\n    if (info.value.kind !== 'directory') throw new Error('pluginDataDirectory must be a real directory');\n  } else if (info.error.code === 'not_found') {\n    getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n  } else {\n    throw info.error;\n  }\n  await nodeHost.setMode(directory, PRIVATE_DIRECTORY_MODE);\n  return getOrThrow(await fs.canonicalPath(directory, context));\n}\n\n/**\n * Content-addressed and owner-only. The name hashes the contents, so replacing an\n * existing staged file through a uniquely named temporary file never changes what it holds.\n */\nasync function writeStagedInternalConfig(\n  fs: FileSystem,\n  target: string,\n  contents: string,\n  stagingDirectory: string,\n  context: Context,\n): Promise<void> {\n  getOrThrow(await fs.createDir(stagingDirectory, { recursive: true }, context));\n  await nodeHost.setMode(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  await writeFileAtomic(fs, target, contents, context);\n  await nodeHost.setMode(target, PRIVATE_FILE_MODE);\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer,\n * reading and writing through the injected file system.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n */\nexport async function normalizeAgentPluginMcpSourceAsync(\n  fs: FileSystem,\n  source: DoomMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n  context: Context,\n): Promise<NormalizedAgentPluginMcpSource> {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = getOrThrow(await fs.canonicalPath(source.pluginRoot, context));\n    const pluginDataDirectory = await preparePluginDataDirectory(fs, source.pluginDataDirectory, context);\n    const configPath = await realContainedPath(fs, pluginRoot, source.configPath, 'mcp.json', context);\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const bytes = getOrThrow(await fs.readBinaryFile(configPath, context));\n    const servers = parseMcpDocument(source, bytes, label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = await normalizeServer(fs, rawServer, pluginRoot, pluginDataDirectory, name, context);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    await writeStagedInternalConfig(fs, target, contents, options.stagingDirectory, context);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,aAAa;;AAEnB,MAAM,iCAAiC;AACvC,MAAM,aAAa;AACnB,MAAM,eAAe,IAAI,OAAO,IAAI,WAAW,QAAQ,WAAW,QAAQ,GAAG;AAE7E,SAAS,OAAO,OAAwB;CACtC,OAAO,aAAa,KAAK,KAAK;AAChC;AAIA,MAAa,4CAA4B,IAAI,IAAI,CAAC,eAAe,aAAa,CAAC;AAC/E,MAAa,uCAAuB,IAAI,IAAI,CAAC,aAAa,eAAe,CAAC;AAiC1E,SAAgB,SAAS,OAAqC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAgB,SAAS,OAAmB,SAA4B,OAAqB;CAC3F,MAAM,aAAa,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC1E,IAAI,YAAY,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,WAAW,EAAE;AACvF;AAEA,SAAgB,eAAe,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAC1G,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAqC;CACvF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;CACjF,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;EACnF,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,OAAmD;CAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;CACnF,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU;EACzC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,kBAAkB;EAChF,OAAO,CAAC,KAAK,IAAI;CACnB,CAAC,CACH;AACF;AAEA,SAAgB,yBAAyB,OAAe,YAAoB,qBAAqC;CAG/G,OAAO,MAAM,QAAQ,+BAA+B,gBAClD,gBAAgB,mBAAmB,aAAa,mBAClD;AACF;AAEA,SAAgB,SAAS,MAAc,WAA4B;CACjE,MAAM,WAAW,KAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAK,KAAK,KAAK,KAAK,aAAa,QAAQ,CAAC,KAAK,WAAW,QAAQ;AACpH;AAEA,SAAgB,qBACd,OACA,YACA,qBACwB;CACxB,MAAM,WAAW,qBAAqB,OAAO,KAAK,KAAK,CAAC;CACxD,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GAAG;EACvC,MAAM,cAAc,QAAQ,aAAa,UAAU,IAAI,YAAY,IAAI;EACvE,IAAI,0BAA0B,IAAI,WAAW,GAC3C,MAAM,IAAI,MAAM,YAAY,IAAI,+BAA+B;CAEnE;CACA,OAAO;EACL,GAAG,OAAO,YACR,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAC5C,KACA,yBAAyB,MAAM,YAAY,mBAAmB,CAChE,CAAC,CACH;EACA,aAAa;EACb,aAAa;CACf;AACF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,eAAe,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAClG,IAAI,aAAa,YAAY,MAAM,aAAa,OAAO;CACvD,IAAI,OAAO,YAAY,GAAG,OAAO,aAAa,MAAM,GAAG,CAAC,CAAC,OAAO;CAChE,OAAO,iBAAiB;AAC1B;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,MAAM,eAAe,OAAO,KAAK;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,qCAAqC;CACvD;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,OAAO,YAAY,OAAO,UAAU,MAAM,IAAI,MAAM,uCAAuC;CAC/F,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,iCAAiC;CAClE,IAAI,OAAO,aAAa,WAAW,CAAC,eAAe,OAAO,QAAQ,GAChE,MAAM,IAAI,MAAM,sCAAsC;CAExD,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAAoD;CACnF,MAAM,UAAU,qBAAqB,OAAO,SAAS;CACrD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,YAAY,KAAK,YAAY;EACnC,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;EACnF,KAAK,IAAI,SAAS;EAClB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,+BAA+B,KAAK,IAAI,GACpE,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;CAEjD;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,UACA,kBACQ;CACR,MAAM,SAAS,WAAW,QAAQ,CAAC,CAChC,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,KAAK,KAAK,kBAAkB,oBAAoB,OAAO,eAAe;AAC/E;AAEA,SAAgB,YAAY,YAAoD;CAC9E,OAAO;EACL,cAAc,EAAE,YAAY,CAAC,EAAE;EAC/B,aAAa,CAAC;EACd,gBAAgB,CAAC;EACjB,aAAa,CAAC,UAAU;CAC1B;AACF;AAEA,SAAgB,YAAY,QAAoD;CAC9E,OAAO,4BAA4B,OAAO,SAAS;AACrD;;AAGA,SAAgB,uBAAuB,QAAkD;CACvF,IAAI,OAAO,iBAAiB,6BAC1B,MAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,YAAY,EAAE,EAAE;CAEvE,IAAI,CAAC,KAAK,WAAW,OAAO,UAAU,KAAK,CAAC,KAAK,WAAW,OAAO,mBAAmB,GACpF,MAAM,IAAI,MAAM,qDAAqD;AAEzE;AAEA,SAAgB,qBAAqB,YAAoB,YAA0B;CACjF,IAAI,KAAK,QAAQ,UAAU,MAAM,cAAc,KAAK,SAAS,UAAU,MAAM,YAC3E,MAAM,IAAI,MAAM,8CAA8C;AAElE;;AAGA,SAAgB,iBACd,QACA,OACA,OACyB;CAEzB,IADe,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAChD,MAAM,OAAO,eAAe,MAAM,IAAI,MAAM,8CAA8C;CACnG,MAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC9F,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B;CACnE,SAAS,QAAQ,CAAC,WAAW,YAAY,GAAG,KAAK;CACjD,IAAI,OAAO,YAAY,OAAO,cAAc,MAAM,IAAI,MAAM,6CAA6C;CACzG,IAAI,CAAC,SAAS,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAChF,OAAO,OAAO;AAChB;;AAGA,SAAgB,kBAAkB,MAAc,SAAuE;CACrH,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,CAAC,WAAW,QAAQ,WAAW;CAC/C,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,IAAK,CAAC,WAAW,CAAC,QAAQ,SAAS,IAAI,KAAO,sBAAsB,qBAAqB,IAAI,IAAI,GAAI,OAAO;CAC5G,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAuB;CAC3D,OAAO,GAAG,MAAM;AAClB;AAEA,SAAgB,wBAAwB,OAAe,MAAc,OAAwB;CAC3F,OAAO,GAAG,MAAM,mBAAmB,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpG;AAEA,SAAgB,eAAe,OAAe,OAAgD;CAC5F,OAAO,YAAY,GAAG,MAAM,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;AACvG;;AAGA,SAAgB,WAAW,KAAc,MAAsB;CAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAClE,MAAM,OAAO,eAAe,IAAI,MAAM,MAAM;CAC5C,IAAI,SAAS,SAAS,SAAS,KAAK;EAAC;EAAQ;EAAW;EAAQ;EAAO;CAAK,GAAG,WAAW,KAAK,EAAE;CACjG,OAAO;AACT;AAEA,SAAgB,YACd,MACA,QACkB;CAClB,OAAO;EACL,UAAU;GAAE;GAAM,WAAW;GAAS;EAAO;EAC7C,QAAQ;GAAE,MAAM;GAAS,GAAG;EAAO;CACrC;AACF;;AAGA,SAAgB,aAAa,KAAiB,MAAc,MAAgC;CAC1F,IAAI,SAAS,qBAAqB,SAAS,OAAO;EAChD,SAAS,KAAK;GAAC;GAAQ;GAAO;EAAS,GAAG,WAAW,KAAK,EAAE;EAC5D,MAAM,MAAM,aAAa,IAAI,GAAG;EAChC,MAAM,UAAU,iBAAiB,IAAI,OAAO;EAC5C,MAAM,YAAY,SAAS,oBAAoB,SAAS;EACxD,MAAM,SAAS;GAAE;GAAK,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAG;EACtD,OAAO;GACL,UAAU;IAAE;IAAM;IAAW;GAAO;GACpC,QAAQ;IAAE,MAAM;IAAW,GAAG;GAAO;EACvC;CACF;CACA,MAAM,IAAI,MAAM,+BAA+B,KAAK,EAAE;AACxD;AAEA,SAAgB,eAAe,iBAAqD;CAClF,OAAO,GAAG,KAAK,UAAU,EAAE,YAAY,gBAAgB,GAAG,MAAM,CAAC,EAAE;AACrE;AAEA,SAAgB,eACd,QACA,YACA,UACQ;CACR,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,mBAAmB,CAAC,CAC3B,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,UAAU,CAAC,CAClB,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK;AACjB;;AAGA,SAAgB,0BACd,UACA,YACA,qBACiD;CACjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,MAAM,eAAe,UAAU,KAAK;CAC1C,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EAAE,MAAM;EAAY,WAAW,KAAK,QAAQ,YAAY,GAAG;CAAE;CAC9F,MAAM,WAAW,yBAAyB,KAAK,YAAY,mBAAmB;CAC9E,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAY,WAAW,KAAK,QAAQ,QAAQ;CAAE;CAE/D,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAqB,WAAW,KAAK,QAAQ,QAAQ;CAAE;CAExE,MAAM,IAAI,MAAM,2DAA2D;AAC7E;;AAGA,SAAgB,wBAAwB,SAA0B;CAChE,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,YAAY,OAAO,YAAY,QAAQ,WAAW,KAAK,OAAO,GAChE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;;;ACrSA,SAASA,oBAAkB,MAAc,WAAmB,OAAuB;CACjF,IAAI;CACJ,IAAI;EACF,gBAAgB,GAAG,aAAa,SAAS;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CAC3C;CACA,IAAI,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CACnG,OAAO;AACT;AAEA,SAASC,mBAAiB,SAAiB,YAA4B;CACrE,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAWD,oBAAkB,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG,SAAS;CAC3F,IAAI,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC7F,IAAI;EACF,GAAG,WAAW,UAAU,GAAG,UAAU,IAAI;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,OAAO;AACT;AAEA,SAASE,4BAA0B,UAAmB,YAAoB,qBAAqC;CAC7G,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAWF,oBAAkB,YAAY,MAAM,YAAY,WAAW,KAAK;CACjF,IAAI,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,iCAAiC;CAC3F,OAAO;AACT;AAEA,SAASG,kBACP,KACA,YACA,qBACA,MACkB;CAClB,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAUF,mBAAiB,eAAe,YAAY,SAAS,SAAS,GAAG,UAAU;CAC3F,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAMC,4BAA0B,YAAY,KAAK,YAAY,mBAAmB;CACtF,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;AAEA,SAASE,4BAA0B,QAAgB,UAAkB,kBAAgC;CACnG,GAAG,UAAU,kBAAkB;EAAE,MAAA;EAA8B,WAAW;CAAK,CAAC;CAChF,GAAG,UAAU,kBAAA,GAAwC;CACrD,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,IAAI,GAAG,WAAW,EAAE;CAC/D,IAAI;EACF,GAAG,cAAc,eAAe,UAAU;GAAE,MAAM;GAAM,MAAA;EAAwB,CAAC;EACjF,IAAI;GACF,GAAG,WAAW,eAAe,MAAM;EACrC,SAAS,OAAO;GACd,MAAM,OAAQ,MAAgC;GAC9C,IAAI,SAAS,YAAY,SAAS,SAAS,MAAM;GACjD,MAAM,OAAO,GAAG,UAAU,MAAM;GAChC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAK,GAAG,aAAa,QAAQ,MAAM,MAAM,UACjF,MAAM,IAAI,MAAM,iEAAiE;EAErF;EACA,GAAG,UAAU,QAAA,GAAyB;CACxC,UAAU;EACR,GAAG,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;CAC1C;AACF;;;;;;;;;;;AAYA,SAAgB,8BACd,QACA,SACgC;CAChC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAa,GAAG,aAAa,OAAO,UAAU;EACpD,IAAI;GACF,MAAM,WAAW,GAAG,UAAU,OAAO,mBAAmB;GACxD,IAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAElE,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAC9D,GAAG,UAAU,OAAO,qBAAqB;IAAE,MAAA;IAA8B,WAAW;GAAK,CAAC;EAC5F;EACA,GAAG,UAAU,OAAO,qBAAA,GAA2C;EAC/D,GAAG,WAAW,OAAO,qBAAqB,GAAG,UAAU,IAAI;EAC3D,MAAM,sBAAsB,GAAG,aAAa,OAAO,mBAAmB;EACtE,MAAM,aAAaJ,oBAAkB,YAAY,OAAO,YAAY,UAAU;EAC9E,qBAAqB,YAAY,UAAU;EAE3C,MAAM,UAAU,iBAAiB,QAAQ,GAAG,aAAa,UAAU,GAAG,KAAK;EAC3E,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAaG,kBAAgB,WAAW,YAAY,qBAAqB,IAAI;IACnF,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,4BAA0B,QAAQ,UAAU,QAAQ,gBAAgB;EACpE,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF;;;ACvIA,eAAe,kBACb,IACA,MACA,WACA,OACA,SACiB;CACjB,MAAM,OAAO,MAAM,GAAG,cAAc,WAAW,OAAO;CACtD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CACvD,IAAI,CAAC,SAAS,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CAChG,OAAO,KAAK;AACd;AAEA,eAAe,iBACb,IACA,SACA,YACA,SACiB;CACjB,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG,WAAW,OAAO;CAC9G,IAAI,WAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,QAC5D,MAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,OAAO,MAAM,SAAS,SAAS,QAAQ;CAC7C,IAAI,SAAS,KAAA,MAAc,OAAO,QAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5G,OAAO;AACT;AAEA,eAAe,0BACb,IACA,UACA,YACA,qBACA,SACiB;CACjB,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,MAAM,YAAY,WAAW,OAAO,OAAO;CACpG,IAAI,WAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,aAC5D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO;AACT;AAEA,eAAe,gBACb,IACA,KACA,YACA,qBACA,MACA,SAC2B;CAC3B,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAU,MAAM,iBAAiB,IAAI,eAAe,YAAY,SAAS,SAAS,GAAG,YAAY,OAAO;CAC9G,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAM,MAAM,0BAA0B,IAAI,YAAY,KAAK,YAAY,qBAAqB,OAAO;CACzG,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;;AAGA,eAAe,2BAA2B,IAAgB,WAAmB,SAAmC;CAC9G,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,OAAO;CACjD,IAAI,KAAK,IACH;MAAA,KAAK,MAAM,SAAS,aAAa,MAAM,IAAI,MAAM,8CAA8C;CAAA,OAC9F,IAAI,KAAK,MAAM,SAAS,aAC7B,WAAW,MAAM,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;MAEtE,MAAM,KAAK;CAEb,MAAM,SAAS,QAAQ,WAAA,GAAiC;CACxD,OAAO,WAAW,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC;AAC9D;;;;;AAMA,eAAe,0BACb,IACA,QACA,UACA,kBACA,SACe;CACf,WAAW,MAAM,GAAG,UAAU,kBAAkB,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;CAC7E,MAAM,SAAS,QAAQ,kBAAA,GAAwC;CAC/D,MAAM,gBAAgB,IAAI,QAAQ,UAAU,OAAO;CACnD,MAAM,SAAS,QAAQ,QAAA,GAAyB;AAClD;;;;;;;;;;AAWA,eAAsB,mCACpB,IACA,QACA,SACA,SACyC;CACzC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAa,WAAW,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,CAAC;EAChF,MAAM,sBAAsB,MAAM,2BAA2B,IAAI,OAAO,qBAAqB,OAAO;EACpG,MAAM,aAAa,MAAM,kBAAkB,IAAI,YAAY,OAAO,YAAY,YAAY,OAAO;EACjG,qBAAqB,YAAY,UAAU;EAG3C,MAAM,UAAU,iBAAiB,QADnB,WAAW,MAAM,GAAG,eAAe,YAAY,OAAO,CAC3B,GAAO,KAAK;EACrD,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAa,MAAM,gBAAgB,IAAI,WAAW,YAAY,qBAAqB,MAAM,OAAO;IACtG,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,MAAM,0BAA0B,IAAI,QAAQ,UAAU,QAAQ,kBAAkB,OAAO;EACvF,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF"}
+{"version":3,"file":"agentPluginMcp.mjs","names":["realContainedPath","normalizeCommand","normalizeWorkingDirectory","normalizeServer","writeStagedInternalConfig"],"sources":["../src/services/agentPluginMcp/normalize.ts","../src/services/agentPluginMcp/sync.ts","../src/services/agentPluginMcp/index.ts"],"sourcesContent":["/** Pure Agent Plugin MCP normalisation shared by the async API and the deprecated Node-only sync shim. */\nimport { createHash } from 'node:crypto';\nimport path from 'node:path';\n\nimport { AGENT_PLUGIN_MCP_SCHEMA_URL, type PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\n/** Same token grammar as node:http `validateHeaderName` (RFC 9110 tchar). */\nconst HTTP_TOKEN = /^[\\^_`a-zA-Z\\-0-9!#$%&'*+.|~]+$/u;\n/** Same rejected characters as node:http `validateHeaderValue`. */\nconst INVALID_HEADER_VALUE_CHARACTER = /[^\\t\\x20-\\x7e\\x80-\\xff]/u;\nconst IPV4_OCTET = '(?:25[0-5]|2[0-4]\\\\d|1\\\\d\\\\d|[1-9]?\\\\d)';\nconst IPV4_ADDRESS = new RegExp(`^${IPV4_OCTET}(?:\\\\.${IPV4_OCTET}){3}$`, 'u');\n\nfunction isIPv4(value: string): boolean {\n  return IPV4_ADDRESS.test(value);\n}\n\nexport const PRIVATE_FILE_MODE = 0o600;\nexport const PRIVATE_DIRECTORY_MODE = 0o700;\nexport const RESERVED_ENVIRONMENT_KEYS = new Set(['PLUGIN_ROOT', 'PLUGIN_DATA']);\nexport const PROXY_SERVER_ALIASES = new Set(['mcp-proxy', 'agiflow-proxy']);\n\nexport type JsonObject = Record<string, unknown>;\n\nexport interface AgentPluginMcpConfigSource {\n  path: string;\n  format: 'internal';\n  cacheKey: string;\n}\n\nexport interface NormalizedAgentPluginMcpSource {\n  /** Owner-only, content-addressed layer that bypasses Claude env interpolation. */\n  configSource?: AgentPluginMcpConfigSource;\n  /** Claude-compatible definitions for an external merged config. */\n  claudeConfig: { mcpServers: Record<string, JsonObject> };\n  serverNames: string[];\n  droppedServers: string[];\n  diagnostics: string[];\n}\n\nexport interface NormalizeAgentPluginMcpOptions {\n  stagingDirectory: string;\n  /** Empty and absent lists both mean keep every server. */\n  allowedServers?: readonly string[];\n  /** Po strips nested wrappers; external-only callers may opt out. */\n  stripProxyWrappers?: boolean;\n}\n\nexport interface NormalizedServer {\n  internal: JsonObject;\n  claude: JsonObject;\n}\n\nexport function isObject(value: unknown): value is JsonObject {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nexport function onlyKeys(value: JsonObject, allowed: readonly string[], label: string): void {\n  const unexpected = Object.keys(value).find((key) => !allowed.includes(key));\n  if (unexpected) throw new Error(`${label} contains unsupported field \"${unexpected}\"`);\n}\n\nexport function nonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || value.length === 0) throw new Error(`${label} must be a non-empty string`);\n  return value;\n}\n\nexport function optionalStringArray(value: unknown, label: string): string[] | undefined {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value)) throw new Error(`${label} must be an array of strings`);\n  return value.map((item, index) => {\n    if (typeof item !== 'string') throw new Error(`${label}[${index}] must be a string`);\n    return item;\n  });\n}\n\nfunction optionalStringRecord(value: unknown, label: string): Record<string, string> | undefined {\n  if (value === undefined) return undefined;\n  if (!isObject(value)) throw new Error(`${label} must be an object of string values`);\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => {\n      if (typeof item !== 'string') throw new Error(`${label}.${key} must be a string`);\n      return [key, item];\n    }),\n  );\n}\n\nexport function expandPluginPlaceholders(value: string, pluginRoot: string, pluginDataDirectory: string): string {\n  // The portable contract is a single, non-recursive replacement pass. An\n  // unrecognised placeholder remains literal and mcp-proxy must not reinterpret it.\n  return value.replace(/\\$\\{PLUGIN_(ROOT|DATA)\\}/gu, (placeholder) =>\n    placeholder === '${PLUGIN_ROOT}' ? pluginRoot : pluginDataDirectory,\n  );\n}\n\nexport function isInside(root: string, candidate: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));\n}\n\nexport function normalizeEnvironment(\n  value: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): Record<string, string> {\n  const declared = optionalStringRecord(value, 'env') ?? {};\n  for (const key of Object.keys(declared)) {\n    const reservedKey = process.platform === 'win32' ? key.toUpperCase() : key;\n    if (RESERVED_ENVIRONMENT_KEYS.has(reservedKey)) {\n      throw new Error(`env key \"${key}\" is reserved by Agent Plugins`);\n    }\n  }\n  return {\n    ...Object.fromEntries(\n      Object.entries(declared).map(([key, item]) => [\n        key,\n        expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n      ]),\n    ),\n    PLUGIN_ROOT: pluginRoot,\n    PLUGIN_DATA: pluginDataDirectory,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const bareHostname = hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (bareHostname.toLowerCase() === 'localhost') return true;\n  if (isIPv4(bareHostname)) return bareHostname.split('.')[0] === '127';\n  return bareHostname === '::1';\n}\n\nexport function normalizeUrl(value: unknown): string {\n  const raw = nonEmptyString(value, 'url');\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error('url must be an absolute HTTP(S) URL');\n  }\n  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n    throw new Error('url must use http or https');\n  }\n  if (parsed.username || parsed.password) throw new Error('url must not contain user information');\n  if (parsed.hash) throw new Error('url must not contain a fragment');\n  if (parsed.protocol === 'http:' && !isLoopbackHost(parsed.hostname)) {\n    throw new Error('non-loopback MCP URLs must use https');\n  }\n  return raw;\n}\n\nexport function normalizeHeaders(value: unknown): Record<string, string> | undefined {\n  const headers = optionalStringRecord(value, 'headers');\n  if (!headers) return undefined;\n  const seen = new Set<string>();\n  for (const [name, item] of Object.entries(headers)) {\n    const canonical = name.toLowerCase();\n    if (seen.has(canonical)) throw new Error(`headers contain duplicate name \"${name}\"`);\n    seen.add(canonical);\n    if (!HTTP_TOKEN.test(name) || INVALID_HEADER_VALUE_CHARACTER.test(item)) {\n      throw new Error(`header \"${name}\" is invalid`);\n    }\n  }\n  return headers;\n}\n\nexport function stagedInternalPath(\n  source: PoMcpAgentPluginProjectionSource,\n  contents: string,\n  stagingDirectory: string,\n): string {\n  const digest = createHash('sha256')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(contents)\n    .digest('hex')\n    .slice(0, 20);\n  return path.join(stagingDirectory, `agent-plugin-mcp-${digest}.internal.json`);\n}\n\nexport function emptyResult(diagnostic: string): NormalizedAgentPluginMcpSource {\n  return {\n    claudeConfig: { mcpServers: {} },\n    serverNames: [],\n    droppedServers: [],\n    diagnostics: [diagnostic],\n  };\n}\n\nexport function sourceLabel(source: PoMcpAgentPluginProjectionSource): string {\n  return `Agent Plugin MCP source \"${source.sourceId}\"`;\n}\n\n/** Checks the projection identity before any file is touched. */\nexport function assertProjectionSource(source: PoMcpAgentPluginProjectionSource): void {\n  if (source.mcpSchemaUrl !== AGENT_PLUGIN_MCP_SCHEMA_URL) {\n    throw new Error(`unsupported schema \"${String(source.mcpSchemaUrl)}\"`);\n  }\n  if (!path.isAbsolute(source.pluginRoot) || !path.isAbsolute(source.pluginDataDirectory)) {\n    throw new Error('pluginRoot and pluginDataDirectory must be absolute');\n  }\n}\n\nexport function assertRootConfigPath(configPath: string, pluginRoot: string): void {\n  if (path.dirname(configPath) !== pluginRoot || path.basename(configPath) !== 'mcp.json') {\n    throw new Error('portable plugin config must be root mcp.json');\n  }\n}\n\n/** Verifies the digest and document shape of the raw mcp.json bytes; returns its server map. */\nexport function parseMcpDocument(\n  source: PoMcpAgentPluginProjectionSource,\n  bytes: Uint8Array,\n  label: string,\n): Record<string, unknown> {\n  const digest = createHash('sha256').update(bytes).digest('hex');\n  if (digest !== source.contentDigest) throw new Error('content digest does not match the projection');\n  const parsed: unknown = JSON.parse(new TextDecoder('utf-8', { ignoreBOM: true }).decode(bytes));\n  if (!isObject(parsed)) throw new Error('document must be an object');\n  onlyKeys(parsed, ['$schema', 'mcpServers'], label);\n  if (parsed.$schema !== source.mcpSchemaUrl) throw new Error('$schema does not match the projected schema');\n  if (!isObject(parsed.mcpServers)) throw new Error('mcpServers must be an object');\n  return parsed.mcpServers;\n}\n\n/** Whether a declared server is skipped (empty name), dropped by the allowlist or wrapper rule, or normalised. */\nexport function serverDisposition(name: string, options: NormalizeAgentPluginMcpOptions): 'empty' | 'dropped' | 'keep' {\n  if (!name) return 'empty';\n  const allowed = options.allowedServers;\n  const keepAll = !allowed || allowed.length === 0;\n  const stripProxyWrappers = options.stripProxyWrappers ?? true;\n  if ((!keepAll && !allowed.includes(name)) || (stripProxyWrappers && PROXY_SERVER_ALIASES.has(name))) return 'dropped';\n  return 'keep';\n}\n\nexport function emptyServerDiagnostic(label: string): string {\n  return `${label} contains an empty server name; that entry was skipped.`;\n}\n\nexport function skippedServerDiagnostic(label: string, name: string, error: unknown): string {\n  return `${label} skipped server \"${name}\": ${error instanceof Error ? error.message : String(error)}`;\n}\n\nexport function disabledResult(label: string, error: unknown): NormalizedAgentPluginMcpSource {\n  return emptyResult(`${label} was disabled: ${error instanceof Error ? error.message : String(error)}`);\n}\n\n/** The declared transport of one server; stdio declarations are also checked for unsupported fields. */\nexport function serverType(raw: unknown, name: string): string {\n  if (!isObject(raw)) throw new Error('definition must be an object');\n  const type = nonEmptyString(raw.type, 'type');\n  if (type === 'stdio') onlyKeys(raw, ['type', 'command', 'args', 'env', 'cwd'], `server \"${name}\"`);\n  return type;\n}\n\nexport function stdioServer(\n  name: string,\n  config: { command: string; args?: string[]; env: Record<string, string>; cwd: string },\n): NormalizedServer {\n  return {\n    internal: { name, transport: 'stdio', config },\n    claude: { type: 'stdio', ...config },\n  };\n}\n\n/** A streamable-http or sse server; any other type is unsupported. */\nexport function remoteServer(raw: JsonObject, name: string, type: string): NormalizedServer {\n  if (type === 'streamable-http' || type === 'sse') {\n    onlyKeys(raw, ['type', 'url', 'headers'], `server \"${name}\"`);\n    const url = normalizeUrl(raw.url);\n    const headers = normalizeHeaders(raw.headers);\n    const transport = type === 'streamable-http' ? 'http' : 'sse';\n    const config = { url, ...(headers ? { headers } : {}) };\n    return {\n      internal: { name, transport, config },\n      claude: { type: transport, ...config },\n    };\n  }\n  throw new Error(`unsupported transport type \"${type}\"`);\n}\n\nexport function stagedContents(internalServers: Record<string, JsonObject>): string {\n  return `${JSON.stringify({ mcpServers: internalServers }, null, 2)}\\n`;\n}\n\nexport function stagedCacheKey(source: PoMcpAgentPluginProjectionSource, configPath: string, contents: string): string {\n  return createHash('sha256')\n    .update('agent-plugin-v1\\0')\n    .update(source.sourceId)\n    .update('\\0')\n    .update(source.contentDigest)\n    .update('\\0')\n    .update(configPath)\n    .update('\\0')\n    .update(contents)\n    .digest('hex');\n}\n\n/** The containment base and expanded path of a declared cwd, or undefined when the plugin root is the default. */\nexport function workingDirectoryCandidate(\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n): { base: string; candidate: string } | undefined {\n  if (declared === undefined) return undefined;\n  const cwd = nonEmptyString(declared, 'cwd');\n  if (cwd.startsWith('./')) return { base: pluginRoot, candidate: path.resolve(pluginRoot, cwd) };\n  const expanded = expandPluginPlaceholders(cwd, pluginRoot, pluginDataDirectory);\n  if (cwd === '${PLUGIN_ROOT}' || cwd.startsWith('${PLUGIN_ROOT}/')) {\n    return { base: pluginRoot, candidate: path.resolve(expanded) };\n  }\n  if (cwd === '${PLUGIN_DATA}' || cwd.startsWith('${PLUGIN_DATA}/')) {\n    return { base: pluginDataDirectory, candidate: path.resolve(expanded) };\n  }\n  throw new Error('cwd must start with ./, ${PLUGIN_ROOT}, or ${PLUGIN_DATA}');\n}\n\n/** Rejects a command that is neither a bare executable name nor a ./ path; true when it must be resolved. */\nexport function isPluginRelativeCommand(command: string): boolean {\n  if (command.startsWith('./')) return true;\n  if (command === '.' || command === '..' || /[\\s/\\\\]/u.test(command)) {\n    throw new Error('command must be a bare executable name or a ./ path inside the plugin');\n  }\n  return false;\n}\n","import { randomUUID } from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nfunction realContainedPath(root: string, candidate: string, label: string): string {\n  let realCandidate: string;\n  try {\n    realCandidate = fs.realpathSync(candidate);\n  } catch {\n    throw new Error(`${label} does not exist`);\n  }\n  if (!isInside(root, realCandidate)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return realCandidate;\n}\n\nfunction normalizeCommand(command: string, pluginRoot: string): string {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = realContainedPath(pluginRoot, path.resolve(pluginRoot, command), 'command');\n  if (!fs.statSync(resolved).isFile()) throw new Error('command must resolve to a regular file');\n  try {\n    fs.accessSync(resolved, fs.constants.X_OK);\n  } catch {\n    throw new Error('command must resolve to an executable file');\n  }\n  return resolved;\n}\n\nfunction normalizeWorkingDirectory(declared: unknown, pluginRoot: string, pluginDataDirectory: string): string {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = realContainedPath(declaredCwd.base, declaredCwd.candidate, 'cwd');\n  if (!fs.statSync(resolved).isDirectory()) throw new Error('cwd must resolve to a directory');\n  return resolved;\n}\n\nfunction normalizeServer(\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n): NormalizedServer {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = normalizeCommand(nonEmptyString(declaration.command, 'command'), pluginRoot);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = normalizeWorkingDirectory(declaration.cwd, pluginRoot, pluginDataDirectory);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\nfunction writeStagedInternalConfig(target: string, contents: string, stagingDirectory: string): void {\n  fs.mkdirSync(stagingDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n  fs.chmodSync(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  const temporaryPath = `${target}.${process.pid}-${randomUUID()}.tmp`;\n  try {\n    fs.writeFileSync(temporaryPath, contents, { flag: 'wx', mode: PRIVATE_FILE_MODE });\n    try {\n      fs.renameSync(temporaryPath, target);\n    } catch (error) {\n      const code = (error as NodeJS.ErrnoException).code;\n      if (code !== 'EEXIST' && code !== 'EPERM') throw error;\n      const stat = fs.lstatSync(target);\n      if (stat.isSymbolicLink() || !stat.isFile() || fs.readFileSync(target, 'utf8') !== contents) {\n        throw new Error('content-addressed staging path is occupied by different content');\n      }\n    }\n    fs.chmodSync(target, PRIVATE_FILE_MODE);\n  } finally {\n    fs.rmSync(temporaryPath, { force: true });\n  }\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n *\n * @deprecated Node-only sync shim; use normalizeAgentPluginMcpSourceAsync. Removed in M2.\n */\nexport function normalizeAgentPluginMcpSource(\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n): NormalizedAgentPluginMcpSource {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = fs.realpathSync(source.pluginRoot);\n    try {\n      const dataStat = fs.lstatSync(source.pluginDataDirectory);\n      if (dataStat.isSymbolicLink() || !dataStat.isDirectory()) {\n        throw new Error('pluginDataDirectory must be a real directory');\n      }\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;\n      fs.mkdirSync(source.pluginDataDirectory, { mode: PRIVATE_DIRECTORY_MODE, recursive: true });\n    }\n    fs.chmodSync(source.pluginDataDirectory, PRIVATE_DIRECTORY_MODE);\n    fs.accessSync(source.pluginDataDirectory, fs.constants.W_OK);\n    const pluginDataDirectory = fs.realpathSync(source.pluginDataDirectory);\n    const configPath = realContainedPath(pluginRoot, source.configPath, 'mcp.json');\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const servers = parseMcpDocument(source, fs.readFileSync(configPath), label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = normalizeServer(rawServer, pluginRoot, pluginDataDirectory, name);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    writeStagedInternalConfig(target, contents, options.stagingDirectory);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n","import path from 'node:path';\n\nimport type { PoMcpAgentPluginProjectionSource } from '@agimon-ai/po-core/mcpProjection';\nimport { type FileSystem, getOrThrow, nodeHost, writeFileAtomic } from '@agimon-ai/po-core/platform';\n\nimport {\n  type JsonObject,\n  type NormalizeAgentPluginMcpOptions,\n  type NormalizedAgentPluginMcpSource,\n  type NormalizedServer,\n  PRIVATE_DIRECTORY_MODE,\n  PRIVATE_FILE_MODE,\n  assertProjectionSource,\n  assertRootConfigPath,\n  disabledResult,\n  emptyServerDiagnostic,\n  expandPluginPlaceholders,\n  isInside,\n  isPluginRelativeCommand,\n  nonEmptyString,\n  normalizeEnvironment,\n  optionalStringArray,\n  parseMcpDocument,\n  remoteServer,\n  serverDisposition,\n  serverType,\n  skippedServerDiagnostic,\n  sourceLabel,\n  stagedCacheKey,\n  stagedContents,\n  stagedInternalPath,\n  stdioServer,\n  workingDirectoryCandidate,\n} from './normalize';\n\nexport type {\n  AgentPluginMcpConfigSource,\n  NormalizeAgentPluginMcpOptions,\n  NormalizedAgentPluginMcpSource,\n} from './normalize';\nexport { normalizeAgentPluginMcpSource } from './sync';\n\ntype Context = Parameters<FileSystem['readTextFile']>[1];\n\nasync function realContainedPath(\n  fs: FileSystem,\n  root: string,\n  candidate: string,\n  label: string,\n  context: Context,\n): Promise<string> {\n  const real = await fs.canonicalPath(candidate, context);\n  if (!real.ok) throw new Error(`${label} does not exist`);\n  if (!isInside(root, real.value)) throw new Error(`${label} escapes its allowed plugin directory`);\n  return real.value;\n}\n\nasync function normalizeCommand(\n  fs: FileSystem,\n  command: string,\n  pluginRoot: string,\n  context: Context,\n): Promise<string> {\n  if (!isPluginRelativeCommand(command)) return command;\n  const resolved = await realContainedPath(fs, pluginRoot, path.resolve(pluginRoot, command), 'command', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'file') {\n    throw new Error('command must resolve to a regular file');\n  }\n  // Execute bits stand in for access(X_OK); the edge has no modes, so nodeHost reports none and the check is skipped.\n  const mode = await nodeHost.fileMode(resolved);\n  if (mode !== undefined && (mode & 0o111) === 0) throw new Error('command must resolve to an executable file');\n  return resolved;\n}\n\nasync function normalizeWorkingDirectory(\n  fs: FileSystem,\n  declared: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  context: Context,\n): Promise<string> {\n  const declaredCwd = workingDirectoryCandidate(declared, pluginRoot, pluginDataDirectory);\n  if (!declaredCwd) return pluginRoot;\n  const resolved = await realContainedPath(fs, declaredCwd.base, declaredCwd.candidate, 'cwd', context);\n  if (getOrThrow(await fs.fileInfo(resolved, context)).kind !== 'directory') {\n    throw new Error('cwd must resolve to a directory');\n  }\n  return resolved;\n}\n\nasync function normalizeServer(\n  fs: FileSystem,\n  raw: unknown,\n  pluginRoot: string,\n  pluginDataDirectory: string,\n  name: string,\n  context: Context,\n): Promise<NormalizedServer> {\n  const type = serverType(raw, name);\n  const declaration = raw as JsonObject;\n  if (type !== 'stdio') return remoteServer(declaration, name, type);\n  const command = await normalizeCommand(fs, nonEmptyString(declaration.command, 'command'), pluginRoot, context);\n  const args = optionalStringArray(declaration.args, 'args')?.map((item) =>\n    expandPluginPlaceholders(item, pluginRoot, pluginDataDirectory),\n  );\n  const env = normalizeEnvironment(declaration.env, pluginRoot, pluginDataDirectory);\n  const cwd = await normalizeWorkingDirectory(fs, declaration.cwd, pluginRoot, pluginDataDirectory, context);\n  return stdioServer(name, { command, ...(args ? { args } : {}), env, cwd });\n}\n\n/** Owner-only plugin data directory; a symbolic link or non-directory rejects the source. */\nasync function preparePluginDataDirectory(fs: FileSystem, directory: string, context: Context): Promise<string> {\n  const info = await fs.fileInfo(directory, context);\n  if (info.ok) {\n    if (info.value.kind !== 'directory') throw new Error('pluginDataDirectory must be a real directory');\n  } else if (info.error.code === 'not_found') {\n    getOrThrow(await fs.createDir(directory, { recursive: true }, context));\n  } else {\n    throw info.error;\n  }\n  await nodeHost.setMode(directory, PRIVATE_DIRECTORY_MODE);\n  return getOrThrow(await fs.canonicalPath(directory, context));\n}\n\n/**\n * Content-addressed and owner-only. The name hashes the contents, so replacing an\n * existing staged file through a uniquely named temporary file never changes what it holds.\n */\nasync function writeStagedInternalConfig(\n  fs: FileSystem,\n  target: string,\n  contents: string,\n  stagingDirectory: string,\n  context: Context,\n): Promise<void> {\n  getOrThrow(await fs.createDir(stagingDirectory, { recursive: true }, context));\n  await nodeHost.setMode(stagingDirectory, PRIVATE_DIRECTORY_MODE);\n  await writeFileAtomic(fs, target, contents, context);\n  await nodeHost.setMode(target, PRIVATE_FILE_MODE);\n}\n\n/**\n * Validates one Agent Plugins v1 `mcp.json` and stages a native mcp-proxy layer,\n * reading and writing through the injected file system.\n *\n * Server validation is isolated: one malformed server is diagnosed and skipped.\n * Document/schema, source identity, or plugin-boundary failures reject the whole\n * source. Only the two portable plugin placeholders are expanded; the staged\n * layer is tagged `internal`, so legacy `${ENV}` interpolation cannot run again.\n */\nexport async function normalizeAgentPluginMcpSourceAsync(\n  fs: FileSystem,\n  source: PoMcpAgentPluginProjectionSource,\n  options: NormalizeAgentPluginMcpOptions,\n  context: Context,\n): Promise<NormalizedAgentPluginMcpSource> {\n  const label = sourceLabel(source);\n  try {\n    assertProjectionSource(source);\n    const pluginRoot = getOrThrow(await fs.canonicalPath(source.pluginRoot, context));\n    const pluginDataDirectory = await preparePluginDataDirectory(fs, source.pluginDataDirectory, context);\n    const configPath = await realContainedPath(fs, pluginRoot, source.configPath, 'mcp.json', context);\n    assertRootConfigPath(configPath, pluginRoot);\n\n    const bytes = getOrThrow(await fs.readBinaryFile(configPath, context));\n    const servers = parseMcpDocument(source, bytes, label);\n    const internalServers = Object.create(null) as Record<string, JsonObject>;\n    const claudeServers = Object.create(null) as Record<string, JsonObject>;\n    const droppedServers: string[] = [];\n    const diagnostics: string[] = [];\n\n    for (const [name, rawServer] of Object.entries(servers)) {\n      const disposition = serverDisposition(name, options);\n      if (disposition === 'empty') {\n        diagnostics.push(emptyServerDiagnostic(label));\n        continue;\n      }\n      if (disposition === 'dropped') {\n        droppedServers.push(name);\n        continue;\n      }\n      try {\n        const normalized = await normalizeServer(fs, rawServer, pluginRoot, pluginDataDirectory, name, context);\n        internalServers[name] = normalized.internal;\n        claudeServers[name] = normalized.claude;\n      } catch (error) {\n        droppedServers.push(name);\n        diagnostics.push(skippedServerDiagnostic(label, name, error));\n      }\n    }\n\n    const contents = stagedContents(internalServers);\n    const target = stagedInternalPath(source, contents, options.stagingDirectory);\n    await writeStagedInternalConfig(fs, target, contents, options.stagingDirectory, context);\n    return {\n      configSource: { path: target, format: 'internal', cacheKey: stagedCacheKey(source, configPath, contents) },\n      claudeConfig: { mcpServers: claudeServers },\n      serverNames: Object.keys(internalServers),\n      droppedServers,\n      diagnostics,\n    };\n  } catch (error) {\n    return disabledResult(label, error);\n  }\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,aAAa;;AAEnB,MAAM,iCAAiC;AACvC,MAAM,aAAa;AACnB,MAAM,eAAe,IAAI,OAAO,IAAI,WAAW,QAAQ,WAAW,QAAQ,GAAG;AAE7E,SAAS,OAAO,OAAwB;CACtC,OAAO,aAAa,KAAK,KAAK;AAChC;AAIA,MAAa,4CAA4B,IAAI,IAAI,CAAC,eAAe,aAAa,CAAC;AAC/E,MAAa,uCAAuB,IAAI,IAAI,CAAC,aAAa,eAAe,CAAC;AAiC1E,SAAgB,SAAS,OAAqC;CAC5D,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAgB,SAAS,OAAmB,SAA4B,OAAqB;CAC3F,MAAM,aAAa,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;CAC1E,IAAI,YAAY,MAAM,IAAI,MAAM,GAAG,MAAM,+BAA+B,WAAW,EAAE;AACvF;AAEA,SAAgB,eAAe,OAAgB,OAAuB;CACpE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,4BAA4B;CAC1G,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAgB,OAAqC;CACvF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;CACjF,OAAO,MAAM,KAAK,MAAM,UAAU;EAChC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,MAAM,mBAAmB;EACnF,OAAO;CACT,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAgB,OAAmD;CAC/F,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,oCAAoC;CACnF,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU;EACzC,IAAI,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,GAAG,MAAM,GAAG,IAAI,kBAAkB;EAChF,OAAO,CAAC,KAAK,IAAI;CACnB,CAAC,CACH;AACF;AAEA,SAAgB,yBAAyB,OAAe,YAAoB,qBAAqC;CAG/G,OAAO,MAAM,QAAQ,+BAA+B,gBAClD,gBAAgB,mBAAmB,aAAa,mBAClD;AACF;AAEA,SAAgB,SAAS,MAAc,WAA4B;CACjE,MAAM,WAAW,KAAK,SAAS,MAAM,SAAS;CAC9C,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAK,KAAK,KAAK,KAAK,aAAa,QAAQ,CAAC,KAAK,WAAW,QAAQ;AACpH;AAEA,SAAgB,qBACd,OACA,YACA,qBACwB;CACxB,MAAM,WAAW,qBAAqB,OAAO,KAAK,KAAK,CAAC;CACxD,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GAAG;EACvC,MAAM,cAAc,QAAQ,aAAa,UAAU,IAAI,YAAY,IAAI;EACvE,IAAI,0BAA0B,IAAI,WAAW,GAC3C,MAAM,IAAI,MAAM,YAAY,IAAI,+BAA+B;CAEnE;CACA,OAAO;EACL,GAAG,OAAO,YACR,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAC5C,KACA,yBAAyB,MAAM,YAAY,mBAAmB,CAChE,CAAC,CACH;EACA,aAAa;EACb,aAAa;CACf;AACF;AAEA,SAAS,eAAe,UAA2B;CACjD,MAAM,eAAe,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;CAClG,IAAI,aAAa,YAAY,MAAM,aAAa,OAAO;CACvD,IAAI,OAAO,YAAY,GAAG,OAAO,aAAa,MAAM,GAAG,CAAC,CAAC,OAAO;CAChE,OAAO,iBAAiB;AAC1B;AAEA,SAAgB,aAAa,OAAwB;CACnD,MAAM,MAAM,eAAe,OAAO,KAAK;CACvC,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,qCAAqC;CACvD;CACA,IAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UACrD,MAAM,IAAI,MAAM,4BAA4B;CAE9C,IAAI,OAAO,YAAY,OAAO,UAAU,MAAM,IAAI,MAAM,uCAAuC;CAC/F,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,iCAAiC;CAClE,IAAI,OAAO,aAAa,WAAW,CAAC,eAAe,OAAO,QAAQ,GAChE,MAAM,IAAI,MAAM,sCAAsC;CAExD,OAAO;AACT;AAEA,SAAgB,iBAAiB,OAAoD;CACnF,MAAM,UAAU,qBAAqB,OAAO,SAAS;CACrD,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,OAAO,GAAG;EAClD,MAAM,YAAY,KAAK,YAAY;EACnC,IAAI,KAAK,IAAI,SAAS,GAAG,MAAM,IAAI,MAAM,mCAAmC,KAAK,EAAE;EACnF,KAAK,IAAI,SAAS;EAClB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,+BAA+B,KAAK,IAAI,GACpE,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;CAEjD;CACA,OAAO;AACT;AAEA,SAAgB,mBACd,QACA,UACA,kBACQ;CACR,MAAM,SAAS,WAAW,QAAQ,CAAC,CAChC,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,KAAK,KAAK,kBAAkB,oBAAoB,OAAO,eAAe;AAC/E;AAEA,SAAgB,YAAY,YAAoD;CAC9E,OAAO;EACL,cAAc,EAAE,YAAY,CAAC,EAAE;EAC/B,aAAa,CAAC;EACd,gBAAgB,CAAC;EACjB,aAAa,CAAC,UAAU;CAC1B;AACF;AAEA,SAAgB,YAAY,QAAkD;CAC5E,OAAO,4BAA4B,OAAO,SAAS;AACrD;;AAGA,SAAgB,uBAAuB,QAAgD;CACrF,IAAI,OAAO,iBAAiB,6BAC1B,MAAM,IAAI,MAAM,uBAAuB,OAAO,OAAO,YAAY,EAAE,EAAE;CAEvE,IAAI,CAAC,KAAK,WAAW,OAAO,UAAU,KAAK,CAAC,KAAK,WAAW,OAAO,mBAAmB,GACpF,MAAM,IAAI,MAAM,qDAAqD;AAEzE;AAEA,SAAgB,qBAAqB,YAAoB,YAA0B;CACjF,IAAI,KAAK,QAAQ,UAAU,MAAM,cAAc,KAAK,SAAS,UAAU,MAAM,YAC3E,MAAM,IAAI,MAAM,8CAA8C;AAElE;;AAGA,SAAgB,iBACd,QACA,OACA,OACyB;CAEzB,IADe,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAChD,MAAM,OAAO,eAAe,MAAM,IAAI,MAAM,8CAA8C;CACnG,MAAM,SAAkB,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC9F,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,4BAA4B;CACnE,SAAS,QAAQ,CAAC,WAAW,YAAY,GAAG,KAAK;CACjD,IAAI,OAAO,YAAY,OAAO,cAAc,MAAM,IAAI,MAAM,6CAA6C;CACzG,IAAI,CAAC,SAAS,OAAO,UAAU,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAChF,OAAO,OAAO;AAChB;;AAGA,SAAgB,kBAAkB,MAAc,SAAuE;CACrH,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,UAAU,QAAQ;CACxB,MAAM,UAAU,CAAC,WAAW,QAAQ,WAAW;CAC/C,MAAM,qBAAqB,QAAQ,sBAAsB;CACzD,IAAK,CAAC,WAAW,CAAC,QAAQ,SAAS,IAAI,KAAO,sBAAsB,qBAAqB,IAAI,IAAI,GAAI,OAAO;CAC5G,OAAO;AACT;AAEA,SAAgB,sBAAsB,OAAuB;CAC3D,OAAO,GAAG,MAAM;AAClB;AAEA,SAAgB,wBAAwB,OAAe,MAAc,OAAwB;CAC3F,OAAO,GAAG,MAAM,mBAAmB,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpG;AAEA,SAAgB,eAAe,OAAe,OAAgD;CAC5F,OAAO,YAAY,GAAG,MAAM,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;AACvG;;AAGA,SAAgB,WAAW,KAAc,MAAsB;CAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,8BAA8B;CAClE,MAAM,OAAO,eAAe,IAAI,MAAM,MAAM;CAC5C,IAAI,SAAS,SAAS,SAAS,KAAK;EAAC;EAAQ;EAAW;EAAQ;EAAO;CAAK,GAAG,WAAW,KAAK,EAAE;CACjG,OAAO;AACT;AAEA,SAAgB,YACd,MACA,QACkB;CAClB,OAAO;EACL,UAAU;GAAE;GAAM,WAAW;GAAS;EAAO;EAC7C,QAAQ;GAAE,MAAM;GAAS,GAAG;EAAO;CACrC;AACF;;AAGA,SAAgB,aAAa,KAAiB,MAAc,MAAgC;CAC1F,IAAI,SAAS,qBAAqB,SAAS,OAAO;EAChD,SAAS,KAAK;GAAC;GAAQ;GAAO;EAAS,GAAG,WAAW,KAAK,EAAE;EAC5D,MAAM,MAAM,aAAa,IAAI,GAAG;EAChC,MAAM,UAAU,iBAAiB,IAAI,OAAO;EAC5C,MAAM,YAAY,SAAS,oBAAoB,SAAS;EACxD,MAAM,SAAS;GAAE;GAAK,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAAG;EACtD,OAAO;GACL,UAAU;IAAE;IAAM;IAAW;GAAO;GACpC,QAAQ;IAAE,MAAM;IAAW,GAAG;GAAO;EACvC;CACF;CACA,MAAM,IAAI,MAAM,+BAA+B,KAAK,EAAE;AACxD;AAEA,SAAgB,eAAe,iBAAqD;CAClF,OAAO,GAAG,KAAK,UAAU,EAAE,YAAY,gBAAgB,GAAG,MAAM,CAAC,EAAE;AACrE;AAEA,SAAgB,eAAe,QAA0C,YAAoB,UAA0B;CACrH,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,mBAAmB,CAAC,CAC3B,OAAO,OAAO,QAAQ,CAAC,CACvB,OAAO,IAAI,CAAC,CACZ,OAAO,OAAO,aAAa,CAAC,CAC5B,OAAO,IAAI,CAAC,CACZ,OAAO,UAAU,CAAC,CAClB,OAAO,IAAI,CAAC,CACZ,OAAO,QAAQ,CAAC,CAChB,OAAO,KAAK;AACjB;;AAGA,SAAgB,0BACd,UACA,YACA,qBACiD;CACjD,IAAI,aAAa,KAAA,GAAW,OAAO,KAAA;CACnC,MAAM,MAAM,eAAe,UAAU,KAAK;CAC1C,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EAAE,MAAM;EAAY,WAAW,KAAK,QAAQ,YAAY,GAAG;CAAE;CAC9F,MAAM,WAAW,yBAAyB,KAAK,YAAY,mBAAmB;CAC9E,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAY,WAAW,KAAK,QAAQ,QAAQ;CAAE;CAE/D,IAAI,QAAQ,oBAAoB,IAAI,WAAW,iBAAiB,GAC9D,OAAO;EAAE,MAAM;EAAqB,WAAW,KAAK,QAAQ,QAAQ;CAAE;CAExE,MAAM,IAAI,MAAM,2DAA2D;AAC7E;;AAGA,SAAgB,wBAAwB,SAA0B;CAChE,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,YAAY,OAAO,YAAY,QAAQ,WAAW,KAAK,OAAO,GAChE,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO;AACT;;;ACjSA,SAASA,oBAAkB,MAAc,WAAmB,OAAuB;CACjF,IAAI;CACJ,IAAI;EACF,gBAAgB,GAAG,aAAa,SAAS;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CAC3C;CACA,IAAI,CAAC,SAAS,MAAM,aAAa,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CACnG,OAAO;AACT;AAEA,SAASC,mBAAiB,SAAiB,YAA4B;CACrE,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAWD,oBAAkB,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG,SAAS;CAC3F,IAAI,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,OAAO,GAAG,MAAM,IAAI,MAAM,wCAAwC;CAC7F,IAAI;EACF,GAAG,WAAW,UAAU,GAAG,UAAU,IAAI;CAC3C,QAAQ;EACN,MAAM,IAAI,MAAM,4CAA4C;CAC9D;CACA,OAAO;AACT;AAEA,SAASE,4BAA0B,UAAmB,YAAoB,qBAAqC;CAC7G,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAWF,oBAAkB,YAAY,MAAM,YAAY,WAAW,KAAK;CACjF,IAAI,CAAC,GAAG,SAAS,QAAQ,CAAC,CAAC,YAAY,GAAG,MAAM,IAAI,MAAM,iCAAiC;CAC3F,OAAO;AACT;AAEA,SAASG,kBACP,KACA,YACA,qBACA,MACkB;CAClB,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAUF,mBAAiB,eAAe,YAAY,SAAS,SAAS,GAAG,UAAU;CAC3F,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAMC,4BAA0B,YAAY,KAAK,YAAY,mBAAmB;CACtF,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;AAEA,SAASE,4BAA0B,QAAgB,UAAkB,kBAAgC;CACnG,GAAG,UAAU,kBAAkB;EAAE,MAAA;EAA8B,WAAW;CAAK,CAAC;CAChF,GAAG,UAAU,kBAAA,GAAwC;CACrD,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,IAAI,GAAG,WAAW,EAAE;CAC/D,IAAI;EACF,GAAG,cAAc,eAAe,UAAU;GAAE,MAAM;GAAM,MAAA;EAAwB,CAAC;EACjF,IAAI;GACF,GAAG,WAAW,eAAe,MAAM;EACrC,SAAS,OAAO;GACd,MAAM,OAAQ,MAAgC;GAC9C,IAAI,SAAS,YAAY,SAAS,SAAS,MAAM;GACjD,MAAM,OAAO,GAAG,UAAU,MAAM;GAChC,IAAI,KAAK,eAAe,KAAK,CAAC,KAAK,OAAO,KAAK,GAAG,aAAa,QAAQ,MAAM,MAAM,UACjF,MAAM,IAAI,MAAM,iEAAiE;EAErF;EACA,GAAG,UAAU,QAAA,GAAyB;CACxC,UAAU;EACR,GAAG,OAAO,eAAe,EAAE,OAAO,KAAK,CAAC;CAC1C;AACF;;;;;;;;;;;AAYA,SAAgB,8BACd,QACA,SACgC;CAChC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAa,GAAG,aAAa,OAAO,UAAU;EACpD,IAAI;GACF,MAAM,WAAW,GAAG,UAAU,OAAO,mBAAmB;GACxD,IAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GACrD,MAAM,IAAI,MAAM,8CAA8C;EAElE,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU,MAAM;GAC9D,GAAG,UAAU,OAAO,qBAAqB;IAAE,MAAA;IAA8B,WAAW;GAAK,CAAC;EAC5F;EACA,GAAG,UAAU,OAAO,qBAAA,GAA2C;EAC/D,GAAG,WAAW,OAAO,qBAAqB,GAAG,UAAU,IAAI;EAC3D,MAAM,sBAAsB,GAAG,aAAa,OAAO,mBAAmB;EACtE,MAAM,aAAaJ,oBAAkB,YAAY,OAAO,YAAY,UAAU;EAC9E,qBAAqB,YAAY,UAAU;EAE3C,MAAM,UAAU,iBAAiB,QAAQ,GAAG,aAAa,UAAU,GAAG,KAAK;EAC3E,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAaG,kBAAgB,WAAW,YAAY,qBAAqB,IAAI;IACnF,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,4BAA0B,QAAQ,UAAU,QAAQ,gBAAgB;EACpE,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF;;;ACvIA,eAAe,kBACb,IACA,MACA,WACA,OACA,SACiB;CACjB,MAAM,OAAO,MAAM,GAAG,cAAc,WAAW,OAAO;CACtD,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,MAAM,GAAG,MAAM,gBAAgB;CACvD,IAAI,CAAC,SAAS,MAAM,KAAK,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sCAAsC;CAChG,OAAO,KAAK;AACd;AAEA,eAAe,iBACb,IACA,SACA,YACA,SACiB;CACjB,IAAI,CAAC,wBAAwB,OAAO,GAAG,OAAO;CAC9C,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,KAAK,QAAQ,YAAY,OAAO,GAAG,WAAW,OAAO;CAC9G,IAAI,WAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,QAC5D,MAAM,IAAI,MAAM,wCAAwC;CAG1D,MAAM,OAAO,MAAM,SAAS,SAAS,QAAQ;CAC7C,IAAI,SAAS,KAAA,MAAc,OAAO,QAAW,GAAG,MAAM,IAAI,MAAM,4CAA4C;CAC5G,OAAO;AACT;AAEA,eAAe,0BACb,IACA,UACA,YACA,qBACA,SACiB;CACjB,MAAM,cAAc,0BAA0B,UAAU,YAAY,mBAAmB;CACvF,IAAI,CAAC,aAAa,OAAO;CACzB,MAAM,WAAW,MAAM,kBAAkB,IAAI,YAAY,MAAM,YAAY,WAAW,OAAO,OAAO;CACpG,IAAI,WAAW,MAAM,GAAG,SAAS,UAAU,OAAO,CAAC,CAAC,CAAC,SAAS,aAC5D,MAAM,IAAI,MAAM,iCAAiC;CAEnD,OAAO;AACT;AAEA,eAAe,gBACb,IACA,KACA,YACA,qBACA,MACA,SAC2B;CAC3B,MAAM,OAAO,WAAW,KAAK,IAAI;CACjC,MAAM,cAAc;CACpB,IAAI,SAAS,SAAS,OAAO,aAAa,aAAa,MAAM,IAAI;CACjE,MAAM,UAAU,MAAM,iBAAiB,IAAI,eAAe,YAAY,SAAS,SAAS,GAAG,YAAY,OAAO;CAC9G,MAAM,OAAO,oBAAoB,YAAY,MAAM,MAAM,CAAC,EAAE,KAAK,SAC/D,yBAAyB,MAAM,YAAY,mBAAmB,CAChE;CACA,MAAM,MAAM,qBAAqB,YAAY,KAAK,YAAY,mBAAmB;CACjF,MAAM,MAAM,MAAM,0BAA0B,IAAI,YAAY,KAAK,YAAY,qBAAqB,OAAO;CACzG,OAAO,YAAY,MAAM;EAAE;EAAS,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EAAI;EAAK;CAAI,CAAC;AAC3E;;AAGA,eAAe,2BAA2B,IAAgB,WAAmB,SAAmC;CAC9G,MAAM,OAAO,MAAM,GAAG,SAAS,WAAW,OAAO;CACjD,IAAI,KAAK,IACH;MAAA,KAAK,MAAM,SAAS,aAAa,MAAM,IAAI,MAAM,8CAA8C;CAAA,OAC9F,IAAI,KAAK,MAAM,SAAS,aAC7B,WAAW,MAAM,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;MAEtE,MAAM,KAAK;CAEb,MAAM,SAAS,QAAQ,WAAA,GAAiC;CACxD,OAAO,WAAW,MAAM,GAAG,cAAc,WAAW,OAAO,CAAC;AAC9D;;;;;AAMA,eAAe,0BACb,IACA,QACA,UACA,kBACA,SACe;CACf,WAAW,MAAM,GAAG,UAAU,kBAAkB,EAAE,WAAW,KAAK,GAAG,OAAO,CAAC;CAC7E,MAAM,SAAS,QAAQ,kBAAA,GAAwC;CAC/D,MAAM,gBAAgB,IAAI,QAAQ,UAAU,OAAO;CACnD,MAAM,SAAS,QAAQ,QAAA,GAAyB;AAClD;;;;;;;;;;AAWA,eAAsB,mCACpB,IACA,QACA,SACA,SACyC;CACzC,MAAM,QAAQ,YAAY,MAAM;CAChC,IAAI;EACF,uBAAuB,MAAM;EAC7B,MAAM,aAAa,WAAW,MAAM,GAAG,cAAc,OAAO,YAAY,OAAO,CAAC;EAChF,MAAM,sBAAsB,MAAM,2BAA2B,IAAI,OAAO,qBAAqB,OAAO;EACpG,MAAM,aAAa,MAAM,kBAAkB,IAAI,YAAY,OAAO,YAAY,YAAY,OAAO;EACjG,qBAAqB,YAAY,UAAU;EAG3C,MAAM,UAAU,iBAAiB,QADnB,WAAW,MAAM,GAAG,eAAe,YAAY,OAAO,CAC3B,GAAO,KAAK;EACrD,MAAM,kBAAkB,OAAO,OAAO,IAAI;EAC1C,MAAM,gBAAgB,OAAO,OAAO,IAAI;EACxC,MAAM,iBAA2B,CAAC;EAClC,MAAM,cAAwB,CAAC;EAE/B,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,OAAO,GAAG;GACvD,MAAM,cAAc,kBAAkB,MAAM,OAAO;GACnD,IAAI,gBAAgB,SAAS;IAC3B,YAAY,KAAK,sBAAsB,KAAK,CAAC;IAC7C;GACF;GACA,IAAI,gBAAgB,WAAW;IAC7B,eAAe,KAAK,IAAI;IACxB;GACF;GACA,IAAI;IACF,MAAM,aAAa,MAAM,gBAAgB,IAAI,WAAW,YAAY,qBAAqB,MAAM,OAAO;IACtG,gBAAgB,QAAQ,WAAW;IACnC,cAAc,QAAQ,WAAW;GACnC,SAAS,OAAO;IACd,eAAe,KAAK,IAAI;IACxB,YAAY,KAAK,wBAAwB,OAAO,MAAM,KAAK,CAAC;GAC9D;EACF;EAEA,MAAM,WAAW,eAAe,eAAe;EAC/C,MAAM,SAAS,mBAAmB,QAAQ,UAAU,QAAQ,gBAAgB;EAC5E,MAAM,0BAA0B,IAAI,QAAQ,UAAU,QAAQ,kBAAkB,OAAO;EACvF,OAAO;GACL,cAAc;IAAE,MAAM;IAAQ,QAAQ;IAAY,UAAU,eAAe,QAAQ,YAAY,QAAQ;GAAE;GACzG,cAAc,EAAE,YAAY,cAAc;GAC1C,aAAa,OAAO,KAAK,eAAe;GACxC;GACA;EACF;CACF,SAAS,OAAO;EACd,OAAO,eAAe,OAAO,KAAK;CACpC;AACF"}

package/dist/apiContracts.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.cjs","names":["Type","jsonApiResponses","defineApiContract"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type DoomHttpContract } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst Text = Type.String();\nconst Optional = Type.Optional;\nconst Strings = Type.Array(Text);\nconst NullableText = Type.Union([Text, Type.Null()]);\nconst Scope = Type.Union([Type.Literal('global'), Type.Literal('repository')]);\nconst Origin = Type.Union([Type.Literal('global'), Type.Literal('repository'), Type.Literal('default')]);\nexport const SettingsConfigSchema = Type.Object({\n  repoRoot: Text,\n  hashes: Type.Object({ global: Text, repository: Text }),\n  values: Type.Record(\n    Text,\n    Type.Object({\n      value: Optional(Text),\n      origin: Origin,\n      scope: Type.Union([Scope, Type.Literal('both')]),\n    }),\n  ),\n});\nconst SettingsEditSchema = Type.Object({ keyPath: Strings, value: Type.Union([Text, Type.Number(), Type.Null()]) });\nexport const SettingsWriteSchema = Type.Union([\n  Type.Object({ repoRoot: Text, scope: Scope, ...SettingsEditSchema.properties, expectedHash: Text }),\n  Type.Object({\n    repoRoot: Text,\n    scope: Scope,\n    edits: Type.Array(SettingsEditSchema, { minItems: 1, maxItems: 100 }),\n    expectedHash: Text,\n  }),\n]);\n\nconst Repository = Type.Object({ id: Text, name: Text, path: Text, active: Type.Boolean() });\nconst Catalog = Type.Array(\n  Type.Object({ name: Text, description: Optional(Text), expandsTo: Optional(Strings), layers: Optional(Strings) }),\n);\nconst SelectionText = Type.Object({ effective: Optional(Text), repository: Optional(Text), origin: Origin });\nconst SelectionStrings = Type.Object({ effective: Optional(Strings), repository: Optional(Strings), origin: Origin });\nexport const RepositorySettingsSchema = Type.Object({\n  repository: Repository,\n  hash: Text,\n  catalogs: Type.Object({ majorModes: Catalog, domains: Catalog, profiles: Catalog }),\n  selection: Type.Object({ majorMode: SelectionText, domains: SelectionStrings, profile: SelectionText }),\n});\nexport const RepositorySelectionWriteSchema = Type.Object({\n  repositoryId: Text,\n  expectedHash: Text,\n  changes: Type.Object({\n    majorMode: Optional(NullableText),\n    domains: Optional(Type.Union([Strings, Type.Null()])),\n    profile: Optional(NullableText),\n  }),\n});\nconst Images = Type.Object({\n  autoResize: Type.Boolean(),\n  maxDimension: Type.Number(),\n  minDimension: Type.Number(),\n  maxAllowedDimension: Type.Number(),\n});\nconst http: DoomHttpContract[] = (['global', 'workspace'] as const).flatMap((scope) => {\n  const common = { scope, basePath: 'settings', authentication: 'owner' as const };\n  return [\n    {\n      ...common,\n      id: 'config',\n      path: '/',\n      method: 'GET',\n      description: 'Read selected settings keys and file hashes.',\n      parameters: [{ name: 'key', in: 'query', required: false, schema: Strings }],\n      responses: jsonApiResponses(SettingsConfigSchema),\n    },\n    {\n      ...common,\n      id: 'value',\n      path: '/value',\n      method: 'PUT',\n      description: 'Write a setting with an optimistic file hash.',\n      body: { contentType: 'application/json', required: true, schema: SettingsWriteSchema },\n      responses: jsonApiResponses(SettingsConfigSchema),\n    },\n    {\n      ...common,\n      id: 'repositories',\n      path: '/repositories',\n      method: 'GET',\n      description: 'List admitted repositories.',\n      responses: jsonApiResponses(Type.Object({ repositories: Type.Array(Repository) })),\n    },\n    {\n      ...common,\n      id: 'repository',\n      path: '/repository',\n      method: 'GET',\n      description: 'Read the mounted workspace catalog and selection.',\n      availability: 'Requires a workspace mount; global returns 404.',\n      responses: jsonApiResponses(RepositorySettingsSchema),\n    },\n    {\n      ...common,\n      id: 'selection',\n      path: '/repository/selection',\n      method: 'PUT',\n      description: 'Update the mounted workspace selection.',\n      availability: 'Requires a workspace mount; global returns 404.',\n      body: { contentType: 'application/json', required: true, schema: RepositorySelectionWriteSchema },\n      responses: jsonApiResponses(RepositorySettingsSchema),\n    },\n    ...(scope === 'global'\n      ? [\n          {\n            ...common,\n            id: 'images.get',\n            path: '/images',\n            method: 'GET' as const,\n            description: 'Read image resizing limits.',\n            responses: jsonApiResponses(Images),\n          },\n          {\n            ...common,\n            id: 'images.put',\n            path: '/images',\n            method: 'PUT' as const,\n            description: 'Update image resizing settings; dimensions are clamped.',\n            body: {\n              contentType: 'application/json',\n              required: true,\n              schema: Type.Object({ autoResize: Optional(Type.Boolean()), maxDimension: Optional(Type.Number()) }),\n            },\n            responses: jsonApiResponses(Images),\n          },\n        ]\n      : []),\n  ] satisfies DoomHttpContract[];\n});\nexport const apiContracts = defineApiContract({ version: 1, http, sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;;;;;AAGA,MAAM,OAAOA,QAAAA,KAAK,OAAO;AACzB,MAAM,WAAWA,QAAAA,KAAK;AACtB,MAAM,UAAUA,QAAAA,KAAK,MAAM,IAAI;AAC/B,MAAM,eAAeA,QAAAA,KAAK,MAAM,CAAC,MAAMA,QAAAA,KAAK,KAAK,CAAC,CAAC;AACnD,MAAM,QAAQA,QAAAA,KAAK,MAAM,CAACA,QAAAA,KAAK,QAAQ,QAAQ,GAAGA,QAAAA,KAAK,QAAQ,YAAY,CAAC,CAAC;AAC7E,MAAM,SAASA,QAAAA,KAAK,MAAM;CAACA,QAAAA,KAAK,QAAQ,QAAQ;CAAGA,QAAAA,KAAK,QAAQ,YAAY;CAAGA,QAAAA,KAAK,QAAQ,SAAS;AAAC,CAAC;AACvG,MAAa,uBAAuBA,QAAAA,KAAK,OAAO;CAC9C,UAAU;CACV,QAAQA,QAAAA,KAAK,OAAO;EAAE,QAAQ;EAAM,YAAY;CAAK,CAAC;CACtD,QAAQA,QAAAA,KAAK,OACX,MACAA,QAAAA,KAAK,OAAO;EACV,OAAO,SAAS,IAAI;EACpB,QAAQ;EACR,OAAOA,QAAAA,KAAK,MAAM,CAAC,OAAOA,QAAAA,KAAK,QAAQ,MAAM,CAAC,CAAC;CACjD,CAAC,CACH;AACF,CAAC;AACD,MAAM,qBAAqBA,QAAAA,KAAK,OAAO;CAAE,SAAS;CAAS,OAAOA,QAAAA,KAAK,MAAM;EAAC;EAAMA,QAAAA,KAAK,OAAO;EAAGA,QAAAA,KAAK,KAAK;CAAC,CAAC;AAAE,CAAC;AAClH,MAAa,sBAAsBA,QAAAA,KAAK,MAAM,CAC5CA,QAAAA,KAAK,OAAO;CAAE,UAAU;CAAM,OAAO;CAAO,GAAG,mBAAmB;CAAY,cAAc;AAAK,CAAC,GAClGA,QAAAA,KAAK,OAAO;CACV,UAAU;CACV,OAAO;CACP,OAAOA,QAAAA,KAAK,MAAM,oBAAoB;EAAE,UAAU;EAAG,UAAU;CAAI,CAAC;CACpE,cAAc;AAChB,CAAC,CACH,CAAC;AAED,MAAM,aAAaA,QAAAA,KAAK,OAAO;CAAE,IAAI;CAAM,MAAM;CAAM,MAAM;CAAM,QAAQA,QAAAA,KAAK,QAAQ;AAAE,CAAC;AAC3F,MAAM,UAAUA,QAAAA,KAAK,MACnBA,QAAAA,KAAK,OAAO;CAAE,MAAM;CAAM,aAAa,SAAS,IAAI;CAAG,WAAW,SAAS,OAAO;CAAG,QAAQ,SAAS,OAAO;AAAE,CAAC,CAClH;AACA,MAAM,gBAAgBA,QAAAA,KAAK,OAAO;CAAE,WAAW,SAAS,IAAI;CAAG,YAAY,SAAS,IAAI;CAAG,QAAQ;AAAO,CAAC;AAC3G,MAAM,mBAAmBA,QAAAA,KAAK,OAAO;CAAE,WAAW,SAAS,OAAO;CAAG,YAAY,SAAS,OAAO;CAAG,QAAQ;AAAO,CAAC;AACpH,MAAa,2BAA2BA,QAAAA,KAAK,OAAO;CAClD,YAAY;CACZ,MAAM;CACN,UAAUA,QAAAA,KAAK,OAAO;EAAE,YAAY;EAAS,SAAS;EAAS,UAAU;CAAQ,CAAC;CAClF,WAAWA,QAAAA,KAAK,OAAO;EAAE,WAAW;EAAe,SAAS;EAAkB,SAAS;CAAc,CAAC;AACxG,CAAC;AACD,MAAa,iCAAiCA,QAAAA,KAAK,OAAO;CACxD,cAAc;CACd,cAAc;CACd,SAASA,QAAAA,KAAK,OAAO;EACnB,WAAW,SAAS,YAAY;EAChC,SAAS,SAASA,QAAAA,KAAK,MAAM,CAAC,SAASA,QAAAA,KAAK,KAAK,CAAC,CAAC,CAAC;EACpD,SAAS,SAAS,YAAY;CAChC,CAAC;AACH,CAAC;AACD,MAAM,SAASA,QAAAA,KAAK,OAAO;CACzB,YAAYA,QAAAA,KAAK,QAAQ;CACzB,cAAcA,QAAAA,KAAK,OAAO;CAC1B,cAAcA,QAAAA,KAAK,OAAO;CAC1B,qBAAqBA,QAAAA,KAAK,OAAO;AACnC,CAAC;AACD,MAAM,OAA4B,CAAC,UAAU,WAAW,CAAC,CAAW,SAAS,UAAU;CACrF,MAAM,SAAS;EAAE;EAAO,UAAU;EAAY,gBAAgB;CAAiB;CAC/E,OAAO;EACL;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,YAAY,CAAC;IAAE,MAAM;IAAO,IAAI;IAAS,UAAU;IAAO,QAAQ;GAAQ,CAAC;GAC3E,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,oBAAoB;EAClD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,MAAM;IAAE,aAAa;IAAoB,UAAU;IAAM,QAAQ;GAAoB;GACrF,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiB,oBAAoB;EAClD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiBD,QAAAA,KAAK,OAAO,EAAE,cAAcA,QAAAA,KAAK,MAAM,UAAU,EAAE,CAAC,CAAC;EACnF;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,cAAc;GACd,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,wBAAwB;EACtD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,cAAc;GACd,MAAM;IAAE,aAAa;IAAoB,UAAU;IAAM,QAAQ;GAA+B;GAChG,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiB,wBAAwB;EACtD;EACA,GAAI,UAAU,WACV,CACE;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiB,MAAM;EACpC,GACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,MAAM;IACJ,aAAa;IACb,UAAU;IACV,QAAQD,QAAAA,KAAK,OAAO;KAAE,YAAY,SAASA,QAAAA,KAAK,QAAQ,CAAC;KAAG,cAAc,SAASA,QAAAA,KAAK,OAAO,CAAC;IAAE,CAAC;GACrG;GACA,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,MAAM;EACpC,CACF,IACA,CAAC;CACP;AACF,CAAC;AACD,MAAa,gBAAA,GAAeC,gCAAAA,kBAAAA,CAAkB;CAAE,SAAS;CAAG;CAAM,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}
+{"version":3,"file":"apiContracts.cjs","names":["Type","jsonApiResponses","defineApiContract"],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type PoHttpContract } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst Text = Type.String();\nconst Optional = Type.Optional;\nconst Strings = Type.Array(Text);\nconst NullableText = Type.Union([Text, Type.Null()]);\nconst Scope = Type.Union([Type.Literal('global'), Type.Literal('repository')]);\nconst Origin = Type.Union([Type.Literal('global'), Type.Literal('repository'), Type.Literal('default')]);\nexport const SettingsConfigSchema = Type.Object({\n  repoRoot: Text,\n  hashes: Type.Object({ global: Text, repository: Text }),\n  values: Type.Record(\n    Text,\n    Type.Object({\n      value: Optional(Text),\n      origin: Origin,\n      scope: Type.Union([Scope, Type.Literal('both')]),\n    }),\n  ),\n});\nconst SettingsEditSchema = Type.Object({ keyPath: Strings, value: Type.Union([Text, Type.Number(), Type.Null()]) });\nexport const SettingsWriteSchema = Type.Union([\n  Type.Object({ repoRoot: Text, scope: Scope, ...SettingsEditSchema.properties, expectedHash: Text }),\n  Type.Object({\n    repoRoot: Text,\n    scope: Scope,\n    edits: Type.Array(SettingsEditSchema, { minItems: 1, maxItems: 100 }),\n    expectedHash: Text,\n  }),\n]);\n\nconst Repository = Type.Object({ id: Text, name: Text, path: Text, active: Type.Boolean() });\nconst Catalog = Type.Array(\n  Type.Object({ name: Text, description: Optional(Text), expandsTo: Optional(Strings), layers: Optional(Strings) }),\n);\nconst SelectionText = Type.Object({ effective: Optional(Text), repository: Optional(Text), origin: Origin });\nconst SelectionStrings = Type.Object({ effective: Optional(Strings), repository: Optional(Strings), origin: Origin });\nexport const RepositorySettingsSchema = Type.Object({\n  repository: Repository,\n  hash: Text,\n  catalogs: Type.Object({ majorModes: Catalog, domains: Catalog, profiles: Catalog }),\n  selection: Type.Object({ majorMode: SelectionText, domains: SelectionStrings, profile: SelectionText }),\n});\nexport const RepositorySelectionWriteSchema = Type.Object({\n  repositoryId: Text,\n  expectedHash: Text,\n  changes: Type.Object({\n    majorMode: Optional(NullableText),\n    domains: Optional(Type.Union([Strings, Type.Null()])),\n    profile: Optional(NullableText),\n  }),\n});\nconst Images = Type.Object({\n  autoResize: Type.Boolean(),\n  maxDimension: Type.Number(),\n  minDimension: Type.Number(),\n  maxAllowedDimension: Type.Number(),\n});\nconst http: PoHttpContract[] = (['global', 'workspace'] as const).flatMap((scope) => {\n  const common = { scope, basePath: 'settings', authentication: 'owner' as const };\n  return [\n    {\n      ...common,\n      id: 'config',\n      path: '/',\n      method: 'GET',\n      description: 'Read selected settings keys and file hashes.',\n      parameters: [{ name: 'key', in: 'query', required: false, schema: Strings }],\n      responses: jsonApiResponses(SettingsConfigSchema),\n    },\n    {\n      ...common,\n      id: 'value',\n      path: '/value',\n      method: 'PUT',\n      description: 'Write a setting with an optimistic file hash.',\n      body: { contentType: 'application/json', required: true, schema: SettingsWriteSchema },\n      responses: jsonApiResponses(SettingsConfigSchema),\n    },\n    {\n      ...common,\n      id: 'repositories',\n      path: '/repositories',\n      method: 'GET',\n      description: 'List admitted repositories.',\n      responses: jsonApiResponses(Type.Object({ repositories: Type.Array(Repository) })),\n    },\n    {\n      ...common,\n      id: 'repository',\n      path: '/repository',\n      method: 'GET',\n      description: 'Read the mounted workspace catalog and selection.',\n      availability: 'Requires a workspace mount; global returns 404.',\n      responses: jsonApiResponses(RepositorySettingsSchema),\n    },\n    {\n      ...common,\n      id: 'selection',\n      path: '/repository/selection',\n      method: 'PUT',\n      description: 'Update the mounted workspace selection.',\n      availability: 'Requires a workspace mount; global returns 404.',\n      body: { contentType: 'application/json', required: true, schema: RepositorySelectionWriteSchema },\n      responses: jsonApiResponses(RepositorySettingsSchema),\n    },\n    ...(scope === 'global'\n      ? [\n          {\n            ...common,\n            id: 'images.get',\n            path: '/images',\n            method: 'GET' as const,\n            description: 'Read image resizing limits.',\n            responses: jsonApiResponses(Images),\n          },\n          {\n            ...common,\n            id: 'images.put',\n            path: '/images',\n            method: 'PUT' as const,\n            description: 'Update image resizing settings; dimensions are clamped.',\n            body: {\n              contentType: 'application/json',\n              required: true,\n              schema: Type.Object({ autoResize: Optional(Type.Boolean()), maxDimension: Optional(Type.Number()) }),\n            },\n            responses: jsonApiResponses(Images),\n          },\n        ]\n      : []),\n  ] satisfies PoHttpContract[];\n});\nexport const apiContracts = defineApiContract({ version: 1, http, sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;;;;;AAGA,MAAM,OAAOA,QAAAA,KAAK,OAAO;AACzB,MAAM,WAAWA,QAAAA,KAAK;AACtB,MAAM,UAAUA,QAAAA,KAAK,MAAM,IAAI;AAC/B,MAAM,eAAeA,QAAAA,KAAK,MAAM,CAAC,MAAMA,QAAAA,KAAK,KAAK,CAAC,CAAC;AACnD,MAAM,QAAQA,QAAAA,KAAK,MAAM,CAACA,QAAAA,KAAK,QAAQ,QAAQ,GAAGA,QAAAA,KAAK,QAAQ,YAAY,CAAC,CAAC;AAC7E,MAAM,SAASA,QAAAA,KAAK,MAAM;CAACA,QAAAA,KAAK,QAAQ,QAAQ;CAAGA,QAAAA,KAAK,QAAQ,YAAY;CAAGA,QAAAA,KAAK,QAAQ,SAAS;AAAC,CAAC;AACvG,MAAa,uBAAuBA,QAAAA,KAAK,OAAO;CAC9C,UAAU;CACV,QAAQA,QAAAA,KAAK,OAAO;EAAE,QAAQ;EAAM,YAAY;CAAK,CAAC;CACtD,QAAQA,QAAAA,KAAK,OACX,MACAA,QAAAA,KAAK,OAAO;EACV,OAAO,SAAS,IAAI;EACpB,QAAQ;EACR,OAAOA,QAAAA,KAAK,MAAM,CAAC,OAAOA,QAAAA,KAAK,QAAQ,MAAM,CAAC,CAAC;CACjD,CAAC,CACH;AACF,CAAC;AACD,MAAM,qBAAqBA,QAAAA,KAAK,OAAO;CAAE,SAAS;CAAS,OAAOA,QAAAA,KAAK,MAAM;EAAC;EAAMA,QAAAA,KAAK,OAAO;EAAGA,QAAAA,KAAK,KAAK;CAAC,CAAC;AAAE,CAAC;AAClH,MAAa,sBAAsBA,QAAAA,KAAK,MAAM,CAC5CA,QAAAA,KAAK,OAAO;CAAE,UAAU;CAAM,OAAO;CAAO,GAAG,mBAAmB;CAAY,cAAc;AAAK,CAAC,GAClGA,QAAAA,KAAK,OAAO;CACV,UAAU;CACV,OAAO;CACP,OAAOA,QAAAA,KAAK,MAAM,oBAAoB;EAAE,UAAU;EAAG,UAAU;CAAI,CAAC;CACpE,cAAc;AAChB,CAAC,CACH,CAAC;AAED,MAAM,aAAaA,QAAAA,KAAK,OAAO;CAAE,IAAI;CAAM,MAAM;CAAM,MAAM;CAAM,QAAQA,QAAAA,KAAK,QAAQ;AAAE,CAAC;AAC3F,MAAM,UAAUA,QAAAA,KAAK,MACnBA,QAAAA,KAAK,OAAO;CAAE,MAAM;CAAM,aAAa,SAAS,IAAI;CAAG,WAAW,SAAS,OAAO;CAAG,QAAQ,SAAS,OAAO;AAAE,CAAC,CAClH;AACA,MAAM,gBAAgBA,QAAAA,KAAK,OAAO;CAAE,WAAW,SAAS,IAAI;CAAG,YAAY,SAAS,IAAI;CAAG,QAAQ;AAAO,CAAC;AAC3G,MAAM,mBAAmBA,QAAAA,KAAK,OAAO;CAAE,WAAW,SAAS,OAAO;CAAG,YAAY,SAAS,OAAO;CAAG,QAAQ;AAAO,CAAC;AACpH,MAAa,2BAA2BA,QAAAA,KAAK,OAAO;CAClD,YAAY;CACZ,MAAM;CACN,UAAUA,QAAAA,KAAK,OAAO;EAAE,YAAY;EAAS,SAAS;EAAS,UAAU;CAAQ,CAAC;CAClF,WAAWA,QAAAA,KAAK,OAAO;EAAE,WAAW;EAAe,SAAS;EAAkB,SAAS;CAAc,CAAC;AACxG,CAAC;AACD,MAAa,iCAAiCA,QAAAA,KAAK,OAAO;CACxD,cAAc;CACd,cAAc;CACd,SAASA,QAAAA,KAAK,OAAO;EACnB,WAAW,SAAS,YAAY;EAChC,SAAS,SAASA,QAAAA,KAAK,MAAM,CAAC,SAASA,QAAAA,KAAK,KAAK,CAAC,CAAC,CAAC;EACpD,SAAS,SAAS,YAAY;CAChC,CAAC;AACH,CAAC;AACD,MAAM,SAASA,QAAAA,KAAK,OAAO;CACzB,YAAYA,QAAAA,KAAK,QAAQ;CACzB,cAAcA,QAAAA,KAAK,OAAO;CAC1B,cAAcA,QAAAA,KAAK,OAAO;CAC1B,qBAAqBA,QAAAA,KAAK,OAAO;AACnC,CAAC;AACD,MAAM,OAA0B,CAAC,UAAU,WAAW,CAAC,CAAW,SAAS,UAAU;CACnF,MAAM,SAAS;EAAE;EAAO,UAAU;EAAY,gBAAgB;CAAiB;CAC/E,OAAO;EACL;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,YAAY,CAAC;IAAE,MAAM;IAAO,IAAI;IAAS,UAAU;IAAO,QAAQ;GAAQ,CAAC;GAC3E,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,oBAAoB;EAClD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,MAAM;IAAE,aAAa;IAAoB,UAAU;IAAM,QAAQ;GAAoB;GACrF,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiB,oBAAoB;EAClD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiBD,QAAAA,KAAK,OAAO,EAAE,cAAcA,QAAAA,KAAK,MAAM,UAAU,EAAE,CAAC,CAAC;EACnF;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,cAAc;GACd,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,wBAAwB;EACtD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,cAAc;GACd,MAAM;IAAE,aAAa;IAAoB,UAAU;IAAM,QAAQ;GAA+B;GAChG,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiB,wBAAwB;EACtD;EACA,GAAI,UAAU,WACV,CACE;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,YAAA,GAAWA,gCAAAA,iBAAAA,CAAiB,MAAM;EACpC,GACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,MAAM;IACJ,aAAa;IACb,UAAU;IACV,QAAQD,QAAAA,KAAK,OAAO;KAAE,YAAY,SAASA,QAAAA,KAAK,QAAQ,CAAC;KAAG,cAAc,SAASA,QAAAA,KAAK,OAAO,CAAC;IAAE,CAAC;GACrG;GACA,YAAA,GAAWC,gCAAAA,iBAAAA,CAAiB,MAAM;EACpC,CACF,IACA,CAAC;CACP;AACF,CAAC;AACD,MAAa,gBAAA,GAAeC,gCAAAA,kBAAAA,CAAkB;CAAE,SAAS;CAAG;CAAM,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}

package/dist/apiContracts.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type DoomHttpContract } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst Text = Type.String();\nconst Optional = Type.Optional;\nconst Strings = Type.Array(Text);\nconst NullableText = Type.Union([Text, Type.Null()]);\nconst Scope = Type.Union([Type.Literal('global'), Type.Literal('repository')]);\nconst Origin = Type.Union([Type.Literal('global'), Type.Literal('repository'), Type.Literal('default')]);\nexport const SettingsConfigSchema = Type.Object({\n  repoRoot: Text,\n  hashes: Type.Object({ global: Text, repository: Text }),\n  values: Type.Record(\n    Text,\n    Type.Object({\n      value: Optional(Text),\n      origin: Origin,\n      scope: Type.Union([Scope, Type.Literal('both')]),\n    }),\n  ),\n});\nconst SettingsEditSchema = Type.Object({ keyPath: Strings, value: Type.Union([Text, Type.Number(), Type.Null()]) });\nexport const SettingsWriteSchema = Type.Union([\n  Type.Object({ repoRoot: Text, scope: Scope, ...SettingsEditSchema.properties, expectedHash: Text }),\n  Type.Object({\n    repoRoot: Text,\n    scope: Scope,\n    edits: Type.Array(SettingsEditSchema, { minItems: 1, maxItems: 100 }),\n    expectedHash: Text,\n  }),\n]);\n\nconst Repository = Type.Object({ id: Text, name: Text, path: Text, active: Type.Boolean() });\nconst Catalog = Type.Array(\n  Type.Object({ name: Text, description: Optional(Text), expandsTo: Optional(Strings), layers: Optional(Strings) }),\n);\nconst SelectionText = Type.Object({ effective: Optional(Text), repository: Optional(Text), origin: Origin });\nconst SelectionStrings = Type.Object({ effective: Optional(Strings), repository: Optional(Strings), origin: Origin });\nexport const RepositorySettingsSchema = Type.Object({\n  repository: Repository,\n  hash: Text,\n  catalogs: Type.Object({ majorModes: Catalog, domains: Catalog, profiles: Catalog }),\n  selection: Type.Object({ majorMode: SelectionText, domains: SelectionStrings, profile: SelectionText }),\n});\nexport const RepositorySelectionWriteSchema = Type.Object({\n  repositoryId: Text,\n  expectedHash: Text,\n  changes: Type.Object({\n    majorMode: Optional(NullableText),\n    domains: Optional(Type.Union([Strings, Type.Null()])),\n    profile: Optional(NullableText),\n  }),\n});\nconst Images = Type.Object({\n  autoResize: Type.Boolean(),\n  maxDimension: Type.Number(),\n  minDimension: Type.Number(),\n  maxAllowedDimension: Type.Number(),\n});\nconst http: DoomHttpContract[] = (['global', 'workspace'] as const).flatMap((scope) => {\n  const common = { scope, basePath: 'settings', authentication: 'owner' as const };\n  return [\n    {\n      ...common,\n      id: 'config',\n      path: '/',\n      method: 'GET',\n      description: 'Read selected settings keys and file hashes.',\n      parameters: [{ name: 'key', in: 'query', required: false, schema: Strings }],\n      responses: jsonApiResponses(SettingsConfigSchema),\n    },\n    {\n      ...common,\n      id: 'value',\n      path: '/value',\n      method: 'PUT',\n      description: 'Write a setting with an optimistic file hash.',\n      body: { contentType: 'application/json', required: true, schema: SettingsWriteSchema },\n      responses: jsonApiResponses(SettingsConfigSchema),\n    },\n    {\n      ...common,\n      id: 'repositories',\n      path: '/repositories',\n      method: 'GET',\n      description: 'List admitted repositories.',\n      responses: jsonApiResponses(Type.Object({ repositories: Type.Array(Repository) })),\n    },\n    {\n      ...common,\n      id: 'repository',\n      path: '/repository',\n      method: 'GET',\n      description: 'Read the mounted workspace catalog and selection.',\n      availability: 'Requires a workspace mount; global returns 404.',\n      responses: jsonApiResponses(RepositorySettingsSchema),\n    },\n    {\n      ...common,\n      id: 'selection',\n      path: '/repository/selection',\n      method: 'PUT',\n      description: 'Update the mounted workspace selection.',\n      availability: 'Requires a workspace mount; global returns 404.',\n      body: { contentType: 'application/json', required: true, schema: RepositorySelectionWriteSchema },\n      responses: jsonApiResponses(RepositorySettingsSchema),\n    },\n    ...(scope === 'global'\n      ? [\n          {\n            ...common,\n            id: 'images.get',\n            path: '/images',\n            method: 'GET' as const,\n            description: 'Read image resizing limits.',\n            responses: jsonApiResponses(Images),\n          },\n          {\n            ...common,\n            id: 'images.put',\n            path: '/images',\n            method: 'PUT' as const,\n            description: 'Update image resizing settings; dimensions are clamped.',\n            body: {\n              contentType: 'application/json',\n              required: true,\n              schema: Type.Object({ autoResize: Optional(Type.Boolean()), maxDimension: Optional(Type.Number()) }),\n            },\n            responses: jsonApiResponses(Images),\n          },\n        ]\n      : []),\n  ] satisfies DoomHttpContract[];\n});\nexport const apiContracts = defineApiContract({ version: 1, http, sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAM,OAAO,KAAK,OAAO;AACzB,MAAM,WAAW,KAAK;AACtB,MAAM,UAAU,KAAK,MAAM,IAAI;AAC/B,MAAM,eAAe,KAAK,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;AACnD,MAAM,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,QAAQ,GAAG,KAAK,QAAQ,YAAY,CAAC,CAAC;AAC7E,MAAM,SAAS,KAAK,MAAM;CAAC,KAAK,QAAQ,QAAQ;CAAG,KAAK,QAAQ,YAAY;CAAG,KAAK,QAAQ,SAAS;AAAC,CAAC;AACvG,MAAa,uBAAuB,KAAK,OAAO;CAC9C,UAAU;CACV,QAAQ,KAAK,OAAO;EAAE,QAAQ;EAAM,YAAY;CAAK,CAAC;CACtD,QAAQ,KAAK,OACX,MACA,KAAK,OAAO;EACV,OAAO,SAAS,IAAI;EACpB,QAAQ;EACR,OAAO,KAAK,MAAM,CAAC,OAAO,KAAK,QAAQ,MAAM,CAAC,CAAC;CACjD,CAAC,CACH;AACF,CAAC;AACD,MAAM,qBAAqB,KAAK,OAAO;CAAE,SAAS;CAAS,OAAO,KAAK,MAAM;EAAC;EAAM,KAAK,OAAO;EAAG,KAAK,KAAK;CAAC,CAAC;AAAE,CAAC;AAClH,MAAa,sBAAsB,KAAK,MAAM,CAC5C,KAAK,OAAO;CAAE,UAAU;CAAM,OAAO;CAAO,GAAG,mBAAmB;CAAY,cAAc;AAAK,CAAC,GAClG,KAAK,OAAO;CACV,UAAU;CACV,OAAO;CACP,OAAO,KAAK,MAAM,oBAAoB;EAAE,UAAU;EAAG,UAAU;CAAI,CAAC;CACpE,cAAc;AAChB,CAAC,CACH,CAAC;AAED,MAAM,aAAa,KAAK,OAAO;CAAE,IAAI;CAAM,MAAM;CAAM,MAAM;CAAM,QAAQ,KAAK,QAAQ;AAAE,CAAC;AAC3F,MAAM,UAAU,KAAK,MACnB,KAAK,OAAO;CAAE,MAAM;CAAM,aAAa,SAAS,IAAI;CAAG,WAAW,SAAS,OAAO;CAAG,QAAQ,SAAS,OAAO;AAAE,CAAC,CAClH;AACA,MAAM,gBAAgB,KAAK,OAAO;CAAE,WAAW,SAAS,IAAI;CAAG,YAAY,SAAS,IAAI;CAAG,QAAQ;AAAO,CAAC;AAC3G,MAAM,mBAAmB,KAAK,OAAO;CAAE,WAAW,SAAS,OAAO;CAAG,YAAY,SAAS,OAAO;CAAG,QAAQ;AAAO,CAAC;AACpH,MAAa,2BAA2B,KAAK,OAAO;CAClD,YAAY;CACZ,MAAM;CACN,UAAU,KAAK,OAAO;EAAE,YAAY;EAAS,SAAS;EAAS,UAAU;CAAQ,CAAC;CAClF,WAAW,KAAK,OAAO;EAAE,WAAW;EAAe,SAAS;EAAkB,SAAS;CAAc,CAAC;AACxG,CAAC;AACD,MAAa,iCAAiC,KAAK,OAAO;CACxD,cAAc;CACd,cAAc;CACd,SAAS,KAAK,OAAO;EACnB,WAAW,SAAS,YAAY;EAChC,SAAS,SAAS,KAAK,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC;EACpD,SAAS,SAAS,YAAY;CAChC,CAAC;AACH,CAAC;AACD,MAAM,SAAS,KAAK,OAAO;CACzB,YAAY,KAAK,QAAQ;CACzB,cAAc,KAAK,OAAO;CAC1B,cAAc,KAAK,OAAO;CAC1B,qBAAqB,KAAK,OAAO;AACnC,CAAC;AACD,MAAM,OAA4B,CAAC,UAAU,WAAW,CAAC,CAAW,SAAS,UAAU;CACrF,MAAM,SAAS;EAAE;EAAO,UAAU;EAAY,gBAAgB;CAAiB;CAC/E,OAAO;EACL;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,YAAY,CAAC;IAAE,MAAM;IAAO,IAAI;IAAS,UAAU;IAAO,QAAQ;GAAQ,CAAC;GAC3E,WAAW,iBAAiB,oBAAoB;EAClD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,MAAM;IAAE,aAAa;IAAoB,UAAU;IAAM,QAAQ;GAAoB;GACrF,WAAW,iBAAiB,oBAAoB;EAClD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,WAAW,iBAAiB,KAAK,OAAO,EAAE,cAAc,KAAK,MAAM,UAAU,EAAE,CAAC,CAAC;EACnF;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,cAAc;GACd,WAAW,iBAAiB,wBAAwB;EACtD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,cAAc;GACd,MAAM;IAAE,aAAa;IAAoB,UAAU;IAAM,QAAQ;GAA+B;GAChG,WAAW,iBAAiB,wBAAwB;EACtD;EACA,GAAI,UAAU,WACV,CACE;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,WAAW,iBAAiB,MAAM;EACpC,GACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,MAAM;IACJ,aAAa;IACb,UAAU;IACV,QAAQ,KAAK,OAAO;KAAE,YAAY,SAAS,KAAK,QAAQ,CAAC;KAAG,cAAc,SAAS,KAAK,OAAO,CAAC;IAAE,CAAC;GACrG;GACA,WAAW,iBAAiB,MAAM;EACpC,CACF,IACA,CAAC;CACP;AACF,CAAC;AACD,MAAa,eAAe,kBAAkB;CAAE,SAAS;CAAG;CAAM,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}
+{"version":3,"file":"apiContracts.mjs","names":[],"sources":["../src/schemas/apiContracts.ts"],"sourcesContent":["import { defineApiContract, jsonApiResponses, type PoHttpContract } from '@agimon-ai/po-core/apiContracts';\nimport { Type } from 'typebox';\n\nconst Text = Type.String();\nconst Optional = Type.Optional;\nconst Strings = Type.Array(Text);\nconst NullableText = Type.Union([Text, Type.Null()]);\nconst Scope = Type.Union([Type.Literal('global'), Type.Literal('repository')]);\nconst Origin = Type.Union([Type.Literal('global'), Type.Literal('repository'), Type.Literal('default')]);\nexport const SettingsConfigSchema = Type.Object({\n  repoRoot: Text,\n  hashes: Type.Object({ global: Text, repository: Text }),\n  values: Type.Record(\n    Text,\n    Type.Object({\n      value: Optional(Text),\n      origin: Origin,\n      scope: Type.Union([Scope, Type.Literal('both')]),\n    }),\n  ),\n});\nconst SettingsEditSchema = Type.Object({ keyPath: Strings, value: Type.Union([Text, Type.Number(), Type.Null()]) });\nexport const SettingsWriteSchema = Type.Union([\n  Type.Object({ repoRoot: Text, scope: Scope, ...SettingsEditSchema.properties, expectedHash: Text }),\n  Type.Object({\n    repoRoot: Text,\n    scope: Scope,\n    edits: Type.Array(SettingsEditSchema, { minItems: 1, maxItems: 100 }),\n    expectedHash: Text,\n  }),\n]);\n\nconst Repository = Type.Object({ id: Text, name: Text, path: Text, active: Type.Boolean() });\nconst Catalog = Type.Array(\n  Type.Object({ name: Text, description: Optional(Text), expandsTo: Optional(Strings), layers: Optional(Strings) }),\n);\nconst SelectionText = Type.Object({ effective: Optional(Text), repository: Optional(Text), origin: Origin });\nconst SelectionStrings = Type.Object({ effective: Optional(Strings), repository: Optional(Strings), origin: Origin });\nexport const RepositorySettingsSchema = Type.Object({\n  repository: Repository,\n  hash: Text,\n  catalogs: Type.Object({ majorModes: Catalog, domains: Catalog, profiles: Catalog }),\n  selection: Type.Object({ majorMode: SelectionText, domains: SelectionStrings, profile: SelectionText }),\n});\nexport const RepositorySelectionWriteSchema = Type.Object({\n  repositoryId: Text,\n  expectedHash: Text,\n  changes: Type.Object({\n    majorMode: Optional(NullableText),\n    domains: Optional(Type.Union([Strings, Type.Null()])),\n    profile: Optional(NullableText),\n  }),\n});\nconst Images = Type.Object({\n  autoResize: Type.Boolean(),\n  maxDimension: Type.Number(),\n  minDimension: Type.Number(),\n  maxAllowedDimension: Type.Number(),\n});\nconst http: PoHttpContract[] = (['global', 'workspace'] as const).flatMap((scope) => {\n  const common = { scope, basePath: 'settings', authentication: 'owner' as const };\n  return [\n    {\n      ...common,\n      id: 'config',\n      path: '/',\n      method: 'GET',\n      description: 'Read selected settings keys and file hashes.',\n      parameters: [{ name: 'key', in: 'query', required: false, schema: Strings }],\n      responses: jsonApiResponses(SettingsConfigSchema),\n    },\n    {\n      ...common,\n      id: 'value',\n      path: '/value',\n      method: 'PUT',\n      description: 'Write a setting with an optimistic file hash.',\n      body: { contentType: 'application/json', required: true, schema: SettingsWriteSchema },\n      responses: jsonApiResponses(SettingsConfigSchema),\n    },\n    {\n      ...common,\n      id: 'repositories',\n      path: '/repositories',\n      method: 'GET',\n      description: 'List admitted repositories.',\n      responses: jsonApiResponses(Type.Object({ repositories: Type.Array(Repository) })),\n    },\n    {\n      ...common,\n      id: 'repository',\n      path: '/repository',\n      method: 'GET',\n      description: 'Read the mounted workspace catalog and selection.',\n      availability: 'Requires a workspace mount; global returns 404.',\n      responses: jsonApiResponses(RepositorySettingsSchema),\n    },\n    {\n      ...common,\n      id: 'selection',\n      path: '/repository/selection',\n      method: 'PUT',\n      description: 'Update the mounted workspace selection.',\n      availability: 'Requires a workspace mount; global returns 404.',\n      body: { contentType: 'application/json', required: true, schema: RepositorySelectionWriteSchema },\n      responses: jsonApiResponses(RepositorySettingsSchema),\n    },\n    ...(scope === 'global'\n      ? [\n          {\n            ...common,\n            id: 'images.get',\n            path: '/images',\n            method: 'GET' as const,\n            description: 'Read image resizing limits.',\n            responses: jsonApiResponses(Images),\n          },\n          {\n            ...common,\n            id: 'images.put',\n            path: '/images',\n            method: 'PUT' as const,\n            description: 'Update image resizing settings; dimensions are clamped.',\n            body: {\n              contentType: 'application/json',\n              required: true,\n              schema: Type.Object({ autoResize: Optional(Type.Boolean()), maxDimension: Optional(Type.Number()) }),\n            },\n            responses: jsonApiResponses(Images),\n          },\n        ]\n      : []),\n  ] satisfies PoHttpContract[];\n});\nexport const apiContracts = defineApiContract({ version: 1, http, sockets: [], dynamic: [] });\nexport default apiContracts;\n"],"mappings":";;;AAGA,MAAM,OAAO,KAAK,OAAO;AACzB,MAAM,WAAW,KAAK;AACtB,MAAM,UAAU,KAAK,MAAM,IAAI;AAC/B,MAAM,eAAe,KAAK,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;AACnD,MAAM,QAAQ,KAAK,MAAM,CAAC,KAAK,QAAQ,QAAQ,GAAG,KAAK,QAAQ,YAAY,CAAC,CAAC;AAC7E,MAAM,SAAS,KAAK,MAAM;CAAC,KAAK,QAAQ,QAAQ;CAAG,KAAK,QAAQ,YAAY;CAAG,KAAK,QAAQ,SAAS;AAAC,CAAC;AACvG,MAAa,uBAAuB,KAAK,OAAO;CAC9C,UAAU;CACV,QAAQ,KAAK,OAAO;EAAE,QAAQ;EAAM,YAAY;CAAK,CAAC;CACtD,QAAQ,KAAK,OACX,MACA,KAAK,OAAO;EACV,OAAO,SAAS,IAAI;EACpB,QAAQ;EACR,OAAO,KAAK,MAAM,CAAC,OAAO,KAAK,QAAQ,MAAM,CAAC,CAAC;CACjD,CAAC,CACH;AACF,CAAC;AACD,MAAM,qBAAqB,KAAK,OAAO;CAAE,SAAS;CAAS,OAAO,KAAK,MAAM;EAAC;EAAM,KAAK,OAAO;EAAG,KAAK,KAAK;CAAC,CAAC;AAAE,CAAC;AAClH,MAAa,sBAAsB,KAAK,MAAM,CAC5C,KAAK,OAAO;CAAE,UAAU;CAAM,OAAO;CAAO,GAAG,mBAAmB;CAAY,cAAc;AAAK,CAAC,GAClG,KAAK,OAAO;CACV,UAAU;CACV,OAAO;CACP,OAAO,KAAK,MAAM,oBAAoB;EAAE,UAAU;EAAG,UAAU;CAAI,CAAC;CACpE,cAAc;AAChB,CAAC,CACH,CAAC;AAED,MAAM,aAAa,KAAK,OAAO;CAAE,IAAI;CAAM,MAAM;CAAM,MAAM;CAAM,QAAQ,KAAK,QAAQ;AAAE,CAAC;AAC3F,MAAM,UAAU,KAAK,MACnB,KAAK,OAAO;CAAE,MAAM;CAAM,aAAa,SAAS,IAAI;CAAG,WAAW,SAAS,OAAO;CAAG,QAAQ,SAAS,OAAO;AAAE,CAAC,CAClH;AACA,MAAM,gBAAgB,KAAK,OAAO;CAAE,WAAW,SAAS,IAAI;CAAG,YAAY,SAAS,IAAI;CAAG,QAAQ;AAAO,CAAC;AAC3G,MAAM,mBAAmB,KAAK,OAAO;CAAE,WAAW,SAAS,OAAO;CAAG,YAAY,SAAS,OAAO;CAAG,QAAQ;AAAO,CAAC;AACpH,MAAa,2BAA2B,KAAK,OAAO;CAClD,YAAY;CACZ,MAAM;CACN,UAAU,KAAK,OAAO;EAAE,YAAY;EAAS,SAAS;EAAS,UAAU;CAAQ,CAAC;CAClF,WAAW,KAAK,OAAO;EAAE,WAAW;EAAe,SAAS;EAAkB,SAAS;CAAc,CAAC;AACxG,CAAC;AACD,MAAa,iCAAiC,KAAK,OAAO;CACxD,cAAc;CACd,cAAc;CACd,SAAS,KAAK,OAAO;EACnB,WAAW,SAAS,YAAY;EAChC,SAAS,SAAS,KAAK,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC;EACpD,SAAS,SAAS,YAAY;CAChC,CAAC;AACH,CAAC;AACD,MAAM,SAAS,KAAK,OAAO;CACzB,YAAY,KAAK,QAAQ;CACzB,cAAc,KAAK,OAAO;CAC1B,cAAc,KAAK,OAAO;CAC1B,qBAAqB,KAAK,OAAO;AACnC,CAAC;AACD,MAAM,OAA0B,CAAC,UAAU,WAAW,CAAC,CAAW,SAAS,UAAU;CACnF,MAAM,SAAS;EAAE;EAAO,UAAU;EAAY,gBAAgB;CAAiB;CAC/E,OAAO;EACL;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,YAAY,CAAC;IAAE,MAAM;IAAO,IAAI;IAAS,UAAU;IAAO,QAAQ;GAAQ,CAAC;GAC3E,WAAW,iBAAiB,oBAAoB;EAClD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,MAAM;IAAE,aAAa;IAAoB,UAAU;IAAM,QAAQ;GAAoB;GACrF,WAAW,iBAAiB,oBAAoB;EAClD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,WAAW,iBAAiB,KAAK,OAAO,EAAE,cAAc,KAAK,MAAM,UAAU,EAAE,CAAC,CAAC;EACnF;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,cAAc;GACd,WAAW,iBAAiB,wBAAwB;EACtD;EACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,cAAc;GACd,MAAM;IAAE,aAAa;IAAoB,UAAU;IAAM,QAAQ;GAA+B;GAChG,WAAW,iBAAiB,wBAAwB;EACtD;EACA,GAAI,UAAU,WACV,CACE;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,WAAW,iBAAiB,MAAM;EACpC,GACA;GACE,GAAG;GACH,IAAI;GACJ,MAAM;GACN,QAAQ;GACR,aAAa;GACb,MAAM;IACJ,aAAa;IACb,UAAU;IACV,QAAQ,KAAK,OAAO;KAAE,YAAY,SAAS,KAAK,QAAQ,CAAC;KAAG,cAAc,SAAS,KAAK,OAAO,CAAC;IAAE,CAAC;GACrG;GACA,WAAW,iBAAiB,MAAM;EACpC,CACF,IACA,CAAC;CACP;AACF,CAAC;AACD,MAAa,eAAe,kBAAkB;CAAE,SAAS;CAAG;CAAM,SAAS,CAAC;CAAG,SAAS,CAAC;AAAE,CAAC"}