@agimon-ai/po-web-dashboard 0.0.0-alpha.0

package/dist/web/features/settings/SessionMcpSettings.mjs

@@ -0,0 +1,488 @@
+import { rememberedHostChannelKey } from "../../lib/sealedSession.mjs";
+import { createSessionMcpClient, listSessionMcpClients, readSessionMcpConfig, revokeSessionMcpClient } from "../../lib/sessionMcpApi.mjs";
+import { sessionsStore } from "../../stores/sessionsStore.mjs";
+import { remoteAccessStore } from "../../stores/remoteAccessStore.mjs";
+import { useDashboardState } from "../../stores/dashboardStateStore.mjs";
+import { useEffect, useLayoutEffect, useMemo, useState } from "react";
+import { useStore } from "@tanstack/react-store";
+import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";
+import { Badge, Button, Input, Select, SelectContent, SelectItem, SelectTrigger, SelectValue, SettingsActions, SettingsCard, SettingsNote, SettingsRow, SettingsRowDescription, SettingsRowText, SettingsRowTitle, SettingsSection, SettingsSectionDescription, SettingsSectionHeader, SettingsSectionTitle, Spinner } from "@agimon-ai/po-web-components";
+//#region src/web/features/settings/SessionMcpSettings.tsx
+function exactHttpsUrl(value) {
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && url.username === "" && url.password === "" && url.hash === "";
+	} catch {
+		return false;
+	}
+}
+function withoutCredential(client) {
+	const { clientSecret: _clientSecret, connectionUrl: _connectionUrl, mcpAppConnectionUrl: _mcpAppConnectionUrl, ...metadata } = client;
+	return metadata;
+}
+const AUTH_METHOD_LABEL = {
+	url_token: "Signed URL",
+	api_key: "API key",
+	client_secret_post: "OAuth"
+};
+/** One copyable value as a settings row: the label and value on the left, the copy button on the right. */
+function CopyValue({ label, value, testId }) {
+	const [state, setState] = useState("idle");
+	async function copy() {
+		if (navigator.clipboard === void 0) {
+			setState("failed");
+			return;
+		}
+		try {
+			await navigator.clipboard.writeText(value);
+			setState("copied");
+		} catch {
+			setState("failed");
+		}
+	}
+	return /* @__PURE__ */ jsxs(SettingsRow, { children: [/* @__PURE__ */ jsxs(SettingsRowText, { children: [
+		/* @__PURE__ */ jsx(SettingsRowTitle, { children: label }),
+		/* @__PURE__ */ jsx("code", {
+			className: "break-all font-mono text-sm text-doom-text",
+			"data-testid": testId,
+			children: value
+		}),
+		/* @__PURE__ */ jsxs("output", {
+			"aria-live": "polite",
+			className: "text-sm text-doom-dim empty:hidden",
+			children: [state === "failed" ? "Copying was blocked. Select the value above to copy it by hand." : "", state === "copied" ? `${label} copied.` : ""]
+		})
+	] }), /* @__PURE__ */ jsx(Button, {
+		type: "button",
+		variant: "outline",
+		size: "sm",
+		"data-testid": `${testId}-copy`,
+		"aria-label": `Copy ${label}`,
+		onClick: () => void copy(),
+		children: state === "copied" ? "Copied" : "Copy"
+	})] });
+}
+/** Local management for the inbound, session-bound MCP endpoint exposed by the host. */
+function SessionMcpSettings() {
+	const sessions = useStore(sessionsStore);
+	const liveSessions = useMemo(() => sessions.order.map((id) => sessions.byId[id]).filter((meta) => meta !== void 0 && !meta.summary.dormant), [sessions.byId, sessions.order]);
+	const [sessionId, setSessionId] = useDashboardState("session-mcp/session", () => sessions.activeId ?? liveSessions[0]?.summary.id ?? "");
+	const selected = sessionId === "" ? void 0 : sessions.byId[sessionId];
+	const workspaceId = selected?.summary.workspaceId;
+	const available = selected?.attach === "attached" && workspaceId !== void 0;
+	const selectionKey = `${workspaceId ?? ""}\u0000${sessionId}`;
+	const [, setSelectionKey, selectionState] = useDashboardState("session-mcp/selection", selectionKey);
+	const remoteCaller = rememberedHostChannelKey() !== void 0;
+	const publicUrl = useStore(remoteAccessStore, (state) => state.view?.publicUrl);
+	const [config, setConfig] = useDashboardState("session-mcp/config", void 0);
+	const [clients, setClients, clientsState] = useDashboardState("session-mcp/clients", []);
+	const [redirectUri, setRedirectUri] = useDashboardState("session-mcp/redirect", "");
+	const [toolPrefix, setToolPrefix] = useDashboardState("session-mcp/tool-prefix", "");
+	const [authMethod, setAuthMethod] = useDashboardState("session-mcp/auth-method", "url_token");
+	const [created, setCreated] = useDashboardState("session-mcp/created", void 0);
+	const visibleCreated = created?.sessionId === sessionId ? created.client : void 0;
+	const [loading, setLoading] = useDashboardState("session-mcp/loading", false);
+	const [busy, setBusy, busyState] = useDashboardState("session-mcp/busy", false);
+	const [error, setError] = useDashboardState("session-mcp/error", void 0);
+	useLayoutEffect(() => {
+		if (selectionState.state === selectionKey && available) return;
+		setSelectionKey(selectionKey);
+		setCreated(void 0);
+		setRedirectUri("");
+		setToolPrefix("");
+		setConfig(void 0);
+		setClients([]);
+		setError(void 0);
+		setBusy(false);
+	}, [
+		available,
+		selectionKey,
+		selectionState,
+		setSelectionKey,
+		setCreated,
+		setRedirectUri,
+		setToolPrefix,
+		setConfig,
+		setClients,
+		setError,
+		setBusy
+	]);
+	useEffect(() => () => setCreated(void 0), [setCreated]);
+	useEffect(() => {
+		if (liveSessions.some((meta) => meta.summary.id === sessionId)) return;
+		const next = liveSessions.find((meta) => meta.summary.id === sessions.activeId) ?? liveSessions[0];
+		setSessionId(next?.summary.id ?? "");
+	}, [
+		liveSessions,
+		sessionId,
+		sessions.activeId,
+		setSessionId
+	]);
+	useEffect(() => {
+		let current = true;
+		const previousClients = clientsState.state;
+		if (!available || workspaceId === void 0) {
+			setLoading(false);
+			return () => {
+				current = false;
+			};
+		}
+		setLoading(true);
+		Promise.all([publicUrl === void 0 ? void 0 : readSessionMcpConfig(workspaceId, sessionId), listSessionMcpClients(workspaceId, sessionId)]).then(([configResult, clientsResult]) => {
+			if (!current) return;
+			if (configResult === void 0) setConfig(void 0);
+			else if ("error" in configResult) setError(configResult.error);
+			else setConfig(configResult.config);
+			if ("error" in clientsResult) setError((previous) => previous ?? clientsResult.error);
+			else if (!busyState.state && clientsState.state === previousClients) setClients(clientsResult.clients);
+			setLoading(false);
+		});
+		return () => {
+			current = false;
+		};
+	}, [
+		available,
+		publicUrl,
+		sessionId,
+		workspaceId,
+		clientsState,
+		busyState,
+		setConfig,
+		setClients,
+		setError,
+		setLoading
+	]);
+	const invalidCallback = authMethod === "oauth" && redirectUri !== "" && !exactHttpsUrl(redirectUri);
+	const canCreate = available && !remoteCaller && config !== void 0 && (authMethod !== "oauth" || exactHttpsUrl(redirectUri)) && !busy;
+	async function createClient() {
+		if (!canCreate || workspaceId === void 0 || busyState.state) return;
+		const operationSelection = selectionKey;
+		setBusy(true);
+		setError(void 0);
+		const prefix = toolPrefix.trim();
+		const naming = prefix === "" ? {} : { toolPrefix: prefix };
+		const result = await createSessionMcpClient(workspaceId, sessionId, authMethod === "oauth" ? {
+			redirectUri: redirectUri.trim(),
+			scope: "session",
+			routing: "conversation",
+			...naming
+		} : {
+			authMethod,
+			scope: "session",
+			routing: "conversation",
+			...naming
+		});
+		if (selectionState.state !== operationSelection) return;
+		setBusy(false);
+		if ("error" in result) {
+			setError(result.error);
+			return;
+		}
+		setCreated({
+			sessionId,
+			client: result.client
+		});
+		setClients((current) => [withoutCredential(result.client), ...current]);
+		setRedirectUri("");
+		setToolPrefix("");
+	}
+	async function revoke(clientId) {
+		if (workspaceId === void 0 || busyState.state) return;
+		const operationSelection = selectionKey;
+		setBusy(true);
+		setError(void 0);
+		const result = await revokeSessionMcpClient(workspaceId, sessionId, clientId);
+		if (selectionState.state !== operationSelection) return;
+		setBusy(false);
+		if ("error" in result) {
+			setError(result.error);
+			return;
+		}
+		setClients((current) => current.filter((client) => client.clientId !== clientId));
+		if (visibleCreated?.clientId === clientId) setCreated(void 0);
+	}
+	return /* @__PURE__ */ jsxs("div", {
+		className: "flex min-w-0 flex-col gap-10",
+		"data-testid": "session-mcp-settings",
+		children: [
+			/* @__PURE__ */ jsxs(SettingsSection, { children: [
+				/* @__PURE__ */ jsxs(SettingsSectionHeader, { children: [/* @__PURE__ */ jsx(SettingsSectionTitle, { children: "Session MCP" }), /* @__PURE__ */ jsx(SettingsSectionDescription, { children: "Let ChatGPT or another MCP client work inside one live Po session. This is separate from the MCP servers Po calls out to." })] }),
+				/* @__PURE__ */ jsxs(SettingsCard, { children: [/* @__PURE__ */ jsxs(SettingsRow, { children: [/* @__PURE__ */ jsxs(SettingsRowText, { children: [/* @__PURE__ */ jsx(SettingsRowTitle, {
+					id: "session-mcp-picker-label",
+					children: "Session"
+				}), /* @__PURE__ */ jsx(SettingsRowDescription, { children: loading ? /* @__PURE__ */ jsxs("span", {
+					className: "inline-flex items-center gap-2",
+					children: [/* @__PURE__ */ jsx(Spinner, { label: "Reading the session MCP connection" }), "Reading the connection…"]
+				}) : selected === void 0 ? "Start a session first, then come back to connect a client to it." : !available ? "This session is disconnected. Reconnect it to manage its clients." : !loading && config === void 0 && error === void 0 ? "Turn on remote control with a public HTTPS address first. Clients connect through it." : "Clients connect to this session and work with its tools and permissions." })] }), /* @__PURE__ */ jsxs(Select, {
+					value: sessionId,
+					disabled: liveSessions.length === 0,
+					onValueChange: setSessionId,
+					children: [/* @__PURE__ */ jsx(SelectTrigger, {
+						id: "session-mcp-picker",
+						"data-testid": "session-mcp-session",
+						"aria-labelledby": "session-mcp-picker-label",
+						className: "w-full sm:w-72",
+						children: /* @__PURE__ */ jsx(SelectValue, { placeholder: "No live session" })
+					}), /* @__PURE__ */ jsx(SelectContent, { children: liveSessions.map((meta) => /* @__PURE__ */ jsxs(SelectItem, {
+						value: meta.summary.id,
+						children: [
+							meta.summary.name,
+							" · ",
+							meta.summary.cwd
+						]
+					}, meta.summary.id)) })]
+				})] }), config === void 0 ? null : /* @__PURE__ */ jsxs(Fragment$1, { children: [
+					/* @__PURE__ */ jsx(CopyValue, {
+						label: "MCP",
+						value: config.mcpUrl,
+						testId: "session-mcp-url"
+					}),
+					/* @__PURE__ */ jsx(CopyValue, {
+						label: "MCP with widgets",
+						value: config.mcpAppUrl,
+						testId: "session-mcp-app-url"
+					}),
+					/* @__PURE__ */ jsxs("details", { children: [/* @__PURE__ */ jsx("summary", {
+						className: "cursor-pointer px-5 py-3 text-sm text-doom-dim hover:text-doom-hi",
+						children: "OAuth endpoints"
+					}), /* @__PURE__ */ jsxs("dl", {
+						className: "grid gap-x-6 gap-y-1 border-t border-doom-border-soft px-5 py-4 text-sm sm:grid-cols-[auto_minmax(0,1fr)]",
+						children: [
+							/* @__PURE__ */ jsx("dt", {
+								className: "text-doom-dim",
+								children: "Authorization"
+							}),
+							/* @__PURE__ */ jsx("dd", {
+								className: "break-all font-mono text-doom-text",
+								children: config.authorizationEndpoint
+							}),
+							/* @__PURE__ */ jsx("dt", {
+								className: "text-doom-dim",
+								children: "Token"
+							}),
+							/* @__PURE__ */ jsx("dd", {
+								className: "break-all font-mono text-doom-text",
+								children: config.tokenEndpoint
+							})
+						]
+					})] })
+				] })] }),
+				error ? /* @__PURE__ */ jsx("p", {
+					role: "alert",
+					className: "text-sm leading-relaxed text-doom-red",
+					children: error
+				}) : null
+			] }),
+			config === void 0 || remoteCaller ? null : /* @__PURE__ */ jsxs(SettingsSection, {
+				"data-testid": "session-mcp-create",
+				children: [
+					/* @__PURE__ */ jsxs(SettingsSectionHeader, { children: [/* @__PURE__ */ jsx(SettingsSectionTitle, { children: "Connect a client" }), /* @__PURE__ */ jsx(SettingsSectionDescription, { children: "A signed URL is the simplest way to connect ChatGPT: the key travels inside the URL, so there is no OAuth callback or header to set up. Other clients can use an API key or OAuth." })] }),
+					/* @__PURE__ */ jsxs(SettingsCard, { children: [
+						/* @__PURE__ */ jsxs(SettingsRow, { children: [/* @__PURE__ */ jsxs(SettingsRowText, { children: [/* @__PURE__ */ jsx(SettingsRowTitle, {
+							id: "session-mcp-auth-method-label",
+							children: "Sign-in method"
+						}), /* @__PURE__ */ jsx(SettingsRowDescription, { children: "How the client proves it is allowed in." })] }), /* @__PURE__ */ jsxs(Select, {
+							value: authMethod,
+							onValueChange: (value) => setAuthMethod(value),
+							children: [/* @__PURE__ */ jsx(SelectTrigger, {
+								id: "session-mcp-auth-method",
+								"data-testid": "session-mcp-auth-method",
+								"aria-labelledby": "session-mcp-auth-method-label",
+								className: "w-full sm:w-72",
+								children: /* @__PURE__ */ jsx(SelectValue, {})
+							}), /* @__PURE__ */ jsxs(SelectContent, { children: [
+								/* @__PURE__ */ jsx(SelectItem, {
+									value: "url_token",
+									children: "Signed URL (JWT)"
+								}),
+								/* @__PURE__ */ jsx(SelectItem, {
+									value: "api_key",
+									children: "API key (Bearer)"
+								}),
+								/* @__PURE__ */ jsx(SelectItem, {
+									value: "oauth",
+									children: "OAuth (callback required)"
+								})
+							] })]
+						})] }),
+						authMethod === "oauth" ? /* @__PURE__ */ jsxs(SettingsRow, { children: [/* @__PURE__ */ jsxs(SettingsRowText, { children: [/* @__PURE__ */ jsx(SettingsRowTitle, { children: /* @__PURE__ */ jsx("label", {
+							htmlFor: "session-mcp-callback",
+							children: "Redirect URL"
+						}) }), /* @__PURE__ */ jsx(SettingsRowDescription, {
+							id: "session-mcp-callback-help",
+							children: invalidCallback ? /* @__PURE__ */ jsx("span", {
+								className: "text-doom-red",
+								children: "Use an absolute HTTPS URL without credentials or a fragment."
+							}) : "Copy it from your OAuth client. Don’t work it out from the MCP URL."
+						})] }), /* @__PURE__ */ jsx(Input, {
+							id: "session-mcp-callback",
+							"data-testid": "session-mcp-callback",
+							type: "url",
+							value: redirectUri,
+							placeholder: "https://chatgpt.com/connector/oauth/…",
+							"aria-invalid": invalidCallback,
+							"aria-describedby": "session-mcp-callback-help",
+							spellCheck: false,
+							onChange: (event) => setRedirectUri(event.target.value),
+							className: "w-full font-mono text-sm sm:w-72"
+						})] }) : null,
+						/* @__PURE__ */ jsxs(SettingsRow, { children: [/* @__PURE__ */ jsxs(SettingsRowText, { children: [/* @__PURE__ */ jsx(SettingsRowTitle, { children: /* @__PURE__ */ jsx("label", {
+							htmlFor: "session-mcp-tool-prefix",
+							children: "Tool prefix"
+						}) }), /* @__PURE__ */ jsxs(SettingsRowDescription, {
+							id: "session-mcp-tool-prefix-help",
+							children: [
+								"Tools appear as ",
+								/* @__PURE__ */ jsx("code", {
+									className: "font-mono",
+									children: "prefix_bash"
+								}),
+								",",
+								" ",
+								/* @__PURE__ */ jsx("code", {
+									className: "font-mono",
+									children: "prefix_read"
+								}),
+								". Lowercase letters and digits, joined by single underscores, up to 24 characters."
+							]
+						})] }), /* @__PURE__ */ jsx(Input, {
+							id: "session-mcp-tool-prefix",
+							"data-testid": "session-mcp-tool-prefix",
+							value: toolPrefix,
+							placeholder: "The session name",
+							autoComplete: "off",
+							spellCheck: false,
+							"aria-describedby": "session-mcp-tool-prefix-help",
+							onChange: (event) => setToolPrefix(event.target.value),
+							className: "w-full font-mono text-sm sm:w-72"
+						})] })
+					] }),
+					/* @__PURE__ */ jsxs("div", {
+						className: "flex flex-col gap-2",
+						"data-testid": "session-mcp-routing",
+						children: [/* @__PURE__ */ jsx(SettingsNote, { children: "Every conversation is automatically routed to its own worktree before tools run, never to the checkout this session uses. While a worktree is provisioning or recovering, tools wait; if recovery can't finish, the conversation reports it rather than falling back to this session." }), /* @__PURE__ */ jsx(SettingsNote, { children: "Access follows this session's mode, domains and profile as they change, and tools run with its permissions." })]
+					}),
+					/* @__PURE__ */ jsx(SettingsActions, { children: /* @__PURE__ */ jsx(Button, {
+						"data-testid": "session-mcp-create-button",
+						size: "sm",
+						variant: canCreate ? "primary" : "outline",
+						loading: busy,
+						disabled: !canCreate,
+						onClick: () => void createClient(),
+						children: authMethod === "url_token" ? "Create signed URL" : authMethod === "api_key" ? "Create API key" : "Create OAuth client"
+					}) })
+				]
+			}),
+			/* @__PURE__ */ jsxs(SettingsSection, {
+				"data-testid": "session-mcp-clients",
+				children: [
+					/* @__PURE__ */ jsxs(SettingsSectionHeader, { children: [/* @__PURE__ */ jsx(SettingsSectionTitle, { children: "Clients" }), clients.length > 0 ? /* @__PURE__ */ jsxs("span", {
+						className: "text-sm text-doom-dim tabular-nums",
+						children: [clients.length, " connected"]
+					}) : null] }),
+					remoteCaller ? /* @__PURE__ */ jsx(SettingsNote, {
+						"data-testid": "session-mcp-remote-note",
+						children: "New clients can only be created on the machine Po runs on. From here you can still see and revoke existing ones, if the host allows it."
+					}) : null,
+					visibleCreated === void 0 ? null : /* @__PURE__ */ jsxs(SettingsCard, {
+						className: "border-doom-green/50",
+						"data-testid": "session-mcp-secret",
+						children: [/* @__PURE__ */ jsxs(SettingsRow, { children: [/* @__PURE__ */ jsxs(SettingsRowText, { children: [/* @__PURE__ */ jsxs(SettingsRowTitle, {
+							className: "flex flex-wrap items-center gap-2",
+							children: ["Save these details now", visibleCreated.toolPrefix ? /* @__PURE__ */ jsxs(Badge, {
+								tone: "neutral",
+								className: "font-mono",
+								"data-testid": "session-mcp-created-prefix",
+								children: [visibleCreated.toolPrefix, "_*"]
+							}) : null]
+						}), /* @__PURE__ */ jsxs(SettingsRowDescription, { children: [visibleCreated.tokenEndpointAuthMethod === "url_token" ? "In ChatGPT, paste either URL into Server URL and choose no additional authentication. Treat both like a password: they are shown once and work until you revoke the client." : visibleCreated.tokenEndpointAuthMethod === "api_key" ? "In ChatGPT, choose API key with a Bearer header and paste the key. It is shown once and disappears when you dismiss it, leave this page or switch session." : null, visibleCreated.tokenEndpointAuthMethod === "url_token" || visibleCreated.tokenEndpointAuthMethod === "api_key" ? null : /* @__PURE__ */ jsxs(Fragment$1, { children: [
+							"Paste the client ID and secret into your OAuth client and choose",
+							" ",
+							/* @__PURE__ */ jsx("code", {
+								className: "font-mono",
+								children: "client_secret_post"
+							}),
+							" as the token endpoint auth method. The secret is shown once."
+						] })] })] }), /* @__PURE__ */ jsx(Button, {
+							variant: "ghost",
+							size: "sm",
+							onClick: () => setCreated(void 0),
+							children: "Dismiss"
+						})] }), visibleCreated.tokenEndpointAuthMethod === "url_token" ? /* @__PURE__ */ jsxs(Fragment$1, { children: [/* @__PURE__ */ jsx(CopyValue, {
+							label: "Signed MCP URL",
+							value: visibleCreated.connectionUrl,
+							testId: "session-mcp-created-url"
+						}), /* @__PURE__ */ jsx(CopyValue, {
+							label: "Signed MCP with widgets URL",
+							value: visibleCreated.mcpAppConnectionUrl,
+							testId: "session-mcp-created-app-url"
+						})] }) : /* @__PURE__ */ jsxs(Fragment$1, { children: [
+							config === void 0 ? null : /* @__PURE__ */ jsxs(Fragment$1, { children: [/* @__PURE__ */ jsx(CopyValue, {
+								label: "MCP",
+								value: config.mcpUrl,
+								testId: "session-mcp-created-url"
+							}), /* @__PURE__ */ jsx(CopyValue, {
+								label: "MCP with widgets",
+								value: config.mcpAppUrl,
+								testId: "session-mcp-created-app-url"
+							})] }),
+							visibleCreated.tokenEndpointAuthMethod === "api_key" ? null : /* @__PURE__ */ jsx(CopyValue, {
+								label: "Client ID",
+								value: visibleCreated.clientId,
+								testId: "session-mcp-created-id"
+							}),
+							/* @__PURE__ */ jsx(CopyValue, {
+								label: visibleCreated.tokenEndpointAuthMethod === "api_key" ? "API key" : "Client secret",
+								value: visibleCreated.clientSecret,
+								testId: "session-mcp-created-secret"
+							})
+						] })]
+					}),
+					clients.length === 0 ? loading ? null : /* @__PURE__ */ jsx(SettingsCard, { children: /* @__PURE__ */ jsx(SettingsRow, { children: /* @__PURE__ */ jsxs(SettingsRowText, { children: [/* @__PURE__ */ jsx(SettingsRowTitle, { children: "No clients yet" }), /* @__PURE__ */ jsx(SettingsRowDescription, { children: "Clients you connect to this session will be listed here." })] }) }) }) : /* @__PURE__ */ jsx(SettingsCard, {
+						asChild: true,
+						children: /* @__PURE__ */ jsx("ul", { children: clients.map((client) => /* @__PURE__ */ jsx(SettingsRow, {
+							asChild: true,
+							children: /* @__PURE__ */ jsxs("li", { children: [/* @__PURE__ */ jsxs(SettingsRowText, { children: [
+								/* @__PURE__ */ jsxs(SettingsRowTitle, {
+									className: "flex flex-wrap items-center gap-2",
+									children: [
+										client.name,
+										/* @__PURE__ */ jsx(Badge, {
+											tone: "neutral",
+											children: AUTH_METHOD_LABEL[client.tokenEndpointAuthMethod] ?? client.tokenEndpointAuthMethod
+										}),
+										client.toolPrefix ? /* @__PURE__ */ jsxs(Badge, {
+											tone: "neutral",
+											className: "font-mono",
+											children: [client.toolPrefix, "_*"]
+										}) : null
+									]
+								}),
+								/* @__PURE__ */ jsx(SettingsRowDescription, { children: client.scope === "session" ? "Session access. Worktree per conversation." : `Restricted access. Tools: ${client.tools.join(", ") || "none"}. Skills: ${client.skills.join(", ") || "none"}.` }),
+								/* @__PURE__ */ jsx("code", {
+									className: "block break-all font-mono text-sm text-doom-dim",
+									children: client.clientId
+								}),
+								client.redirectUri ? /* @__PURE__ */ jsx("span", {
+									className: "block break-all font-mono text-sm text-doom-dim",
+									children: client.redirectUri
+								}) : null
+							] }), /* @__PURE__ */ jsx(Button, {
+								variant: "ghost",
+								size: "sm",
+								disabled: busy,
+								onClick: () => void revoke(client.clientId),
+								children: "Revoke"
+							})] })
+						}, client.clientId)) })
+					}),
+					/* @__PURE__ */ jsx(SettingsNote, { children: "Signed URLs and API keys belong to this session and survive a restart until you revoke them. OAuth sign-ins last only while Po runs, so a client may ask to authorise again." })
+				]
+			})
+		]
+	});
+}
+//#endregion
+export { SessionMcpSettings };
+
+//# sourceMappingURL=SessionMcpSettings.mjs.map

package/dist/web/features/settings/SessionMcpSettings.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionMcpSettings.mjs","names":[],"sources":["../../../../src/web/features/settings/SessionMcpSettings.tsx"],"sourcesContent":["import {\n  Badge,\n  Button,\n  Input,\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n  SettingsActions,\n  SettingsCard,\n  SettingsNote,\n  SettingsRow,\n  SettingsRowDescription,\n  SettingsRowText,\n  SettingsRowTitle,\n  SettingsSection,\n  SettingsSectionDescription,\n  SettingsSectionHeader,\n  SettingsSectionTitle,\n  Spinner,\n} from '@agimon-ai/po-web-components';\nimport { useStore } from '@tanstack/react-store';\nimport { useEffect, useLayoutEffect, useMemo, useState } from 'react';\n\nimport type { CreatedSessionMcpClient, SessionMcpClient, SessionMcpConfig } from '../../../types/sessionMcp';\nimport { rememberedHostChannelKey } from '../../lib/sealedSession';\nimport {\n  createSessionMcpClient,\n  listSessionMcpClients,\n  readSessionMcpConfig,\n  revokeSessionMcpClient,\n} from '../../lib/sessionMcpApi';\nimport { useDashboardState } from '../../stores/dashboardStateStore';\nimport { remoteAccessStore } from '../../stores/remoteAccessStore';\nimport { sessionsStore } from '../../stores/sessionsStore';\n\nfunction exactHttpsUrl(value: string): boolean {\n  try {\n    const url = new URL(value);\n    return url.protocol === 'https:' && url.username === '' && url.password === '' && url.hash === '';\n  } catch {\n    return false;\n  }\n}\n\nfunction withoutCredential(client: CreatedSessionMcpClient): SessionMcpClient {\n  const {\n    clientSecret: _clientSecret,\n    connectionUrl: _connectionUrl,\n    mcpAppConnectionUrl: _mcpAppConnectionUrl,\n    ...metadata\n  } = client;\n  return metadata;\n}\n\ntype CopyState = 'idle' | 'copied' | 'failed';\n\nconst AUTH_METHOD_LABEL: Readonly<Record<string, string>> = {\n  url_token: 'Signed URL',\n  api_key: 'API key',\n  client_secret_post: 'OAuth',\n};\n\n/** One copyable value as a settings row: the label and value on the left, the copy button on the right. */\nfunction CopyValue({ label, value, testId }: { label: string; value: string; testId: string }) {\n  const [state, setState] = useState<CopyState>('idle');\n\n  async function copy(): Promise<void> {\n    if (navigator.clipboard === undefined) {\n      setState('failed');\n      return;\n    }\n    try {\n      await navigator.clipboard.writeText(value);\n      setState('copied');\n    } catch {\n      setState('failed');\n    }\n  }\n\n  return (\n    <SettingsRow>\n      <SettingsRowText>\n        <SettingsRowTitle>{label}</SettingsRowTitle>\n        <code className=\"break-all font-mono text-sm text-doom-text\" data-testid={testId}>\n          {value}\n        </code>\n        <output aria-live=\"polite\" className=\"text-sm text-doom-dim empty:hidden\">\n          {state === 'failed' ? 'Copying was blocked. Select the value above to copy it by hand.' : ''}\n          {state === 'copied' ? `${label} copied.` : ''}\n        </output>\n      </SettingsRowText>\n      <Button\n        type=\"button\"\n        variant=\"outline\"\n        size=\"sm\"\n        data-testid={`${testId}-copy`}\n        aria-label={`Copy ${label}`}\n        onClick={() => void copy()}\n      >\n        {state === 'copied' ? 'Copied' : 'Copy'}\n      </Button>\n    </SettingsRow>\n  );\n}\n\n/** Local management for the inbound, session-bound MCP endpoint exposed by the host. */\nexport function SessionMcpSettings() {\n  const sessions = useStore(sessionsStore);\n  const liveSessions = useMemo(\n    () => sessions.order.map((id) => sessions.byId[id]).filter((meta) => meta !== undefined && !meta.summary.dormant),\n    [sessions.byId, sessions.order],\n  );\n  const [sessionId, setSessionId] = useDashboardState(\n    'session-mcp/session',\n    () => sessions.activeId ?? liveSessions[0]?.summary.id ?? '',\n  );\n  const selected = sessionId === '' ? undefined : sessions.byId[sessionId];\n  const workspaceId = selected?.summary.workspaceId;\n  const available = selected?.attach === 'attached' && workspaceId !== undefined;\n  const selectionKey = `${workspaceId ?? ''}\\u0000${sessionId}`;\n  const [, setSelectionKey, selectionState] = useDashboardState('session-mcp/selection', selectionKey);\n  const remoteCaller = rememberedHostChannelKey() !== undefined;\n  // Session MCP URLs hang off Remote Control's public origin. Without one the config cannot exist,\n  // so it is not requested; the page says to enable Remote Control instead of reporting a failure.\n  const publicUrl = useStore(remoteAccessStore, (state) => state.view?.publicUrl);\n  const [config, setConfig] = useDashboardState<SessionMcpConfig | undefined>('session-mcp/config', undefined);\n  const [clients, setClients, clientsState] = useDashboardState<SessionMcpClient[]>('session-mcp/clients', []);\n  const [redirectUri, setRedirectUri] = useDashboardState('session-mcp/redirect', '');\n  const [toolPrefix, setToolPrefix] = useDashboardState('session-mcp/tool-prefix', '');\n  const [authMethod, setAuthMethod] = useDashboardState<'url_token' | 'api_key' | 'oauth'>(\n    'session-mcp/auth-method',\n    'url_token',\n  );\n  const [created, setCreated] = useDashboardState<{ sessionId: string; client: CreatedSessionMcpClient } | undefined>(\n    'session-mcp/created',\n    undefined,\n  );\n  const visibleCreated = created?.sessionId === sessionId ? created.client : undefined;\n  const [loading, setLoading] = useDashboardState('session-mcp/loading', false);\n  const [busy, setBusy, busyState] = useDashboardState('session-mcp/busy', false);\n  const [error, setError] = useDashboardState<string | undefined>('session-mcp/error', undefined);\n\n  useLayoutEffect(() => {\n    if (selectionState.state === selectionKey && available) return;\n    setSelectionKey(selectionKey);\n    // A template replacement is not a target change. Actual target changes still discard one-time secrets.\n    setCreated(undefined);\n    setRedirectUri('');\n    setToolPrefix('');\n    setConfig(undefined);\n    setClients([]);\n    setError(undefined);\n    setBusy(false);\n  }, [\n    available,\n    selectionKey,\n    selectionState,\n    setSelectionKey,\n    setCreated,\n    setRedirectUri,\n    setToolPrefix,\n    setConfig,\n    setClients,\n    setError,\n    setBusy,\n  ]);\n\n  // A one-time credential is shown only while this panel stays open. Leaving the section discards it,\n  // so the memory-only dashboard state never replays a secret on a later visit.\n  useEffect(() => () => setCreated(undefined), [setCreated]);\n\n  useEffect(() => {\n    if (liveSessions.some((meta) => meta.summary.id === sessionId)) return;\n    const next = liveSessions.find((meta) => meta.summary.id === sessions.activeId) ?? liveSessions[0];\n    // eslint-disable-next-line react/set-state-in-effect -- a removed or ended session must move the management target.\n    setSessionId(next?.summary.id ?? '');\n  }, [liveSessions, sessionId, sessions.activeId, setSessionId]);\n\n  useEffect(() => {\n    let current = true;\n    const previousClients = clientsState.state;\n    if (!available || workspaceId === undefined) {\n      setLoading(false);\n      return () => {\n        current = false;\n      };\n    }\n    setLoading(true);\n    void Promise.all([\n      publicUrl === undefined ? undefined : readSessionMcpConfig(workspaceId, sessionId),\n      listSessionMcpClients(workspaceId, sessionId),\n    ]).then(([configResult, clientsResult]) => {\n      if (!current) return;\n      if (configResult === undefined) setConfig(undefined);\n      else if ('error' in configResult) setError(configResult.error);\n      else setConfig(configResult.config);\n      if ('error' in clientsResult) setError((previous) => previous ?? clientsResult.error);\n      else if (!busyState.state && clientsState.state === previousClients) setClients(clientsResult.clients);\n      setLoading(false);\n    });\n    return () => {\n      current = false;\n    };\n  }, [\n    available,\n    publicUrl,\n    sessionId,\n    workspaceId,\n    clientsState,\n    busyState,\n    setConfig,\n    setClients,\n    setError,\n    setLoading,\n  ]);\n\n  const invalidCallback = authMethod === 'oauth' && redirectUri !== '' && !exactHttpsUrl(redirectUri);\n  const canCreate =\n    available &&\n    !remoteCaller &&\n    config !== undefined &&\n    (authMethod !== 'oauth' || exactHttpsUrl(redirectUri)) &&\n    !busy;\n\n  async function createClient(): Promise<void> {\n    if (!canCreate || workspaceId === undefined || busyState.state) return;\n    const operationSelection = selectionKey;\n    setBusy(true);\n    setError(undefined);\n    const prefix = toolPrefix.trim();\n    const naming = prefix === '' ? {} : { toolPrefix: prefix };\n    const result = await createSessionMcpClient(\n      workspaceId,\n      sessionId,\n      authMethod === 'oauth'\n        ? { redirectUri: redirectUri.trim(), scope: 'session', routing: 'conversation', ...naming }\n        : { authMethod, scope: 'session', routing: 'conversation', ...naming },\n    );\n    if (selectionState.state !== operationSelection) return;\n    setBusy(false);\n    if ('error' in result) {\n      setError(result.error);\n      return;\n    }\n    setCreated({ sessionId, client: result.client });\n    setClients((current) => [withoutCredential(result.client), ...current]);\n    setRedirectUri('');\n    setToolPrefix('');\n  }\n\n  async function revoke(clientId: string): Promise<void> {\n    if (workspaceId === undefined || busyState.state) return;\n    const operationSelection = selectionKey;\n    setBusy(true);\n    setError(undefined);\n    const result = await revokeSessionMcpClient(workspaceId, sessionId, clientId);\n    if (selectionState.state !== operationSelection) return;\n    setBusy(false);\n    if ('error' in result) {\n      setError(result.error);\n      return;\n    }\n    setClients((current) => current.filter((client) => client.clientId !== clientId));\n    if (visibleCreated?.clientId === clientId) setCreated(undefined);\n  }\n\n  const sessionStatus =\n    selected === undefined\n      ? 'Start a session first, then come back to connect a client to it.'\n      : !available\n        ? 'This session is disconnected. Reconnect it to manage its clients.'\n        : !loading && config === undefined && error === undefined\n          ? 'Turn on remote control with a public HTTPS address first. Clients connect through it.'\n          : 'Clients connect to this session and work with its tools and permissions.';\n\n  return (\n    <div className=\"flex min-w-0 flex-col gap-10\" data-testid=\"session-mcp-settings\">\n      <SettingsSection>\n        <SettingsSectionHeader>\n          <SettingsSectionTitle>Session MCP</SettingsSectionTitle>\n          <SettingsSectionDescription>\n            Let ChatGPT or another MCP client work inside one live Po session. This is separate from the MCP servers Po\n            calls out to.\n          </SettingsSectionDescription>\n        </SettingsSectionHeader>\n        <SettingsCard>\n          <SettingsRow>\n            <SettingsRowText>\n              <SettingsRowTitle id=\"session-mcp-picker-label\">Session</SettingsRowTitle>\n              <SettingsRowDescription>\n                {loading ? (\n                  <span className=\"inline-flex items-center gap-2\">\n                    <Spinner label=\"Reading the session MCP connection\" />\n                    Reading the connection…\n                  </span>\n                ) : (\n                  sessionStatus\n                )}\n              </SettingsRowDescription>\n            </SettingsRowText>\n            <Select value={sessionId} disabled={liveSessions.length === 0} onValueChange={setSessionId}>\n              <SelectTrigger\n                id=\"session-mcp-picker\"\n                data-testid=\"session-mcp-session\"\n                aria-labelledby=\"session-mcp-picker-label\"\n                className=\"w-full sm:w-72\"\n              >\n                <SelectValue placeholder=\"No live session\" />\n              </SelectTrigger>\n              <SelectContent>\n                {liveSessions.map((meta) => (\n                  <SelectItem key={meta.summary.id} value={meta.summary.id}>\n                    {meta.summary.name} · {meta.summary.cwd}\n                  </SelectItem>\n                ))}\n              </SelectContent>\n            </Select>\n          </SettingsRow>\n          {config === undefined ? null : (\n            <>\n              <CopyValue label=\"MCP\" value={config.mcpUrl} testId=\"session-mcp-url\" />\n              <CopyValue label=\"MCP with widgets\" value={config.mcpAppUrl} testId=\"session-mcp-app-url\" />\n              <details>\n                <summary className=\"cursor-pointer px-5 py-3 text-sm text-doom-dim hover:text-doom-hi\">\n                  OAuth endpoints\n                </summary>\n                <dl className=\"grid gap-x-6 gap-y-1 border-t border-doom-border-soft px-5 py-4 text-sm sm:grid-cols-[auto_minmax(0,1fr)]\">\n                  <dt className=\"text-doom-dim\">Authorization</dt>\n                  <dd className=\"break-all font-mono text-doom-text\">{config.authorizationEndpoint}</dd>\n                  <dt className=\"text-doom-dim\">Token</dt>\n                  <dd className=\"break-all font-mono text-doom-text\">{config.tokenEndpoint}</dd>\n                </dl>\n              </details>\n            </>\n          )}\n        </SettingsCard>\n        {error ? (\n          <p role=\"alert\" className=\"text-sm leading-relaxed text-doom-red\">\n            {error}\n          </p>\n        ) : null}\n      </SettingsSection>\n\n      {config === undefined || remoteCaller ? null : (\n        <SettingsSection data-testid=\"session-mcp-create\">\n          <SettingsSectionHeader>\n            <SettingsSectionTitle>Connect a client</SettingsSectionTitle>\n            <SettingsSectionDescription>\n              A signed URL is the simplest way to connect ChatGPT: the key travels inside the URL, so there is no OAuth\n              callback or header to set up. Other clients can use an API key or OAuth.\n            </SettingsSectionDescription>\n          </SettingsSectionHeader>\n          <SettingsCard>\n            <SettingsRow>\n              <SettingsRowText>\n                <SettingsRowTitle id=\"session-mcp-auth-method-label\">Sign-in method</SettingsRowTitle>\n                <SettingsRowDescription>How the client proves it is allowed in.</SettingsRowDescription>\n              </SettingsRowText>\n              <Select\n                value={authMethod}\n                onValueChange={(value) => setAuthMethod(value as 'url_token' | 'api_key' | 'oauth')}\n              >\n                <SelectTrigger\n                  id=\"session-mcp-auth-method\"\n                  data-testid=\"session-mcp-auth-method\"\n                  aria-labelledby=\"session-mcp-auth-method-label\"\n                  className=\"w-full sm:w-72\"\n                >\n                  <SelectValue />\n                </SelectTrigger>\n                <SelectContent>\n                  <SelectItem value=\"url_token\">Signed URL (JWT)</SelectItem>\n                  <SelectItem value=\"api_key\">API key (Bearer)</SelectItem>\n                  <SelectItem value=\"oauth\">OAuth (callback required)</SelectItem>\n                </SelectContent>\n              </Select>\n            </SettingsRow>\n            {authMethod === 'oauth' ? (\n              <SettingsRow>\n                <SettingsRowText>\n                  <SettingsRowTitle>\n                    <label htmlFor=\"session-mcp-callback\">Redirect URL</label>\n                  </SettingsRowTitle>\n                  <SettingsRowDescription id=\"session-mcp-callback-help\">\n                    {invalidCallback ? (\n                      <span className=\"text-doom-red\">\n                        Use an absolute HTTPS URL without credentials or a fragment.\n                      </span>\n                    ) : (\n                      'Copy it from your OAuth client. Don’t work it out from the MCP URL.'\n                    )}\n                  </SettingsRowDescription>\n                </SettingsRowText>\n                <Input\n                  id=\"session-mcp-callback\"\n                  data-testid=\"session-mcp-callback\"\n                  type=\"url\"\n                  value={redirectUri}\n                  placeholder=\"https://chatgpt.com/connector/oauth/…\"\n                  aria-invalid={invalidCallback}\n                  aria-describedby=\"session-mcp-callback-help\"\n                  spellCheck={false}\n                  onChange={(event) => setRedirectUri(event.target.value)}\n                  className=\"w-full font-mono text-sm sm:w-72\"\n                />\n              </SettingsRow>\n            ) : null}\n            <SettingsRow>\n              <SettingsRowText>\n                <SettingsRowTitle>\n                  <label htmlFor=\"session-mcp-tool-prefix\">Tool prefix</label>\n                </SettingsRowTitle>\n                <SettingsRowDescription id=\"session-mcp-tool-prefix-help\">\n                  Tools appear as <code className=\"font-mono\">prefix_bash</code>,{' '}\n                  <code className=\"font-mono\">prefix_read</code>. Lowercase letters and digits, joined by single\n                  underscores, up to 24 characters.\n                </SettingsRowDescription>\n              </SettingsRowText>\n              <Input\n                id=\"session-mcp-tool-prefix\"\n                data-testid=\"session-mcp-tool-prefix\"\n                value={toolPrefix}\n                placeholder=\"The session name\"\n                autoComplete=\"off\"\n                spellCheck={false}\n                aria-describedby=\"session-mcp-tool-prefix-help\"\n                onChange={(event) => setToolPrefix(event.target.value)}\n                className=\"w-full font-mono text-sm sm:w-72\"\n              />\n            </SettingsRow>\n          </SettingsCard>\n          <div className=\"flex flex-col gap-2\" data-testid=\"session-mcp-routing\">\n            <SettingsNote>\n              Every conversation is automatically routed to its own worktree before tools run, never to the checkout\n              this session uses. While a worktree is provisioning or recovering, tools wait; if recovery can&apos;t\n              finish, the conversation reports it rather than falling back to this session.\n            </SettingsNote>\n            <SettingsNote>\n              Access follows this session&apos;s mode, domains and profile as they change, and tools run with its\n              permissions.\n            </SettingsNote>\n          </div>\n          <SettingsActions>\n            <Button\n              data-testid=\"session-mcp-create-button\"\n              size=\"sm\"\n              variant={canCreate ? 'primary' : 'outline'}\n              loading={busy}\n              disabled={!canCreate}\n              onClick={() => void createClient()}\n            >\n              {authMethod === 'url_token'\n                ? 'Create signed URL'\n                : authMethod === 'api_key'\n                  ? 'Create API key'\n                  : 'Create OAuth client'}\n            </Button>\n          </SettingsActions>\n        </SettingsSection>\n      )}\n\n      <SettingsSection data-testid=\"session-mcp-clients\">\n        <SettingsSectionHeader>\n          <SettingsSectionTitle>Clients</SettingsSectionTitle>\n          {clients.length > 0 ? (\n            <span className=\"text-sm text-doom-dim tabular-nums\">{clients.length} connected</span>\n          ) : null}\n        </SettingsSectionHeader>\n\n        {remoteCaller ? (\n          <SettingsNote data-testid=\"session-mcp-remote-note\">\n            New clients can only be created on the machine Po runs on. From here you can still see and revoke existing\n            ones, if the host allows it.\n          </SettingsNote>\n        ) : null}\n\n        {visibleCreated === undefined ? null : (\n          <SettingsCard className=\"border-doom-green/50\" data-testid=\"session-mcp-secret\">\n            <SettingsRow>\n              <SettingsRowText>\n                <SettingsRowTitle className=\"flex flex-wrap items-center gap-2\">\n                  Save these details now\n                  {visibleCreated.toolPrefix ? (\n                    <Badge tone=\"neutral\" className=\"font-mono\" data-testid=\"session-mcp-created-prefix\">\n                      {visibleCreated.toolPrefix}_*\n                    </Badge>\n                  ) : null}\n                </SettingsRowTitle>\n                <SettingsRowDescription>\n                  {visibleCreated.tokenEndpointAuthMethod === 'url_token'\n                    ? 'In ChatGPT, paste either URL into Server URL and choose no additional authentication. Treat both like a password: they are shown once and work until you revoke the client.'\n                    : visibleCreated.tokenEndpointAuthMethod === 'api_key'\n                      ? 'In ChatGPT, choose API key with a Bearer header and paste the key. It is shown once and disappears when you dismiss it, leave this page or switch session.'\n                      : null}\n                  {visibleCreated.tokenEndpointAuthMethod === 'url_token' ||\n                  visibleCreated.tokenEndpointAuthMethod === 'api_key' ? null : (\n                    <>\n                      Paste the client ID and secret into your OAuth client and choose{' '}\n                      <code className=\"font-mono\">client_secret_post</code> as the token endpoint auth method. The\n                      secret is shown once.\n                    </>\n                  )}\n                </SettingsRowDescription>\n              </SettingsRowText>\n              <Button variant=\"ghost\" size=\"sm\" onClick={() => setCreated(undefined)}>\n                Dismiss\n              </Button>\n            </SettingsRow>\n            {visibleCreated.tokenEndpointAuthMethod === 'url_token' ? (\n              <>\n                <CopyValue\n                  label=\"Signed MCP URL\"\n                  value={visibleCreated.connectionUrl!}\n                  testId=\"session-mcp-created-url\"\n                />\n                <CopyValue\n                  label=\"Signed MCP with widgets URL\"\n                  value={visibleCreated.mcpAppConnectionUrl!}\n                  testId=\"session-mcp-created-app-url\"\n                />\n              </>\n            ) : (\n              <>\n                {config === undefined ? null : (\n                  <>\n                    <CopyValue label=\"MCP\" value={config.mcpUrl} testId=\"session-mcp-created-url\" />\n                    <CopyValue label=\"MCP with widgets\" value={config.mcpAppUrl} testId=\"session-mcp-created-app-url\" />\n                  </>\n                )}\n                {visibleCreated.tokenEndpointAuthMethod === 'api_key' ? null : (\n                  <CopyValue label=\"Client ID\" value={visibleCreated.clientId} testId=\"session-mcp-created-id\" />\n                )}\n                <CopyValue\n                  label={visibleCreated.tokenEndpointAuthMethod === 'api_key' ? 'API key' : 'Client secret'}\n                  value={visibleCreated.clientSecret!}\n                  testId=\"session-mcp-created-secret\"\n                />\n              </>\n            )}\n          </SettingsCard>\n        )}\n\n        {clients.length === 0 ? (\n          loading ? null : (\n            <SettingsCard>\n              <SettingsRow>\n                <SettingsRowText>\n                  <SettingsRowTitle>No clients yet</SettingsRowTitle>\n                  <SettingsRowDescription>\n                    Clients you connect to this session will be listed here.\n                  </SettingsRowDescription>\n                </SettingsRowText>\n              </SettingsRow>\n            </SettingsCard>\n          )\n        ) : (\n          <SettingsCard asChild>\n            <ul>\n              {clients.map((client) => (\n                <SettingsRow asChild key={client.clientId}>\n                  <li>\n                    <SettingsRowText>\n                      <SettingsRowTitle className=\"flex flex-wrap items-center gap-2\">\n                        {client.name}\n                        <Badge tone=\"neutral\">\n                          {AUTH_METHOD_LABEL[client.tokenEndpointAuthMethod] ?? client.tokenEndpointAuthMethod}\n                        </Badge>\n                        {client.toolPrefix ? (\n                          <Badge tone=\"neutral\" className=\"font-mono\">\n                            {client.toolPrefix}_*\n                          </Badge>\n                        ) : null}\n                      </SettingsRowTitle>\n                      <SettingsRowDescription>\n                        {client.scope === 'session'\n                          ? 'Session access. Worktree per conversation.'\n                          : `Restricted access. Tools: ${client.tools.join(', ') || 'none'}. Skills: ${client.skills.join(', ') || 'none'}.`}\n                      </SettingsRowDescription>\n                      <code className=\"block break-all font-mono text-sm text-doom-dim\">{client.clientId}</code>\n                      {client.redirectUri ? (\n                        <span className=\"block break-all font-mono text-sm text-doom-dim\">{client.redirectUri}</span>\n                      ) : null}\n                    </SettingsRowText>\n                    <Button variant=\"ghost\" size=\"sm\" disabled={busy} onClick={() => void revoke(client.clientId)}>\n                      Revoke\n                    </Button>\n                  </li>\n                </SettingsRow>\n              ))}\n            </ul>\n          </SettingsCard>\n        )}\n\n        <SettingsNote>\n          Signed URLs and API keys belong to this session and survive a restart until you revoke them. OAuth sign-ins\n          last only while Po runs, so a client may ask to authorise again.\n        </SettingsNote>\n      </SettingsSection>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;;AAqCA,SAAS,cAAc,OAAwB;CAC7C,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,KAAK;EACzB,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,SAAS;CACjG,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAAkB,QAAmD;CAC5E,MAAM,EACJ,cAAc,eACd,eAAe,gBACf,qBAAqB,sBACrB,GAAG,aACD;CACJ,OAAO;AACT;AAIA,MAAM,oBAAsD;CAC1D,WAAW;CACX,SAAS;CACT,oBAAoB;AACtB;;AAGA,SAAS,UAAU,EAAE,OAAO,OAAO,UAA4D;CAC7F,MAAM,CAAC,OAAO,YAAY,SAAoB,MAAM;CAEpD,eAAe,OAAsB;EACnC,IAAI,UAAU,cAAc,KAAA,GAAW;GACrC,SAAS,QAAQ;GACjB;EACF;EACA,IAAI;GACF,MAAM,UAAU,UAAU,UAAU,KAAK;GACzC,SAAS,QAAQ;EACnB,QAAQ;GACN,SAAS,QAAQ;EACnB;CACF;CAEA,OACE,qBAAC,aAAD,EAAA,UAAA,CACE,qBAAC,iBAAD,EAAA,UAAA;EACE,oBAAC,kBAAD,EAAA,UAAmB,MAAwB,CAAA;EAC3C,oBAAC,QAAD;GAAM,WAAU;GAA6C,eAAa;GACvE,UAAA;EACG,CAAA;EACN,qBAAC,UAAD;GAAQ,aAAU;GAAS,WAAU;GAArC,UAAA,CACG,UAAU,WAAW,oEAAoE,IACzF,UAAU,WAAW,GAAG,MAAM,YAAY,EACrC;;CACO,EAAA,CAAA,GACjB,oBAAC,QAAD;EACE,MAAK;EACL,SAAQ;EACR,MAAK;EACL,eAAa,GAAG,OAAO;EACvB,cAAY,QAAQ;EACpB,eAAe,KAAK,KAAK;EAExB,UAAA,UAAU,WAAW,WAAW;CAC3B,CAAA,CACG,EAAA,CAAA;AAEjB;;AAGA,SAAgB,qBAAqB;CACnC,MAAM,WAAW,SAAS,aAAa;CACvC,MAAM,eAAe,cACb,SAAS,MAAM,KAAK,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,QAAQ,SAAS,SAAS,KAAA,KAAa,CAAC,KAAK,QAAQ,OAAO,GAChH,CAAC,SAAS,MAAM,SAAS,KAAK,CAChC;CACA,MAAM,CAAC,WAAW,gBAAgB,kBAChC,6BACM,SAAS,YAAY,aAAa,EAAE,EAAE,QAAQ,MAAM,EAC5D;CACA,MAAM,WAAW,cAAc,KAAK,KAAA,IAAY,SAAS,KAAK;CAC9D,MAAM,cAAc,UAAU,QAAQ;CACtC,MAAM,YAAY,UAAU,WAAW,cAAc,gBAAgB,KAAA;CACrE,MAAM,eAAe,GAAG,eAAe,GAAG,QAAQ;CAClD,MAAM,GAAG,iBAAiB,kBAAkB,kBAAkB,yBAAyB,YAAY;CACnG,MAAM,eAAe,yBAAyB,MAAM,KAAA;CAGpD,MAAM,YAAY,SAAS,oBAAoB,UAAU,MAAM,MAAM,SAAS;CAC9E,MAAM,CAAC,QAAQ,aAAa,kBAAgD,sBAAsB,KAAA,CAAS;CAC3G,MAAM,CAAC,SAAS,YAAY,gBAAgB,kBAAsC,uBAAuB,CAAC,CAAC;CAC3G,MAAM,CAAC,aAAa,kBAAkB,kBAAkB,wBAAwB,EAAE;CAClF,MAAM,CAAC,YAAY,iBAAiB,kBAAkB,2BAA2B,EAAE;CACnF,MAAM,CAAC,YAAY,iBAAiB,kBAClC,2BACA,WACF;CACA,MAAM,CAAC,SAAS,cAAc,kBAC5B,uBACA,KAAA,CACF;CACA,MAAM,iBAAiB,SAAS,cAAc,YAAY,QAAQ,SAAS,KAAA;CAC3E,MAAM,CAAC,SAAS,cAAc,kBAAkB,uBAAuB,KAAK;CAC5E,MAAM,CAAC,MAAM,SAAS,aAAa,kBAAkB,oBAAoB,KAAK;CAC9E,MAAM,CAAC,OAAO,YAAY,kBAAsC,qBAAqB,KAAA,CAAS;CAE9F,sBAAsB;EACpB,IAAI,eAAe,UAAU,gBAAgB,WAAW;EACxD,gBAAgB,YAAY;EAE5B,WAAW,KAAA,CAAS;EACpB,eAAe,EAAE;EACjB,cAAc,EAAE;EAChB,UAAU,KAAA,CAAS;EACnB,WAAW,CAAC,CAAC;EACb,SAAS,KAAA,CAAS;EAClB,QAAQ,KAAK;CACf,GAAG;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CAID,sBAAsB,WAAW,KAAA,CAAS,GAAG,CAAC,UAAU,CAAC;CAEzD,gBAAgB;EACd,IAAI,aAAa,MAAM,SAAS,KAAK,QAAQ,OAAO,SAAS,GAAG;EAChE,MAAM,OAAO,aAAa,MAAM,SAAS,KAAK,QAAQ,OAAO,SAAS,QAAQ,KAAK,aAAa;EAEhG,aAAa,MAAM,QAAQ,MAAM,EAAE;CACrC,GAAG;EAAC;EAAc;EAAW,SAAS;EAAU;CAAY,CAAC;CAE7D,gBAAgB;EACd,IAAI,UAAU;EACd,MAAM,kBAAkB,aAAa;EACrC,IAAI,CAAC,aAAa,gBAAgB,KAAA,GAAW;GAC3C,WAAW,KAAK;GAChB,aAAa;IACX,UAAU;GACZ;EACF;EACA,WAAW,IAAI;EACf,QAAa,IAAI,CACf,cAAc,KAAA,IAAY,KAAA,IAAY,qBAAqB,aAAa,SAAS,GACjF,sBAAsB,aAAa,SAAS,CAC9C,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,mBAAmB;GACzC,IAAI,CAAC,SAAS;GACd,IAAI,iBAAiB,KAAA,GAAW,UAAU,KAAA,CAAS;QAC9C,IAAI,WAAW,cAAc,SAAS,aAAa,KAAK;QACxD,UAAU,aAAa,MAAM;GAClC,IAAI,WAAW,eAAe,UAAU,aAAa,YAAY,cAAc,KAAK;QAC/E,IAAI,CAAC,UAAU,SAAS,aAAa,UAAU,iBAAiB,WAAW,cAAc,OAAO;GACrG,WAAW,KAAK;EAClB,CAAC;EACD,aAAa;GACX,UAAU;EACZ;CACF,GAAG;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC;CAED,MAAM,kBAAkB,eAAe,WAAW,gBAAgB,MAAM,CAAC,cAAc,WAAW;CAClG,MAAM,YACJ,aACA,CAAC,gBACD,WAAW,KAAA,MACV,eAAe,WAAW,cAAc,WAAW,MACpD,CAAC;CAEH,eAAe,eAA8B;EAC3C,IAAI,CAAC,aAAa,gBAAgB,KAAA,KAAa,UAAU,OAAO;EAChE,MAAM,qBAAqB;EAC3B,QAAQ,IAAI;EACZ,SAAS,KAAA,CAAS;EAClB,MAAM,SAAS,WAAW,KAAK;EAC/B,MAAM,SAAS,WAAW,KAAK,CAAC,IAAI,EAAE,YAAY,OAAO;EACzD,MAAM,SAAS,MAAM,uBACnB,aACA,WACA,eAAe,UACX;GAAE,aAAa,YAAY,KAAK;GAAG,OAAO;GAAW,SAAS;GAAgB,GAAG;EAAO,IACxF;GAAE;GAAY,OAAO;GAAW,SAAS;GAAgB,GAAG;EAAO,CACzE;EACA,IAAI,eAAe,UAAU,oBAAoB;EACjD,QAAQ,KAAK;EACb,IAAI,WAAW,QAAQ;GACrB,SAAS,OAAO,KAAK;GACrB;EACF;EACA,WAAW;GAAE;GAAW,QAAQ,OAAO;EAAO,CAAC;EAC/C,YAAY,YAAY,CAAC,kBAAkB,OAAO,MAAM,GAAG,GAAG,OAAO,CAAC;EACtE,eAAe,EAAE;EACjB,cAAc,EAAE;CAClB;CAEA,eAAe,OAAO,UAAiC;EACrD,IAAI,gBAAgB,KAAA,KAAa,UAAU,OAAO;EAClD,MAAM,qBAAqB;EAC3B,QAAQ,IAAI;EACZ,SAAS,KAAA,CAAS;EAClB,MAAM,SAAS,MAAM,uBAAuB,aAAa,WAAW,QAAQ;EAC5E,IAAI,eAAe,UAAU,oBAAoB;EACjD,QAAQ,KAAK;EACb,IAAI,WAAW,QAAQ;GACrB,SAAS,OAAO,KAAK;GACrB;EACF;EACA,YAAY,YAAY,QAAQ,QAAQ,WAAW,OAAO,aAAa,QAAQ,CAAC;EAChF,IAAI,gBAAgB,aAAa,UAAU,WAAW,KAAA,CAAS;CACjE;CAWA,OACE,qBAAC,OAAD;EAAK,WAAU;EAA+B,eAAY;EAA1D,UAAA;GACE,qBAAC,iBAAD,EAAA,UAAA;IACE,qBAAC,uBAAD,EAAA,UAAA,CACE,oBAAC,sBAAD,EAAA,UAAsB,cAAiC,CAAA,GACvD,oBAAC,4BAAD,EAAA,UAA4B,4HAGA,CAAA,CACP,EAAA,CAAA;IACvB,qBAAC,cAAD,EAAA,UAAA,CACE,qBAAC,aAAD,EAAA,UAAA,CACE,qBAAC,iBAAD,EAAA,UAAA,CACE,oBAAC,kBAAD;KAAkB,IAAG;KAA2B,UAAA;IAAyB,CAAA,GACzE,oBAAC,wBAAD,EAAA,UACG,UACC,qBAAC,QAAD;KAAM,WAAU;KAAhB,UAAA,CACE,oBAAC,SAAD,EAAS,OAAM,qCAAsC,CAAA,GAAC,yBAElD;IA3BpB,CAAA,IAAA,aAAa,KAAA,IACT,qEACA,CAAC,YACC,sEACA,CAAC,WAAW,WAAW,KAAA,KAAa,UAAU,KAAA,IAC5C,0FACA,2EAyB0B,CAAA,CACT,EAAA,CAAA,GACjB,qBAAC,QAAD;KAAQ,OAAO;KAAW,UAAU,aAAa,WAAW;KAAG,eAAe;KAA9E,UAAA,CACE,oBAAC,eAAD;MACE,IAAG;MACH,eAAY;MACZ,mBAAgB;MAChB,WAAU;MAEV,UAAA,oBAAC,aAAD,EAAa,aAAY,kBAAmB,CAAA;KAC/B,CAAA,GACf,oBAAC,eAAD,EAAA,UACG,aAAa,KAAK,SACjB,qBAAC,YAAD;MAAkC,OAAO,KAAK,QAAQ;MAAtD,UAAA;OACG,KAAK,QAAQ;OAAK;OAAI,KAAK,QAAQ;MAC1B;KAFK,GAAA,KAAK,QAAQ,EAElB,CACb,EACY,CAAA,CACT;IACG,CAAA,CAAA,EAAA,CAAA,GACZ,WAAW,KAAA,IAAY,OACtB,qBAAA,YAAA,EAAA,UAAA;KACE,oBAAC,WAAD;MAAW,OAAM;MAAM,OAAO,OAAO;MAAQ,QAAO;KAAmB,CAAA;KACvE,oBAAC,WAAD;MAAW,OAAM;MAAmB,OAAO,OAAO;MAAW,QAAO;KAAuB,CAAA;KAC3F,qBAAC,WAAD,EAAA,UAAA,CACE,oBAAC,WAAD;MAAS,WAAU;MAAoE,UAAA;KAE9E,CAAA,GACT,qBAAC,MAAD;MAAI,WAAU;MAAd,UAAA;OACE,oBAAC,MAAD;QAAI,WAAU;QAAgB,UAAA;OAAiB,CAAA;OAC/C,oBAAC,MAAD;QAAI,WAAU;QAAsC,UAAA,OAAO;OAA0B,CAAA;OACrF,oBAAC,MAAD;QAAI,WAAU;QAAgB,UAAA;OAAS,CAAA;OACvC,oBAAC,MAAD;QAAI,WAAU;QAAsC,UAAA,OAAO;OAAkB,CAAA;MAC3E;KACG,CAAA,CAAA,EAAA,CAAA;IACT,EAAA,CAAA,CAEQ,EAAA,CAAA;IACb,QACC,oBAAC,KAAD;KAAG,MAAK;KAAQ,WAAU;KACvB,UAAA;IACA,CAAA,IACD;GACW,EAAA,CAAA;GAEhB,WAAW,KAAA,KAAa,eAAe,OACtC,qBAAC,iBAAD;IAAiB,eAAY;IAA7B,UAAA;KACE,qBAAC,uBAAD,EAAA,UAAA,CACE,oBAAC,sBAAD,EAAA,UAAsB,mBAAsC,CAAA,GAC5D,oBAAC,4BAAD,EAAA,UAA4B,qLAGA,CAAA,CACP,EAAA,CAAA;KACvB,qBAAC,cAAD,EAAA,UAAA;MACE,qBAAC,aAAD,EAAA,UAAA,CACE,qBAAC,iBAAD,EAAA,UAAA,CACE,oBAAC,kBAAD;OAAkB,IAAG;OAAgC,UAAA;MAAgC,CAAA,GACrF,oBAAC,wBAAD,EAAA,UAAwB,0CAA+D,CAAA,CACxE,EAAA,CAAA,GACjB,qBAAC,QAAD;OACE,OAAO;OACP,gBAAgB,UAAU,cAAc,KAA0C;OAFpF,UAAA,CAIE,oBAAC,eAAD;QACE,IAAG;QACH,eAAY;QACZ,mBAAgB;QAChB,WAAU;QAEV,UAAA,oBAAC,aAAD,CAAc,CAAA;OACD,CAAA,GACf,qBAAC,eAAD,EAAA,UAAA;QACE,oBAAC,YAAD;SAAY,OAAM;SAAY,UAAA;QAA4B,CAAA;QAC1D,oBAAC,YAAD;SAAY,OAAM;SAAU,UAAA;QAA4B,CAAA;QACxD,oBAAC,YAAD;SAAY,OAAM;SAAQ,UAAA;QAAqC,CAAA;OAClD,EAAA,CAAA,CACT;MACG,CAAA,CAAA,EAAA,CAAA;MACZ,eAAe,UACd,qBAAC,aAAD,EAAA,UAAA,CACE,qBAAC,iBAAD,EAAA,UAAA,CACE,oBAAC,kBAAD,EAAA,UACE,oBAAC,SAAD;OAAO,SAAQ;OAAuB,UAAA;MAAmB,CAAA,EACzC,CAAA,GAClB,oBAAC,wBAAD;OAAwB,IAAG;OACxB,UAAA,kBACC,oBAAC,QAAD;QAAM,WAAU;QAAgB,UAAA;OAE1B,CAAA,IAEN;MAEoB,CAAA,CACT,EAAA,CAAA,GACjB,oBAAC,OAAD;OACE,IAAG;OACH,eAAY;OACZ,MAAK;OACL,OAAO;OACP,aAAY;OACZ,gBAAc;OACd,oBAAiB;OACjB,YAAY;OACZ,WAAW,UAAU,eAAe,MAAM,OAAO,KAAK;OACtD,WAAU;MACX,CAAA,CACU,EAAA,CAAA,IACX;MACJ,qBAAC,aAAD,EAAA,UAAA,CACE,qBAAC,iBAAD,EAAA,UAAA,CACE,oBAAC,kBAAD,EAAA,UACE,oBAAC,SAAD;OAAO,SAAQ;OAA0B,UAAA;MAAkB,CAAA,EAC3C,CAAA,GAClB,qBAAC,wBAAD;OAAwB,IAAG;OAA3B,UAAA;QAA0D;QACxC,oBAAC,QAAD;SAAM,WAAU;SAAY,UAAA;QAAiB,CAAA;QAAC;QAAE;QAChE,oBAAC,QAAD;SAAM,WAAU;SAAY,UAAA;QAAiB,CAAA;QAAC;OAExB;MACT,CAAA,CAAA,EAAA,CAAA,GACjB,oBAAC,OAAD;OACE,IAAG;OACH,eAAY;OACZ,OAAO;OACP,aAAY;OACZ,cAAa;OACb,YAAY;OACZ,oBAAiB;OACjB,WAAW,UAAU,cAAc,MAAM,OAAO,KAAK;OACrD,WAAU;MACX,CAAA,CACU,EAAA,CAAA;KACD,EAAA,CAAA;KACd,qBAAC,OAAD;MAAK,WAAU;MAAsB,eAAY;MAAjD,UAAA,CACE,oBAAC,cAAD,EAAA,UAAc,wRAIA,CAAA,GACd,oBAAC,cAAD,EAAA,UAAc,8GAGA,CAAA,CACX;;KACL,oBAAC,iBAAD,EAAA,UACE,oBAAC,QAAD;MACE,eAAY;MACZ,MAAK;MACL,SAAS,YAAY,YAAY;MACjC,SAAS;MACT,UAAU,CAAC;MACX,eAAe,KAAK,aAAa;MAEhC,UAAA,eAAe,cACZ,sBACA,eAAe,YACb,mBACA;KACA,CAAA,EACO,CAAA;IACF;;GAGnB,qBAAC,iBAAD;IAAiB,eAAY;IAA7B,UAAA;KACE,qBAAC,uBAAD,EAAA,UAAA,CACE,oBAAC,sBAAD,EAAA,UAAsB,UAA6B,CAAA,GAClD,QAAQ,SAAS,IAChB,qBAAC,QAAD;MAAM,WAAU;MAAhB,UAAA,CAAsD,QAAQ,QAAO,YAAgB;KACnF,CAAA,IAAA,IACiB,EAAA,CAAA;KAEtB,eACC,oBAAC,cAAD;MAAc,eAAY;MAA0B,UAAA;KAGtC,CAAA,IACZ;KAEH,mBAAmB,KAAA,IAAY,OAC9B,qBAAC,cAAD;MAAc,WAAU;MAAuB,eAAY;MAA3D,UAAA,CACE,qBAAC,aAAD,EAAA,UAAA,CACE,qBAAC,iBAAD,EAAA,UAAA,CACE,qBAAC,kBAAD;OAAkB,WAAU;OAA5B,UAAA,CAAgE,0BAE7D,eAAe,aACd,qBAAC,OAAD;QAAO,MAAK;QAAU,WAAU;QAAY,eAAY;QAAxD,UAAA,CACG,eAAe,YAAW,IACtB;OACL,CAAA,IAAA,IACY;MAClB,CAAA,GAAA,qBAAC,wBAAD,EAAA,UAAA,CACG,eAAe,4BAA4B,cACxC,gLACA,eAAe,4BAA4B,YACzC,+JACA,MACL,eAAe,4BAA4B,eAC5C,eAAe,4BAA4B,YAAY,OACrD,qBAAA,YAAA,EAAA,UAAA;OAAE;OACiE;OACjE,oBAAC,QAAD;QAAM,WAAU;QAAY,UAAA;OAAwB,CAAA;OAAC;MAErD,EAAA,CAAA,CAEkB,EAAA,CAAA,CACT,EAAA,CAAA,GACjB,oBAAC,QAAD;OAAQ,SAAQ;OAAQ,MAAK;OAAK,eAAe,WAAW,KAAA,CAAS;OAAG,UAAA;MAEhE,CAAA,CACG,EAAA,CAAA,GACZ,eAAe,4BAA4B,cAC1C,qBAAA,YAAA,EAAA,UAAA,CACE,oBAAC,WAAD;OACE,OAAM;OACN,OAAO,eAAe;OACtB,QAAO;MACR,CAAA,GACD,oBAAC,WAAD;OACE,OAAM;OACN,OAAO,eAAe;OACtB,QAAO;MACR,CAAA,CACD,EAAA,CAAA,IAEF,qBAAA,YAAA,EAAA,UAAA;OACG,WAAW,KAAA,IAAY,OACtB,qBAAA,YAAA,EAAA,UAAA,CACE,oBAAC,WAAD;QAAW,OAAM;QAAM,OAAO,OAAO;QAAQ,QAAO;OAA2B,CAAA,GAC/E,oBAAC,WAAD;QAAW,OAAM;QAAmB,OAAO,OAAO;QAAW,QAAO;OAA+B,CAAA,CACnG,EAAA,CAAA;OAEH,eAAe,4BAA4B,YAAY,OACtD,oBAAC,WAAD;QAAW,OAAM;QAAY,OAAO,eAAe;QAAU,QAAO;OAA0B,CAAA;OAEhG,oBAAC,WAAD;QACE,OAAO,eAAe,4BAA4B,YAAY,YAAY;QAC1E,OAAO,eAAe;QACtB,QAAO;OACR,CAAA;MACD,EAAA,CAAA,CAEQ;;KAGf,QAAQ,WAAW,IAClB,UAAU,OACR,oBAAC,cAAD,EAAA,UACE,oBAAC,aAAD,EAAA,UACE,qBAAC,iBAAD,EAAA,UAAA,CACE,oBAAC,kBAAD,EAAA,UAAkB,iBAAgC,CAAA,GAClD,oBAAC,wBAAD,EAAA,UAAwB,2DAEA,CAAA,CACT,EAAA,CAAA,EACN,CAAA,EACD,CAAA,IAGhB,oBAAC,cAAD;MAAc,SAAA;MACZ,UAAA,oBAAC,MAAD,EAAA,UACG,QAAQ,KAAK,WACZ,oBAAC,aAAD;OAAa,SAAA;OACX,UAAA,qBAAC,MAAD,EAAA,UAAA,CACE,qBAAC,iBAAD,EAAA,UAAA;QACE,qBAAC,kBAAD;SAAkB,WAAU;SAA5B,UAAA;UACG,OAAO;UACR,oBAAC,OAAD;WAAO,MAAK;WACT,UAAA,kBAAkB,OAAO,4BAA4B,OAAO;UACxD,CAAA;UACN,OAAO,aACN,qBAAC,OAAD;WAAO,MAAK;WAAU,WAAU;WAAhC,UAAA,CACG,OAAO,YAAW,IACd;UACL,CAAA,IAAA;SACY;;QAClB,oBAAC,wBAAD,EAAA,UACG,OAAO,UAAU,YACd,+CACA,6BAA6B,OAAO,MAAM,KAAK,IAAI,KAAK,OAAO,YAAY,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,GAC5F,CAAA;QACxB,oBAAC,QAAD;SAAM,WAAU;SAAmD,UAAA,OAAO;QAAe,CAAA;QACxF,OAAO,cACN,oBAAC,QAAD;SAAM,WAAU;SAAmD,UAAA,OAAO;QAAkB,CAAA,IAC1F;OACW,EAAA,CAAA,GACjB,oBAAC,QAAD;QAAQ,SAAQ;QAAQ,MAAK;QAAK,UAAU;QAAM,eAAe,KAAK,OAAO,OAAO,QAAQ;QAAG,UAAA;OAEvF,CAAA,CACN,EAAA,CAAA;MACO,GA5Ba,OAAO,QA4BpB,CACd,EACC,CAAA;KACQ,CAAA;KAGhB,oBAAC,cAAD,EAAA,UAAc,+KAGA,CAAA;IACC;;EACd;;AAET"}