@axiom-lattice/gateway 10.3.0 → 11.0.0

package/dist/embed/embed-page-mindmap-definition-FAOFIHXS-LS6BVRC5.js

@@ -1,96 +0,0 @@
-import{a as ge}from"./embed-page-chunk-62HLTSNB.js";import{a as ue}from"./embed-page-chunk-I7ESIG2O.js";import{b as he,c as de}from"./embed-page-chunk-YUWPQRVF.js";import"./embed-page-chunk-XWR7WUUN.js";import"./embed-page-chunk-7AXKFOLH.js";import"./embed-page-chunk-D4ICPD5X.js";import"./embed-page-chunk-IK542MPZ.js";import"./embed-page-chunk-JAMKPUN7.js";import"./embed-page-chunk-7TH7FFVA.js";import"./embed-page-chunk-DVOV6TZI.js";import"./embed-page-chunk-Z4KLLEUH.js";import"./embed-page-chunk-LKNA7XLR.js";import"./embed-page-chunk-72UJHRYJ.js";import{G as M,Z as C,c as se,d as oe,e as ae,j as B,t as ce,w as le}from"./embed-page-chunk-3MT44IAN.js";import{b as T}from"./embed-page-chunk-2BOYLGSX.js";import"./embed-page-chunk-DM5ESF6C.js";import"./embed-page-chunk-SV2BM3WO.js";import"./embed-page-chunk-S4XZPBRM.js";import{a as h}from"./embed-page-chunk-444E5YR2.js";import"./embed-page-chunk-U2CG7PH5.js";import"./embed-page-chunk-45A47GH2.js";var k=[];for(let e=0;e<256;++e)k.push((e+256).toString(16).slice(1));function pe(e,i=0){return(k[e[i+0]]+k[e[i+1]]+k[e[i+2]]+k[e[i+3]]+"-"+k[e[i+4]]+k[e[i+5]]+"-"+k[e[i+6]]+k[e[i+7]]+"-"+k[e[i+8]]+k[e[i+9]]+"-"+k[e[i+10]]+k[e[i+11]]+k[e[i+12]]+k[e[i+13]]+k[e[i+14]]+k[e[i+15]]).toLowerCase()}var Ee=new Uint8Array(16);function q(){return crypto.getRandomValues(Ee)}function _e(e,i,l){return!i&&!e&&crypto.randomUUID?crypto.randomUUID():Se(e,i,l)}function Se(e,i,l){e=e||{};let a=e.random??e.rng?.()??q();if(a.length<16)throw new Error("Random bytes length must be >= 16");if(a[6]=a[6]&15|64,a[8]=a[8]&63|128,i){if(l=l||0,l<0||l+16>i.length)throw new RangeError(`UUID byte range ${l}:${l+15} is out of buffer bounds`);for(let t=0;t<16;++t)i[l+t]=a[t];return i}return pe(a)}var J=_e;var K=(function(){var e=h(function(D,s,n,o){for(n=n||{},o=D.length;o--;n[D[o]]=s);return n},"o"),i=[1,4],l=[1,13],a=[1,12],t=[1,15],d=[1,16],f=[1,20],m=[1,19],b=[6,7,8],O=[1,26],w=[1,24],R=[1,25],g=[6,7,11],A=[1,6,13,15,16,19,22],Q=[1,33],Z=[1,34],$=[1,6,7,11,13,15,16,19,22],j={trace:h(function(){},"trace"),yy:{},symbols_:{error:2,start:3,mindMap:4,spaceLines:5,SPACELINE:6,NL:7,MINDMAP:8,document:9,stop:10,EOF:11,statement:12,SPACELIST:13,node:14,ICON:15,CLASS:16,nodeWithId:17,nodeWithoutId:18,NODE_DSTART:19,NODE_DESCR:20,NODE_DEND:21,NODE_ID:22,$accept:0,$end:1},terminals_:{2:"error",6:"SPACELINE",7:"NL",8:"MINDMAP",11:"EOF",13:"SPACELIST",15:"ICON",16:"CLASS",19:"NODE_DSTART",20:"NODE_DESCR",21:"NODE_DEND",22:"NODE_ID"},productions_:[0,[3,1],[3,2],[5,1],[5,2],[5,2],[4,2],[4,3],[10,1],[10,1],[10,1],[10,2],[10,2],[9,3],[9,2],[12,2],[12,2],[12,2],[12,1],[12,1],[12,1],[12,1],[12,1],[14,1],[14,1],[18,3],[17,1],[17,4]],performAction:h(function(s,n,o,c,p,r,U){var u=r.length-1;switch(p){case 6:case 7:return c;case 8:c.getLogger().trace("Stop NL ");break;case 9:c.getLogger().trace("Stop EOF ");break;case 11:c.getLogger().trace("Stop NL2 ");break;case 12:c.getLogger().trace("Stop EOF2 ");break;case 15:c.getLogger().info("Node: ",r[u].id),c.addNode(r[u-1].length,r[u].id,r[u].descr,r[u].type);break;case 16:c.getLogger().trace("Icon: ",r[u]),c.decorateNode({icon:r[u]});break;case 17:case 21:c.decorateNode({class:r[u]});break;case 18:c.getLogger().trace("SPACELIST");break;case 19:c.getLogger().trace("Node: ",r[u].id),c.addNode(0,r[u].id,r[u].descr,r[u].type);break;case 20:c.decorateNode({icon:r[u]});break;case 25:c.getLogger().trace("node found ..",r[u-2]),this.$={id:r[u-1],descr:r[u-1],type:c.getType(r[u-2],r[u])};break;case 26:this.$={id:r[u],descr:r[u],type:c.nodeType.DEFAULT};break;case 27:c.getLogger().trace("node found ..",r[u-3]),this.$={id:r[u-3],descr:r[u-1],type:c.getType(r[u-2],r[u])};break}},"anonymous"),table:[{3:1,4:2,5:3,6:[1,5],8:i},{1:[3]},{1:[2,1]},{4:6,6:[1,7],7:[1,8],8:i},{6:l,7:[1,10],9:9,12:11,13:a,14:14,15:t,16:d,17:17,18:18,19:f,22:m},e(b,[2,3]),{1:[2,2]},e(b,[2,4]),e(b,[2,5]),{1:[2,6],6:l,12:21,13:a,14:14,15:t,16:d,17:17,18:18,19:f,22:m},{6:l,9:22,12:11,13:a,14:14,15:t,16:d,17:17,18:18,19:f,22:m},{6:O,7:w,10:23,11:R},e(g,[2,22],{17:17,18:18,14:27,15:[1,28],16:[1,29],19:f,22:m}),e(g,[2,18]),e(g,[2,19]),e(g,[2,20]),e(g,[2,21]),e(g,[2,23]),e(g,[2,24]),e(g,[2,26],{19:[1,30]}),{20:[1,31]},{6:O,7:w,10:32,11:R},{1:[2,7],6:l,12:21,13:a,14:14,15:t,16:d,17:17,18:18,19:f,22:m},e(A,[2,14],{7:Q,11:Z}),e($,[2,8]),e($,[2,9]),e($,[2,10]),e(g,[2,15]),e(g,[2,16]),e(g,[2,17]),{20:[1,35]},{21:[1,36]},e(A,[2,13],{7:Q,11:Z}),e($,[2,11]),e($,[2,12]),{21:[1,37]},e(g,[2,25]),e(g,[2,27])],defaultActions:{2:[2,1],6:[2,2]},parseError:h(function(s,n){if(n.recoverable)this.trace(s);else{var o=new Error(s);throw o.hash=n,o}},"parseError"),parse:h(function(s){var n=this,o=[0],c=[],p=[null],r=[],U=this.table,u="",V=0,ee=0,te=0,me=2,ie=1,ye=r.slice.call(arguments,1),y=Object.create(this.lexer),L={yy:{}};for(var H in this.yy)Object.prototype.hasOwnProperty.call(this.yy,H)&&(L.yy[H]=this.yy[H]);y.setInput(s,L.yy),L.yy.lexer=y,L.yy.parser=this,typeof y.yylloc>"u"&&(y.yylloc={});var W=y.yylloc;r.push(W);var ke=y.options&&y.options.ranges;typeof L.yy.parseError=="function"?this.parseError=L.yy.parseError:this.parseError=Object.getPrototypeOf(this).parseError;function be(_){o.length=o.length-2*_,p.length=p.length-_,r.length=r.length-_}h(be,"popStack");function ne(){var _;return _=c.pop()||y.lex()||ie,typeof _!="number"&&(_ instanceof Array&&(c=_,_=c.pop()),_=n.symbols_[_]||_),_}h(ne,"lex");for(var E,X,v,S,we,z,I={},F,x,re,G;;){if(v=o[o.length-1],this.defaultActions[v]?S=this.defaultActions[v]:((E===null||typeof E>"u")&&(E=ne()),S=U[v]&&U[v][E]),typeof S>"u"||!S.length||!S[0]){var Y="";G=[];for(F in U[v])this.terminals_[F]&&F>me&&G.push("'"+this.terminals_[F]+"'");y.showPosition?Y="Parse error on line "+(V+1)+`:
-`+y.showPosition()+`
-Expecting `+G.join(", ")+", got '"+(this.terminals_[E]||E)+"'":Y="Parse error on line "+(V+1)+": Unexpected "+(E==ie?"end of input":"'"+(this.terminals_[E]||E)+"'"),this.parseError(Y,{text:y.match,token:this.terminals_[E]||E,line:y.yylineno,loc:W,expected:G})}if(S[0]instanceof Array&&S.length>1)throw new Error("Parse Error: multiple actions possible at state: "+v+", token: "+E);switch(S[0]){case 1:o.push(E),p.push(y.yytext),r.push(y.yylloc),o.push(S[1]),E=null,X?(E=X,X=null):(ee=y.yyleng,u=y.yytext,V=y.yylineno,W=y.yylloc,te>0&&te--);break;case 2:if(x=this.productions_[S[1]][1],I.$=p[p.length-x],I._$={first_line:r[r.length-(x||1)].first_line,last_line:r[r.length-1].last_line,first_column:r[r.length-(x||1)].first_column,last_column:r[r.length-1].last_column},ke&&(I._$.range=[r[r.length-(x||1)].range[0],r[r.length-1].range[1]]),z=this.performAction.apply(I,[u,ee,V,L.yy,S[1],p,r].concat(ye)),typeof z<"u")return z;x&&(o=o.slice(0,-1*x*2),p=p.slice(0,-1*x),r=r.slice(0,-1*x)),o.push(this.productions_[S[1]][0]),p.push(I.$),r.push(I._$),re=U[o[o.length-2]][o[o.length-1]],o.push(re);break;case 3:return!0}}return!0},"parse")},fe=(function(){var D={EOF:1,parseError:h(function(n,o){if(this.yy.parser)this.yy.parser.parseError(n,o);else throw new Error(n)},"parseError"),setInput:h(function(s,n){return this.yy=n||this.yy||{},this._input=s,this._more=this._backtrack=this.done=!1,this.yylineno=this.yyleng=0,this.yytext=this.matched=this.match="",this.conditionStack=["INITIAL"],this.yylloc={first_line:1,first_column:0,last_line:1,last_column:0},this.options.ranges&&(this.yylloc.range=[0,0]),this.offset=0,this},"setInput"),input:h(function(){var s=this._input[0];this.yytext+=s,this.yyleng++,this.offset++,this.match+=s,this.matched+=s;var n=s.match(/(?:\r\n?|\n).*/g);return n?(this.yylineno++,this.yylloc.last_line++):this.yylloc.last_column++,this.options.ranges&&this.yylloc.range[1]++,this._input=this._input.slice(1),s},"input"),unput:h(function(s){var n=s.length,o=s.split(/(?:\r\n?|\n)/g);this._input=s+this._input,this.yytext=this.yytext.substr(0,this.yytext.length-n),this.offset-=n;var c=this.match.split(/(?:\r\n?|\n)/g);this.match=this.match.substr(0,this.match.length-1),this.matched=this.matched.substr(0,this.matched.length-1),o.length-1&&(this.yylineno-=o.length-1);var p=this.yylloc.range;return this.yylloc={first_line:this.yylloc.first_line,last_line:this.yylineno+1,first_column:this.yylloc.first_column,last_column:o?(o.length===c.length?this.yylloc.first_column:0)+c[c.length-o.length].length-o[0].length:this.yylloc.first_column-n},this.options.ranges&&(this.yylloc.range=[p[0],p[0]+this.yyleng-n]),this.yyleng=this.yytext.length,this},"unput"),more:h(function(){return this._more=!0,this},"more"),reject:h(function(){if(this.options.backtrack_lexer)this._backtrack=!0;else return this.parseError("Lexical error on line "+(this.yylineno+1)+`. You can only invoke reject() in the lexer when the lexer is of the backtracking persuasion (options.backtrack_lexer = true).
-`+this.showPosition(),{text:"",token:null,line:this.yylineno});return this},"reject"),less:h(function(s){this.unput(this.match.slice(s))},"less"),pastInput:h(function(){var s=this.matched.substr(0,this.matched.length-this.match.length);return(s.length>20?"...":"")+s.substr(-20).replace(/\n/g,"")},"pastInput"),upcomingInput:h(function(){var s=this.match;return s.length<20&&(s+=this._input.substr(0,20-s.length)),(s.substr(0,20)+(s.length>20?"...":"")).replace(/\n/g,"")},"upcomingInput"),showPosition:h(function(){var s=this.pastInput(),n=new Array(s.length+1).join("-");return s+this.upcomingInput()+`
-`+n+"^"},"showPosition"),test_match:h(function(s,n){var o,c,p;if(this.options.backtrack_lexer&&(p={yylineno:this.yylineno,yylloc:{first_line:this.yylloc.first_line,last_line:this.last_line,first_column:this.yylloc.first_column,last_column:this.yylloc.last_column},yytext:this.yytext,match:this.match,matches:this.matches,matched:this.matched,yyleng:this.yyleng,offset:this.offset,_more:this._more,_input:this._input,yy:this.yy,conditionStack:this.conditionStack.slice(0),done:this.done},this.options.ranges&&(p.yylloc.range=this.yylloc.range.slice(0))),c=s[0].match(/(?:\r\n?|\n).*/g),c&&(this.yylineno+=c.length),this.yylloc={first_line:this.yylloc.last_line,last_line:this.yylineno+1,first_column:this.yylloc.last_column,last_column:c?c[c.length-1].length-c[c.length-1].match(/\r?\n?/)[0].length:this.yylloc.last_column+s[0].length},this.yytext+=s[0],this.match+=s[0],this.matches=s,this.yyleng=this.yytext.length,this.options.ranges&&(this.yylloc.range=[this.offset,this.offset+=this.yyleng]),this._more=!1,this._backtrack=!1,this._input=this._input.slice(s[0].length),this.matched+=s[0],o=this.performAction.call(this,this.yy,this,n,this.conditionStack[this.conditionStack.length-1]),this.done&&this._input&&(this.done=!1),o)return o;if(this._backtrack){for(var r in p)this[r]=p[r];return!1}return!1},"test_match"),next:h(function(){if(this.done)return this.EOF;this._input||(this.done=!0);var s,n,o,c;this._more||(this.yytext="",this.match="");for(var p=this._currentRules(),r=0;r<p.length;r++)if(o=this._input.match(this.rules[p[r]]),o&&(!n||o[0].length>n[0].length)){if(n=o,c=r,this.options.backtrack_lexer){if(s=this.test_match(o,p[r]),s!==!1)return s;if(this._backtrack){n=!1;continue}else return!1}else if(!this.options.flex)break}return n?(s=this.test_match(n,p[c]),s!==!1?s:!1):this._input===""?this.EOF:this.parseError("Lexical error on line "+(this.yylineno+1)+`. Unrecognized text.
-`+this.showPosition(),{text:"",token:null,line:this.yylineno})},"next"),lex:h(function(){var n=this.next();return n||this.lex()},"lex"),begin:h(function(n){this.conditionStack.push(n)},"begin"),popState:h(function(){var n=this.conditionStack.length-1;return n>0?this.conditionStack.pop():this.conditionStack[0]},"popState"),_currentRules:h(function(){return this.conditionStack.length&&this.conditionStack[this.conditionStack.length-1]?this.conditions[this.conditionStack[this.conditionStack.length-1]].rules:this.conditions.INITIAL.rules},"_currentRules"),topState:h(function(n){return n=this.conditionStack.length-1-Math.abs(n||0),n>=0?this.conditionStack[n]:"INITIAL"},"topState"),pushState:h(function(n){this.begin(n)},"pushState"),stateStackSize:h(function(){return this.conditionStack.length},"stateStackSize"),options:{"case-insensitive":!0},performAction:h(function(n,o,c,p){var r=p;switch(c){case 0:return n.getLogger().trace("Found comment",o.yytext),6;break;case 1:return 8;case 2:this.begin("CLASS");break;case 3:return this.popState(),16;break;case 4:this.popState();break;case 5:n.getLogger().trace("Begin icon"),this.begin("ICON");break;case 6:return n.getLogger().trace("SPACELINE"),6;break;case 7:return 7;case 8:return 15;case 9:n.getLogger().trace("end icon"),this.popState();break;case 10:return n.getLogger().trace("Exploding node"),this.begin("NODE"),19;break;case 11:return n.getLogger().trace("Cloud"),this.begin("NODE"),19;break;case 12:return n.getLogger().trace("Explosion Bang"),this.begin("NODE"),19;break;case 13:return n.getLogger().trace("Cloud Bang"),this.begin("NODE"),19;break;case 14:return this.begin("NODE"),19;break;case 15:return this.begin("NODE"),19;break;case 16:return this.begin("NODE"),19;break;case 17:return this.begin("NODE"),19;break;case 18:return 13;case 19:return 22;case 20:return 11;case 21:this.begin("NSTR2");break;case 22:return"NODE_DESCR";case 23:this.popState();break;case 24:n.getLogger().trace("Starting NSTR"),this.begin("NSTR");break;case 25:return n.getLogger().trace("description:",o.yytext),"NODE_DESCR";break;case 26:this.popState();break;case 27:return this.popState(),n.getLogger().trace("node end ))"),"NODE_DEND";break;case 28:return this.popState(),n.getLogger().trace("node end )"),"NODE_DEND";break;case 29:return this.popState(),n.getLogger().trace("node end ...",o.yytext),"NODE_DEND";break;case 30:return this.popState(),n.getLogger().trace("node end (("),"NODE_DEND";break;case 31:return this.popState(),n.getLogger().trace("node end (-"),"NODE_DEND";break;case 32:return this.popState(),n.getLogger().trace("node end (-"),"NODE_DEND";break;case 33:return this.popState(),n.getLogger().trace("node end (("),"NODE_DEND";break;case 34:return this.popState(),n.getLogger().trace("node end (("),"NODE_DEND";break;case 35:return n.getLogger().trace("Long description:",o.yytext),20;break;case 36:return n.getLogger().trace("Long description:",o.yytext),20;break}},"anonymous"),rules:[/^(?:\s*%%.*)/i,/^(?:mindmap\b)/i,/^(?::::)/i,/^(?:.+)/i,/^(?:\n)/i,/^(?:::icon\()/i,/^(?:[\s]+[\n])/i,/^(?:[\n]+)/i,/^(?:[^\)]+)/i,/^(?:\))/i,/^(?:-\))/i,/^(?:\(-)/i,/^(?:\)\))/i,/^(?:\))/i,/^(?:\(\()/i,/^(?:\{\{)/i,/^(?:\()/i,/^(?:\[)/i,/^(?:[\s]+)/i,/^(?:[^\(\[\n\)\{\}]+)/i,/^(?:$)/i,/^(?:["][`])/i,/^(?:[^`"]+)/i,/^(?:[`]["])/i,/^(?:["])/i,/^(?:[^"]+)/i,/^(?:["])/i,/^(?:[\)]\))/i,/^(?:[\)])/i,/^(?:[\]])/i,/^(?:\}\})/i,/^(?:\(-)/i,/^(?:-\))/i,/^(?:\(\()/i,/^(?:\()/i,/^(?:[^\)\]\(\}]+)/i,/^(?:.+(?!\(\())/i],conditions:{CLASS:{rules:[3,4],inclusive:!1},ICON:{rules:[8,9],inclusive:!1},NSTR2:{rules:[22,23],inclusive:!1},NSTR:{rules:[25,26],inclusive:!1},NODE:{rules:[21,24,27,28,29,30,31,32,33,34,35,36],inclusive:!1},INITIAL:{rules:[0,1,2,5,6,7,10,11,12,13,14,15,16,17,18,19,20],inclusive:!0}}};return D})();j.lexer=fe;function P(){this.yy={}}return h(P,"Parser"),P.prototype=j,j.Parser=P,new P})();K.parser=K;var xe=K,Ne=12,N={DEFAULT:0,NO_BORDER:0,ROUNDED_RECT:1,RECT:2,CIRCLE:3,CLOUD:4,BANG:5,HEXAGON:6},De=class{constructor(){this.nodes=[],this.count=0,this.elements={},this.getLogger=this.getLogger.bind(this),this.nodeType=N,this.clear(),this.getType=this.getType.bind(this),this.getElementById=this.getElementById.bind(this),this.getParent=this.getParent.bind(this),this.getMindmap=this.getMindmap.bind(this),this.addNode=this.addNode.bind(this),this.decorateNode=this.decorateNode.bind(this)}static{h(this,"MindmapDB")}clear(){this.nodes=[],this.count=0,this.elements={},this.baseLevel=void 0}getParent(e){for(let i=this.nodes.length-1;i>=0;i--)if(this.nodes[i].level<e)return this.nodes[i];return null}getMindmap(){return this.nodes.length>0?this.nodes[0]:null}addNode(e,i,l,a){T.info("addNode",e,i,l,a);let t=!1;this.nodes.length===0?(this.baseLevel=e,e=0,t=!0):this.baseLevel!==void 0&&(e=e-this.baseLevel,t=!1);let d=C(),f=d.mindmap?.padding??B.mindmap.padding;switch(a){case this.nodeType.ROUNDED_RECT:case this.nodeType.RECT:case this.nodeType.HEXAGON:f*=2;break}let m={id:this.count++,nodeId:M(i,d),level:e,descr:M(l,d),type:a,children:[],width:d.mindmap?.maxNodeWidth??B.mindmap.maxNodeWidth,padding:f,isRoot:t},b=this.getParent(e);if(b)b.children.push(m),this.nodes.push(m);else if(t)this.nodes.push(m);else throw new Error(`There can be only one root. No parent could be found for ("${m.descr}")`)}getType(e,i){switch(T.debug("In get type",e,i),e){case"[":return this.nodeType.RECT;case"(":return i===")"?this.nodeType.ROUNDED_RECT:this.nodeType.CLOUD;case"((":return this.nodeType.CIRCLE;case")":return this.nodeType.CLOUD;case"))":return this.nodeType.BANG;case"{{":return this.nodeType.HEXAGON;default:return this.nodeType.DEFAULT}}setElementForId(e,i){this.elements[e]=i}getElementById(e){return this.elements[e]}decorateNode(e){if(!e)return;let i=C(),l=this.nodes[this.nodes.length-1];e.icon&&(l.icon=M(e.icon,i)),e.class&&(l.class=M(e.class,i))}type2Str(e){switch(e){case this.nodeType.DEFAULT:return"no-border";case this.nodeType.RECT:return"rect";case this.nodeType.ROUNDED_RECT:return"rounded-rect";case this.nodeType.CIRCLE:return"circle";case this.nodeType.CLOUD:return"cloud";case this.nodeType.BANG:return"bang";case this.nodeType.HEXAGON:return"hexgon";default:return"no-border"}}assignSections(e,i){if(e.level===0?e.section=void 0:e.section=i,e.children)for(let[l,a]of e.children.entries()){let t=e.level===0?l%(Ne-1):i;this.assignSections(a,t)}}flattenNodes(e,i){let l=C(),a=["mindmap-node"];e.isRoot===!0?a.push("section-root","section--1"):e.section!==void 0&&a.push(`section-${e.section}`),e.class&&a.push(e.class);let t=a.join(" "),d=h(m=>{let O=(l.theme?.toLowerCase()??"").includes("redux");switch(m){case N.CIRCLE:return"mindmapCircle";case N.RECT:return"rect";case N.ROUNDED_RECT:return"rounded";case N.CLOUD:return"cloud";case N.BANG:return"bang";case N.HEXAGON:return"hexagon";case N.DEFAULT:return O?"rounded":"defaultMindmapNode";case N.NO_BORDER:default:return"rect"}},"getShapeFromType"),f={id:e.id.toString(),domId:"node_"+e.id.toString(),label:e.descr,labelType:"markdown",isGroup:!1,shape:d(e.type),width:e.width,height:e.height??0,padding:e.padding,cssClasses:t,cssStyles:[],look:l.look,icon:e.icon,x:e.x,y:e.y,level:e.level,nodeId:e.nodeId,type:e.type,section:e.section};if(i.push(f),e.children)for(let m of e.children)this.flattenNodes(m,i)}generateEdges(e,i){if(!e.children)return;let l=C();for(let a of e.children){let t="edge";a.section!==void 0&&(t+=` section-edge-${a.section}`);let d=e.level+1;t+=` edge-depth-${d}`;let f={id:`edge_${e.id}_${a.id}`,start:e.id.toString(),end:a.id.toString(),type:"normal",curve:"basis",thickness:"normal",look:l.look,classes:t,depth:e.level,section:a.section};i.push(f),this.generateEdges(a,i)}}getData(){let e=this.getMindmap(),i=C(),a=le().layout!==void 0,t=i;if(a||(t.layout="cose-bilkent"),!e)return{nodes:[],edges:[],config:t};T.debug("getData: mindmapRoot",e,i),this.assignSections(e);let d=[],f=[];this.flattenNodes(e,d),this.generateEdges(e,f),T.debug(`getData: processed ${d.length} nodes and ${f.length} edges`);let m=new Map;for(let b of d)m.set(b.id,{shape:b.shape,width:b.width,height:b.height,padding:b.padding});return{nodes:d,edges:f,config:t,rootNode:e,markers:["point"],direction:"TB",nodeSpacing:50,rankSpacing:50,shapes:Object.fromEntries(m),type:"mindmap",diagramId:"mindmap-"+J()}}getLogger(){return T}},Le=h(async(e,i,l,a)=>{T.debug(`Rendering mindmap diagram
-`+e);let t=a.db,d=t.getData(),f=ge(i,d.config.securityLevel);if(d.type=a.type,d.layoutAlgorithm=de(d.config.layout,{fallback:"cose-bilkent"}),d.diagramId=i,!t.getMindmap())return;d.nodes.forEach(g=>{g.shape==="rounded"?(g.radius=15,g.taper=15,g.stroke="none",g.width=0,g.padding=15):g.shape==="circle"?g.padding=10:g.shape==="rect"?(g.width=0,g.padding=10):g.shape==="hexagon"&&(g.width=0,g.height=0)}),await he(d,f);let{themeVariables:b}=ce(),{useGradient:O,gradientStart:w,gradientStop:R}=b;if(O&&w&&R){let g=f.attr("id"),A=f.append("defs").append("linearGradient").attr("id",`${g}-gradient`).attr("gradientUnits","objectBoundingBox").attr("x1","0%").attr("y1","0%").attr("x2","100%").attr("y2","0%");A.append("stop").attr("offset","0%").attr("stop-color",w).attr("stop-opacity",1),A.append("stop").attr("offset","100%").attr("stop-color",R).attr("stop-opacity",1)}ue(f,d.config.mindmap?.padding??B.mindmap.padding,"mindmapDiagram",d.config.mindmap?.useMaxWidth??B.mindmap.useMaxWidth)},"draw"),ve={draw:Le},Te=h(e=>{let{theme:i,look:l}=e,a="";for(let t=0;t<e.THEME_COLOR_LIMIT;t++)e["lineColor"+t]=e["lineColor"+t]||e["cScaleInv"+t],se(e["lineColor"+t])?e["lineColor"+t]=oe(e["lineColor"+t],20):e["lineColor"+t]=ae(e["lineColor"+t],20);for(let t=0;t<e.THEME_COLOR_LIMIT;t++){let d=""+(l==="neo"?Math.max(10-(t-1)*2,2):17-3*t);a+=`
-    .section-${t-1} rect, .section-${t-1} path, .section-${t-1} circle, .section-${t-1} polygon, .section-${t-1} path  {
-      fill: ${e["cScale"+t]};
-    }
-    .section-${t-1} text {
-     fill: ${e["cScaleLabel"+t]};
-    }
-     .section-${t-1} span {
-     color: ${e["cScaleLabel"+t]};
-    }
-    .node-icon-${t-1} {
-      font-size: 40px;
-      color: ${e["cScaleLabel"+t]};
-    }
-    .section-edge-${t-1}{
-      stroke: ${e["cScale"+t]};
-    }
-    .edge-depth-${t-1}{
-      stroke-width: ${d};
-    }
-    .section-${t-1} line {
-      stroke: ${e["cScaleInv"+t]} ;
-      stroke-width: 3;
-    }
-
-    .disabled, .disabled circle, .disabled text {
-      fill: lightgray;
-    }
-    .disabled text {
-      fill: #efefef;
-    }
-    [data-look="neo"].mindmap-node.section-${t-1} rect, [data-look="neo"].mindmap-node.section-${t-1} path, [data-look="neo"].mindmap-node.section-${t-1} circle, [data-look="neo"].mindmap-node.section-${t-1} polygon {
-      fill: ${i==="redux"||i==="redux-dark"||i==="neutral"?e.mainBkg:e["cScale"+t]};
-      stroke: ${i==="redux"||i==="redux-dark"?e.nodeBorder:e["cScale"+t]};
-      stroke-width: ${e.strokeWidth??2}px;
-    }
-    [data-look="neo"].section-edge-${t-1}{
-      stroke: ${i?.includes("redux")||i==="neo-dark"?e.nodeBorder:e["cScale"+t]};
-    }
-    [data-look="neo"].mindmap-node.section-${t-1} text {
-     fill: ${i==="redux"||i==="redux-dark"?e.nodeBorder:e["cScaleLabel"+(i==="neutral"?1:t)]};
-    }
-    `}return a},"genSections"),Oe=h((e,i,l)=>{let a="";for(let t=0;t<e;t++)a+=`
-    [data-look="neo"].mindmap-node.section-${t-1} rect, [data-look="neo"].mindmap-node.section-${t-1} path, [data-look="neo"].mindmap-node.section-${t-1} circle, [data-look="neo"].mindmap-node.section-${t-1} polygon {
-      stroke: url(${i}-gradient);
-      fill: ${l};
-    }
-    .section-${t-1} line {
-      stroke-width: 0;
-    }`;return a},"genGradient"),Ie=h(e=>{let{theme:i}=e,l=e.svgId,a=e.dropShadow?e.dropShadow.replace("url(#drop-shadow)",`url(${l}-drop-shadow)`):"none";return`
-  .edge {
-    stroke-width: 3;
-  }
-  ${Te(e)}
-  .section-root rect, .section-root path, .section-root circle, .section-root polygon  {
-    fill: ${e.git0};
-  }
-  .section-root text {
-    fill: ${e.gitBranchLabel0};
-  }
-  .section-root span {
-    color: ${i?.includes("redux")?e.nodeBorder:e.gitBranchLabel0};
-  }
-  .icon-container {
-    height:100%;
-    display: flex;
-    justify-content: center;
-    align-items: center;
-  }
-  .edge {
-    fill: none;
-  }
-  .mindmap-node-label {
-    dy: 1em;
-    alignment-baseline: middle;
-    text-anchor: middle;
-    dominant-baseline: middle;
-    text-align: center;
-  }
-  [data-look="neo"].mindmap-node  {
-    filter: ${a};
-  }
-  [data-look="neo"].mindmap-node.section-root rect, [data-look="neo"].mindmap-node.section-root path, [data-look="neo"].mindmap-node.section-root circle, [data-look="neo"].mindmap-node.section-root polygon  {
-    fill: ${i?.includes("redux")?e.mainBkg:e.git0};
-  }
-  [data-look="neo"].mindmap-node.section-root .text-inner-tspan {
-    fill:  ${i?.includes("redux")?e.nodeBorder:e["cScaleLabel"+(i==="neutral"?1:0)]};
-  }
-  ${e.useGradient&&l&&e.mainBkg?Oe(e.THEME_COLOR_LIMIT,l,e.mainBkg):""}
-`},"getStyles"),Ce=Ie,it={get db(){return new De},renderer:ve,parser:xe,styles:Ce};export{it as diagram};

package/dist/embed/embed-page-stateDiagram-v2-UEYNNEHI-QI633DEL.js

@@ -1 +0,0 @@
-import{a as e,b as i,c as o,d as m}from"./embed-page-chunk-UVNC53TL.js";import"./embed-page-chunk-CJYKMTD7.js";import"./embed-page-chunk-62HLTSNB.js";import"./embed-page-chunk-I7ESIG2O.js";import"./embed-page-chunk-YUWPQRVF.js";import"./embed-page-chunk-XWR7WUUN.js";import"./embed-page-chunk-7AXKFOLH.js";import"./embed-page-chunk-D4ICPD5X.js";import"./embed-page-chunk-IK542MPZ.js";import"./embed-page-chunk-JAMKPUN7.js";import"./embed-page-chunk-7TH7FFVA.js";import"./embed-page-chunk-DVOV6TZI.js";import"./embed-page-chunk-Z4KLLEUH.js";import"./embed-page-chunk-LKNA7XLR.js";import"./embed-page-chunk-72UJHRYJ.js";import"./embed-page-chunk-3MT44IAN.js";import"./embed-page-chunk-2BOYLGSX.js";import"./embed-page-chunk-DM5ESF6C.js";import"./embed-page-chunk-SV2BM3WO.js";import"./embed-page-chunk-S4XZPBRM.js";import{a as r}from"./embed-page-chunk-444E5YR2.js";import"./embed-page-chunk-U2CG7PH5.js";import"./embed-page-chunk-45A47GH2.js";var D={parser:e,get db(){return new o(2)},renderer:i,styles:m,init:r(t=>{t.state||(t.state={}),t.state.arrowMarkerAbsolute=t.arrowMarkerAbsolute},"init")};export{D as diagram};

package/dist/embed/embed-page-swimlanesDiagram-ULZ7WXOC-7W6HH2PU.js

@@ -1,8 +0,0 @@
-import{a as o,b as e}from"./embed-page-chunk-CV2LFQZA.js";import"./embed-page-chunk-ZFADBU7Y.js";import"./embed-page-chunk-AWMMPAX5.js";import"./embed-page-chunk-CJYKMTD7.js";import"./embed-page-chunk-62HLTSNB.js";import"./embed-page-chunk-I7ESIG2O.js";import"./embed-page-chunk-YUWPQRVF.js";import"./embed-page-chunk-XWR7WUUN.js";import"./embed-page-chunk-7AXKFOLH.js";import"./embed-page-chunk-D4ICPD5X.js";import"./embed-page-chunk-IK542MPZ.js";import"./embed-page-chunk-JAMKPUN7.js";import"./embed-page-chunk-7TH7FFVA.js";import"./embed-page-chunk-DVOV6TZI.js";import"./embed-page-chunk-Z4KLLEUH.js";import"./embed-page-chunk-LKNA7XLR.js";import"./embed-page-chunk-72UJHRYJ.js";import"./embed-page-chunk-3MT44IAN.js";import"./embed-page-chunk-2BOYLGSX.js";import"./embed-page-chunk-DM5ESF6C.js";import"./embed-page-chunk-SV2BM3WO.js";import"./embed-page-chunk-S4XZPBRM.js";import{a as r}from"./embed-page-chunk-444E5YR2.js";import"./embed-page-chunk-U2CG7PH5.js";import"./embed-page-chunk-45A47GH2.js";var m=r(t=>`${o(t)}
-  .swimlane.cluster rect {
-    stroke: ${t.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,"getStyles"),i=m,B=e({defaultLayout:"swimlane",styles:i});export{B as diagram};

package/dist/kbProvider-2D6DZ34N.mjs

@@ -1,50 +0,0 @@
-import "./chunk-NFEGQTCC.mjs";
-
-// src/services/open/providers/kbProvider.ts
-import { z } from "zod";
-function createKbProvider(collectionService) {
-  return {
-    domain: "kb",
-    label: "Knowledge Base",
-    source: "builtin",
-    scopeKind: "tenant",
-    actions: [
-      {
-        name: "search",
-        label: "Search collections",
-        description: "Search a knowledge base collection. Returns matched entries with content, metadata and similarity score.",
-        schema: {
-          collection: z.string().min(1),
-          query: z.string().min(1),
-          limit: z.number().int().min(1).max(50).optional()
-        },
-        annotations: { readOnlyHint: true, destructiveHint: false }
-      }
-    ],
-    execute: async (action, args, ctx) => {
-      if (action !== "search") {
-        return {
-          content: [{ type: "text", text: `Unknown kb action: ${action}` }],
-          isError: true
-        };
-      }
-      const { collection, query, limit } = args;
-      const req = {
-        user: { tenantId: ctx.tenantId },
-        headers: {}
-      };
-      const entries = await collectionService.searchEntries(
-        req,
-        collection,
-        { query, top_k: limit ?? 5 }
-      );
-      return {
-        content: [{ type: "text", text: JSON.stringify(entries, null, 2) }]
-      };
-    }
-  };
-}
-export {
-  createKbProvider
-};
-//# sourceMappingURL=kbProvider-2D6DZ34N.mjs.map

package/dist/kbProvider-2D6DZ34N.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/services/open/providers/kbProvider.ts"],"sourcesContent":["/**\n * Built-in kb provider for the Open surface: knowledge-base search.\n *\n * Delegates to CollectionService (business code, zero changes) with a\n * synthesized minimal request — collection_service's getTenantId reads\n * user.tenantId, and the Open context always carries the credential-derived\n * tenant (never a caller-supplied header).\n */\n\nimport { z } from \"zod\";\nimport type { FastifyRequest } from \"fastify\";\nimport type {\n  OpenExecutionContext,\n  OpenExecutionResult,\n} from \"@axiom-lattice/protocols\";\nimport { CollectionService } from \"../../../services/collection_service\";\nimport type { OpenProviderDeclaration } from \"../openLattice\";\n\nexport function createKbProvider(\n  collectionService: CollectionService,\n): OpenProviderDeclaration {\n  return {\n    domain: \"kb\",\n    label: \"Knowledge Base\",\n    source: \"builtin\",\n    scopeKind: \"tenant\",\n    actions: [\n      {\n        name: \"search\",\n        label: \"Search collections\",\n        description:\n          \"Search a knowledge base collection. Returns matched entries with content, metadata and similarity score.\",\n        schema: {\n          collection: z.string().min(1),\n          query: z.string().min(1),\n          limit: z.number().int().min(1).max(50).optional(),\n        },\n        annotations: { readOnlyHint: true, destructiveHint: false },\n      },\n    ],\n    execute: async (\n      action: string,\n      args: unknown,\n      ctx: OpenExecutionContext,\n    ): Promise<OpenExecutionResult> => {\n      if (action !== \"search\") {\n        return {\n          content: [{ type: \"text\", text: `Unknown kb action: ${action}` }],\n          isError: true,\n        };\n      }\n      const { collection, query, limit } = args as {\n        collection: string;\n        query: string;\n        limit?: number;\n      };\n      const req = {\n        user: { tenantId: ctx.tenantId },\n        headers: {},\n      } as unknown as FastifyRequest;\n      const entries = await collectionService.searchEntries(\n        req,\n        collection,\n        { query, top_k: limit ?? 5 },\n      );\n      return {\n        content: [{ type: \"text\", text: JSON.stringify(entries, null, 2) }],\n      };\n    },\n  };\n}\n"],"mappings":";;;AASA,SAAS,SAAS;AASX,SAAS,iBACd,mBACyB;AACzB,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aACE;AAAA,QACF,QAAQ;AAAA,UACN,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,UAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,UACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,QAClD;AAAA,QACA,aAAa,EAAE,cAAc,MAAM,iBAAiB,MAAM;AAAA,MAC5D;AAAA,IACF;AAAA,IACA,SAAS,OACP,QACA,MACA,QACiC;AACjC,UAAI,WAAW,UAAU;AACvB,eAAO;AAAA,UACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,sBAAsB,MAAM,GAAG,CAAC;AAAA,UAChE,SAAS;AAAA,QACX;AAAA,MACF;AACA,YAAM,EAAE,YAAY,OAAO,MAAM,IAAI;AAKrC,YAAM,MAAM;AAAA,QACV,MAAM,EAAE,UAAU,IAAI,SAAS;AAAA,QAC/B,SAAS,CAAC;AAAA,MACZ;AACA,YAAM,UAAU,MAAM,kBAAkB;AAAA,QACtC;AAAA,QACA;AAAA,QACA,EAAE,OAAO,OAAO,SAAS,EAAE;AAAA,MAC7B;AACA,aAAO;AAAA,QACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/open-Y7PAA2VJ.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/routes/open.ts","../src/services/open/openRateLimiter.ts","../src/services/open/openMcpServer.ts"],"sourcesContent":["/**\n * Open API surface routes: GET/POST/DELETE /open/mcp.\n *\n * The route is a thin shell — credential resolution (OpenAuthService),\n * catalog filtering and invocation (OpenLattice), and stateless MCP server\n * construction live in services/open/*. The transport writes the response\n * itself, so the reply is hijacked (same precedent as the Project Room SSE\n * route).\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport {\n  getReplicaId,\n  getStoreLattice,\n  resolvePluginConnections,\n} from \"@axiom-lattice/core\";\nimport { REPLICA_HEADER, type A2AApiKeyStore, type OpenAuditStore, type OpenGrant, type ProjectStore } from \"@axiom-lattice/protocols\";\nimport { OpenCredentialService } from \"../services/open/openCredentialService\";\nimport { OpenAuditService } from \"../services/open/openAuditService\";\nimport { OpenRateLimiter } from \"../services/open/openRateLimiter\";\nimport type { RateLimitService } from \"../services/rate-limit/RateLimitService\";\nimport type { OpenCredential } from \"../services/open/openCredentialService\";\nimport {\n  openLattice,\n  ActionNotFoundError,\n  ConnectionNotAllowedError,\n  GrantDeniedError,\n  ValidationError,\n  resolveCoveringConnectionKeys,\n} from \"../services/open/openLattice\";\nimport { createMcpHandler, isLegacyRequest } from \"@modelcontextprotocol/server\";\nimport { toNodeHandler, toWebRequest } from \"@modelcontextprotocol/node\";\nimport {\n  buildSessionServer,\n  createSessionServer,\n  type SessionServerOptions,\n} from \"../services/open/openMcpServer\";\nimport { collectExposedPluginUiResources } from \"../services/open/registerExposedPlugins\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPlugins,\n} from \"../services/open/tenantOpenPlugins\";\n\nexport interface OpenRouteDeps {\n  openAuth?: OpenCredentialService;\n  grantsSource?: (ctx: OpenCredential) => OpenGrant[];\n  audit?: OpenAuditService;\n  /** Legacy in-memory limiter; used only when `rateLimits` is absent. */\n  rateLimiter?: OpenRateLimiter;\n  /** Gateway rate limiter; preferred when provided. */\n  rateLimits?: RateLimitService;\n  /**\n   * Test seam: build the credential's tenant sandbox plugin bundle. Defaults to\n   * {@link buildTenantOpenPlugins} with the global catalog's tool names reserved\n   * so a tenant tool can never shadow a global/built-in one.\n   */\n  tenantPlugins?: (\n    tenantId: string,\n    grants: OpenGrant[],\n    reservedToolNames: ReadonlySet<string>,\n  ) => Promise<TenantOpenPlugins>;\n  /** Test seam for grant-pinned connection validation. */\n  resolveConnections?: typeof resolvePluginConnections;\n}\n\nfunction extractBearer(request: FastifyRequest): string | undefined {\n  const header = request.headers.authorization;\n  if (!header?.startsWith(\"Bearer \")) return undefined;\n  return header.slice(\"Bearer \".length).trim() || undefined;\n}\n\n/**\n * Degraded tenant plugin bundle used when the sandbox catalog cannot be read.\n *\n * A catalog read failure must not 500 the session: the MCP server still builds\n * and serves the global tools. `invoke` is unreachable through normal routing\n * (`hasTool` is always false, so calls route to OpenLattice) but returns an\n * error result if it is ever reached.\n */\nfunction emptyTenantPlugins(): TenantOpenPlugins {\n  return {\n    tools: [],\n    uiResources: new Map(),\n    hasTool: () => false,\n    degraded: true,\n    invoke: async (toolName) => ({\n      content: [\n        { type: \"text\", text: `Tenant plugin catalog unavailable for ${toolName}` },\n      ],\n      isError: true,\n    }),\n  };\n}\n\n/** JSON-RPC error codes used on the Open surface. */\nconst RPC_ERROR = {\n  GRANT_DENIED: -32001,\n  ACTION_NOT_FOUND: -32002,\n  VALIDATION_FAILED: -32003,\n  EXECUTION_ERROR: -32004,\n  RATE_LIMITED: -32005,\n  CONNECTION_NOT_ALLOWED: -32006,\n} as const;\n\nexport function registerOpenRoutes(\n  app: FastifyInstance,\n  deps: OpenRouteDeps = {},\n): void {\n  const openAuth =\n    deps.openAuth ??\n    new OpenCredentialService(\n      getStoreLattice(\"default\", \"a2aApiKey\").store as A2AApiKeyStore,\n      getStoreLattice(\"default\", \"project\").store as ProjectStore,\n    );\n  const grantsSource =\n    deps.grantsSource ?? ((ctx: OpenCredential) => ctx.grants);\n  const audit =\n    deps.audit ??\n    (() => {\n      try {\n        const store = getStoreLattice(\"default\", \"openAudit\").store as OpenAuditStore;\n        return new OpenAuditService(store);\n      } catch {\n        return undefined;\n      }\n    })();\n\n  const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();\n  const rateLimits = deps.rateLimits;\n\n  const resolveConnections = deps.resolveConnections ?? resolvePluginConnections;\n\n  /**\n   * Resolve and validate the connection keys pinned by the covering grant.\n   *\n   * The credential tenant is authoritative; a selected key that is missing or\n   * belongs to another tenant/type fails closed.\n   */\n  const selectedConnectionKeys = async (\n    grants: OpenGrant[],\n    domain: string,\n    action: string,\n    tenantId: string,\n  ): Promise<string[] | undefined> => {\n    const keys = resolveCoveringConnectionKeys(grants, domain, action);\n    if (!keys) return undefined;\n    let resolved: Awaited<ReturnType<typeof resolvePluginConnections>>;\n    try {\n      resolved = await resolveConnections(domain, { connections: keys }, { tenantId });\n    } catch {\n      throw new ConnectionNotAllowedError(`connection store unavailable for ${domain}`);\n    }\n    const found = new Set(resolved.map((entry) => entry.key));\n    const missing = keys.filter((key) => !found.has(key));\n    if (missing.length > 0) {\n      throw new ConnectionNotAllowedError(\n        `unknown connection(s) for ${domain}: ${missing.join(\", \")}`,\n      );\n    }\n    return keys;\n  };\n\n  const markReplica = (reply: FastifyReply): void => {\n    const replica = getReplicaId();\n    reply.header(REPLICA_HEADER, replica);\n    reply.raw.setHeader(REPLICA_HEADER, replica);\n  };\n\n  const buildSessionOptions = async (\n    context: OpenCredential,\n    log: FastifyRequest[\"log\"],\n  ): Promise<SessionServerOptions> => {\n    const grants = grantsSource(context);\n    const catalog = await openLattice.catalogFor(grants, { tenantId: context.tenantId });\n    // Tenant sandbox plugins are volume-resident and outside the OpenLattice\n    // registry; merge their grant-filtered tools/UI alongside the globals.\n    // Global/built-in tool names are reserved so a tenant plugin of the same\n    // type (kb/sandbox/agent) can neither crash `registerTool` with a duplicate\n    // nor capture the invoke routing for a global tool.\n    const globalToolNames = new Set(catalog.map((t) => t.toolName));\n    const buildTenant =\n      deps.tenantPlugins ??\n      ((tenantId, tenantGrants, reservedToolNames) =>\n        buildTenantOpenPlugins(tenantId, tenantGrants, { reservedToolNames }));\n    let tenant: TenantOpenPlugins;\n    try {\n      tenant = await buildTenant(context.tenantId, grants, globalToolNames);\n      if (tenant.degraded) {\n        // The catalog's common failure mode is a diagnostic, not a throw\n        // (`ensureLoaded` returns error-level diagnostics). Surface it and\n        // serve global tools only.\n        log.warn(\n          { tenantId: context.tenantId },\n          \"open mcp: tenant plugin catalog degraded; serving global tools only\",\n        );\n      }\n    } catch (error) {\n      // Sandbox catalogs are volume-resident and can be transiently\n      // unavailable; degrade to globals-only rather than failing the whole\n      // session so external hosts can still connect. `err` keeps the stack.\n      log.warn(\n        { tenantId: context.tenantId, err: error },\n        \"open mcp: tenant plugin catalog unavailable; serving global tools only\",\n      );\n      tenant = emptyTenantPlugins();\n    }\n    const mergedCatalog = mergeOpenCatalog(catalog, tenant.tools);\n    const uiResources = new Map([\n      ...collectExposedPluginUiResources(grants),\n      ...tenant.uiResources,\n    ]);\n    return {\n      credential: { credentialId: context.credentialId, kind: context.kind },\n      grants,\n      catalog: mergedCatalog,\n      uiResources,\n      invoke: async (toolName, args) => {\n        const startedAt = Date.now();\n        const sep = toolName.indexOf(\"_\");\n        const auditDomain = sep > 0 ? toolName.slice(0, sep) : toolName;\n        const auditAction = sep > 0 ? toolName.slice(sep + 1) : \"\";\n\n        let allowed: boolean;\n        let retryAfterMs: number | undefined;\n        if (rateLimits) {\n          const decision = await rateLimits.consume(\n            auditDomain === \"agent\" ? \"open.agent\" : \"open.api\",\n            { credential: context.credentialId },\n          );\n          allowed = decision.allowed;\n          retryAfterMs = decision.allowed\n            ? undefined\n            : decision.retryAfterSeconds * 1000;\n        } else {\n          const decision = rateLimiter.check(context.credentialId, auditDomain);\n          allowed = decision.allowed;\n          retryAfterMs = decision.retryAfterMs;\n        }\n        if (!allowed) {\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode: \"RATE_LIMITED\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(\n              `RATE_LIMITED: retry after ${retryAfterMs ?? 1000}ms`,\n            ),\n            { rpcCode: RPC_ERROR.RATE_LIMITED },\n          );\n        }\n\n        try {\n          const connectionKeys = await selectedConnectionKeys(\n            grants,\n            auditDomain,\n            auditAction,\n            context.tenantId,\n          );\n          const isTenantRoute = tenant.hasTool(toolName) && !globalToolNames.has(toolName);\n          const runConfig: Record<string, unknown> = {\n            sandboxName: context.sandboxName,\n            credentialId: context.credentialId,\n            depth: context.depth,\n          };\n          const result = isTenantRoute\n            ? await tenant.invoke(toolName, args, {\n                tenantId: context.tenantId,\n                projectId: context.projectId,\n                workspaceId: context.workspaceId,\n                runConfig,\n                ...(connectionKeys ? { connectionKeys } : {}),\n              })\n            : await openLattice.invoke(\n                grants,\n                {\n                  tenantId: context.tenantId,\n                  projectId: context.projectId,\n                  workspaceId: context.workspaceId,\n                  runConfig,\n                },\n                toolName,\n                args,\n              );\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: result.isError ? \"error\" : \"ok\",\n            ...(result.isError ? { errorCode: \"EXECUTION_ERROR\" } : {}),\n            durationMs: Date.now() - startedAt,\n          });\n          return result;\n        } catch (err) {\n          const code =\n            err instanceof ConnectionNotAllowedError\n              ? RPC_ERROR.CONNECTION_NOT_ALLOWED\n              : err instanceof GrantDeniedError\n                ? RPC_ERROR.GRANT_DENIED\n                : err instanceof ActionNotFoundError\n                  ? RPC_ERROR.ACTION_NOT_FOUND\n                  : err instanceof ValidationError\n                    ? RPC_ERROR.VALIDATION_FAILED\n                    : RPC_ERROR.EXECUTION_ERROR;\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode:\n              err instanceof ConnectionNotAllowedError\n                ? \"CONNECTION_NOT_ALLOWED\"\n                : err instanceof GrantDeniedError\n                  ? \"GRANT_DENIED\"\n                  : err instanceof ActionNotFoundError\n                    ? \"ACTION_NOT_FOUND\"\n                    : err instanceof ValidationError\n                      ? \"VALIDATION_FAILED\"\n                      : \"EXECUTION_ERROR\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(err instanceof Error ? err.message : String(err)),\n            { rpcCode: code },\n          );\n        }\n      },\n    };\n  };\n\n  const handleOpenMcpPost = async (\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) => {\n    markReplica(reply);\n    const context = await openAuth.resolve(extractBearer(request));\n    if (!context) {\n      return reply.status(401).send({ error: \"AUTH_FAILED\" });\n    }\n\n    // One handler per request: the credential-scoped catalog (and the\n    // credential itself) is resolved inside the factory, so no session or\n    // server state is shared between requests or replicas.\n    //\n    // Modern 2026-07-28 traffic is served by `createMcpHandler`. Legacy\n    // 2025-era traffic is routed in user land to the existing stateless\n    // `NodeStreamableHTTPServerTransport`, which keeps the pre-upgrade\n    // `enableJsonResponse: true` contract (the SDK's built-in legacy fallback\n    // answers with SSE). `isLegacyRequest` is the entry's own classifier, so\n    // this branch can never disagree with the handler.\n    const modern = createMcpHandler(\n      async () =>\n        (\n          await createSessionServer(\n            await buildSessionOptions(context, request.log),\n          )\n        ).server,\n      {\n        legacy: \"reject\",\n        onerror: (error) => {\n          request.log.warn({ err: error }, \"open mcp: handler error\");\n        },\n      },\n    );\n    const nodeHandler = toNodeHandler(modern, {\n      onerror: (error) => {\n        request.log.warn({ err: error }, \"open mcp: transport error\");\n      },\n    });\n\n    // @hono/node-server 1.19.15 arms a 500ms drain timer that calls\n    // `socket.destroySoon()`. Fastify's light-my-request (used by `app.inject`)\n    // attaches an EventEmitter mock socket without that method, so under test\n    // the timer throws into whichever suite is running when it fires. Real\n    // sockets always have `destroySoon`; shim the mock only.\n    const rawSocket = request.raw.socket as unknown as\n      | { destroySoon?: () => void }\n      | undefined;\n    if (rawSocket && typeof rawSocket.destroySoon !== \"function\") {\n      Object.defineProperty(rawSocket, \"destroySoon\", {\n        value: () => undefined,\n        configurable: true,\n      });\n    }\n\n    reply.hijack();\n\n    const webRequest = await toWebRequest(request.raw, request.body);\n    if (await isLegacyRequest(webRequest, request.body)) {\n      const built = await buildSessionServer(\n        await buildSessionOptions(context, request.log),\n      );\n      await built.server.connect(built.transport);\n      const close = (): void => {\n        void built.transport.close().catch(() => undefined);\n        void built.server.close().catch(() => undefined);\n      };\n      reply.raw.once(\"close\", close);\n      await built.transport.handleRequest(request.raw, reply.raw, request.body);\n      return;\n    }\n\n    const close = (): void => {\n      void modern.close().catch(() => undefined);\n    };\n    reply.raw.once(\"close\", close);\n    await nodeHandler(request.raw, reply.raw, request.body);\n  };\n\n  const methodNotAllowed = async (\n    _request: FastifyRequest,\n    reply: FastifyReply,\n  ) => {\n    reply.header(\"Allow\", \"POST\");\n    return reply.status(405).send({ error: \"METHOD_NOT_ALLOWED\" });\n  };\n\n  app.post(\"/open/mcp\", handleOpenMcpPost);\n  // Canonical MCP surface aliases the unified Open MCP server.\n  app.post(\"/mcp\", handleOpenMcpPost);\n  app.post(\"/mcp/\", handleOpenMcpPost);\n  app.get(\"/mcp\", methodNotAllowed);\n  app.get(\"/mcp/\", methodNotAllowed);\n\n  // Stateless Streamable HTTP has no server→client GET stream or session\n  // DELETE. A 404 is not a recognized \"not supported\" signal: the official\n  // client transport tolerates 405 (`Allow` set) and continues.\n  app.get(\"/open/mcp\", methodNotAllowed);\n  app.get(\"/open/mcp/\", methodNotAllowed);\n  app.delete(\"/open/mcp\", methodNotAllowed);\n  app.delete(\"/mcp\", methodNotAllowed);\n  app.delete(\"/mcp/\", methodNotAllowed);\n\n}\n","/**\n * In-memory per-credential rate limiter (token bucket). The agent domain gets\n * a stricter bucket because each call consumes LLM budget.\n *\n * Process-local by design (V1 single-gateway); a distributed limiter is V2.\n */\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  retryAfterMs?: number;\n}\n\ninterface Bucket {\n  tokens: number;\n  updatedAt: number;\n}\n\nexport interface OpenRateLimiterOptions {\n  /** Default requests per minute per credential. */\n  defaultPerMinute?: number;\n  /** Stricter limit for the agent domain. */\n  agentPerMinute?: number;\n}\n\nexport class OpenRateLimiter {\n  private readonly buckets = new Map<string, Bucket>();\n  private readonly defaultPerMinute: number;\n  private readonly agentPerMinute: number;\n\n  constructor(options: OpenRateLimiterOptions = {}) {\n    this.defaultPerMinute = options.defaultPerMinute ?? 60000;\n    this.agentPerMinute = options.agentPerMinute ?? 2000;\n  }\n\n  private bucketClass(domain: string): string {\n    return domain === \"agent\" ? \"agent\" : \"default\";\n  }\n\n  private limitFor(domain: string): number {\n    return domain === \"agent\" ? this.agentPerMinute : this.defaultPerMinute;\n  }\n\n  /** Consume one token; denied calls report how long to wait. */\n  check(credentialId: string, domain: string): RateLimitDecision {\n    const limit = this.limitFor(domain);\n    const key = `${this.bucketClass(domain)}:${credentialId}`;\n    const now = Date.now();\n    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };\n\n    const refillPerMs = limit / 60_000;\n    const elapsed = now - bucket.updatedAt;\n    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);\n    bucket.updatedAt = now;\n\n    if (bucket.tokens >= 1) {\n      bucket.tokens -= 1;\n      this.buckets.set(key, bucket);\n      return { allowed: true };\n    }\n\n    this.buckets.set(key, bucket);\n    const deficit = 1 - bucket.tokens;\n    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };\n  }\n\n  /** Test helper. */\n  reset(): void {\n    this.buckets.clear();\n  }\n}\n","/**\n * Builds a stateless MCP server instance whose tool list is the\n * credential-filtered OpenLattice catalog. A fresh instance is built per HTTP\n * request so no server/session state is shared between replicas.\n *\n * The transport uses `sessionIdGenerator: undefined`: it never issues\n * `Mcp-Session-Id`, and every request is self-contained. Credential-scoped\n * tool lists therefore stay per-request without a session registry.\n *\n * Every tool executor routes through the OpenLattice invoke kernel, so\n * authorization is re-checked on each invocation (default-deny, live grants).\n */\n\nimport { NodeStreamableHTTPServerTransport } from \"@modelcontextprotocol/node\";\nimport {\n  McpServer,\n  type StandardSchemaWithJSON,\n} from \"@modelcontextprotocol/server\";\nimport { z } from \"zod\";\nimport type { McpUiCsp, OpenGrant } from \"@axiom-lattice/protocols\";\nimport type { OpenToolDescriptor } from \"./openLattice\";\n\nexport const OPEN_MCP_SERVER_INFO = {\n  name: \"axiom-open\",\n  version: \"0.1.0\",\n} as const;\n\n/**\n * A `ui://` HTML resource served by the session. `read` is invoked per\n * `resources/read`, so the caller can fetch plugin UI lazily.\n */\nexport interface OpenUiResource {\n  /** MIME for the resource; defaults to \"text/html;profile=mcp-app\". */\n  mimeType?: string;\n  csp?: McpUiCsp;\n  read: () => Promise<{ html: string; csp?: McpUiCsp }>;\n}\n\n/** v2 accepts Standard Schema with JSON; our catalog stores Zod 3 schemas. */\nfunction isStandardSchemaWithJson(value: unknown): value is StandardSchemaWithJSON {\n  if (typeof value !== \"object\" || value === null) return false;\n  const standard = (value as { \"~standard\"?: { jsonSchema?: unknown } })[\"~standard\"];\n  return typeof standard === \"object\" && standard !== null && \"jsonSchema\" in standard;\n}\n\nfunction toStandardSchema(schema: z.ZodRawShape | z.ZodType): StandardSchemaWithJSON {\n  if (isStandardSchemaWithJson(schema)) return schema;\n  const zodSchema = schema instanceof z.ZodType ? schema : z.object(schema);\n  return zodSchema;\n}\n\nexport interface BuiltSession {\n  server: McpServer;\n  transport: NodeStreamableHTTPServerTransport;\n  tools: OpenToolDescriptor[];\n}\n\n/** Options shared by the session server builder and the HTTP handler factory. */\nexport interface SessionServerOptions {\n  credential: { credentialId: string; kind: string };\n  grants: OpenGrant[];\n  catalog: OpenToolDescriptor[];\n  invoke: (\n    toolName: string,\n    args: unknown,\n  ) => Promise<{\n    content: Array<{ type: \"text\"; text: string }>;\n    isError?: boolean;\n  }>;\n  uiResources?: Map<string, OpenUiResource>;\n}\n\n/**\n * Builds (but does not connect) one MCP server instance for a single serving\n * unit. `createMcpHandler` calls this factory once per request (and for the\n * initial `server/discover` probe), so every call must return a fresh server.\n *\n * The same server definition serves both protocol eras: legacy 2025-era\n * requests are answered by the stateless fallback, modern 2026-07-28 requests\n * carry a per-request envelope.\n */\nexport async function createSessionServer(\n  options: SessionServerOptions,\n): Promise<{ server: McpServer; tools: OpenToolDescriptor[] }> {\n  const { catalog, invoke, uiResources } = options;\n  const server = new McpServer(OPEN_MCP_SERVER_INFO, {\n    capabilities: {\n      // The SDK has no `extensions` field; MCP App hosts discover the UI\n      // extension through `experimental`.\n      experimental: { \"io.modelcontextprotocol/ui\": {} },\n    },\n  });\n  for (const tool of catalog) {\n    server.registerTool(\n      tool.toolName,\n      {\n        description: tool.description,\n        inputSchema: toStandardSchema(tool.schema),\n        annotations: {\n          readOnlyHint: tool.annotations.readOnlyHint,\n          destructiveHint: tool.annotations.destructiveHint,\n        },\n        ...(tool.ui ? { _meta: { ui: { resourceUri: tool.ui.resourceUri } } } : {}),\n      },\n      async (args: unknown) => {\n        const result = await invoke(tool.toolName, args);\n        return { content: result.content, isError: result.isError };\n      },\n    );\n  }\n  for (const [uri, res] of uiResources ?? []) {\n    const mimeType = res.mimeType ?? \"text/html;profile=mcp-app\";\n    server.registerResource(\n      `mcp-app:${uri}`,\n      uri,\n      {\n        mimeType,\n        ...(res.csp ? { _meta: { ui: { csp: res.csp } } } : {}),\n      },\n      async (u) => {\n        const { html, csp } = await res.read();\n        return {\n          contents: [\n            {\n              uri: u.href,\n              mimeType,\n              text: html,\n              ...(csp ? { _meta: { ui: { csp } } } : {}),\n            },\n          ],\n        };\n      },\n    );\n  }\n  return { server, tools: catalog };\n}\n\n/**\n * Builds (but does not connect) a stateless MCP server plus the legacy\n * streamable HTTP transport. The caller MUST connect it before handling a\n * request — otherwise the transport has no onmessage handler and the request\n * is swallowed. Deferring connect is what lets tests attach the server to an\n * `InMemoryTransport`.\n *\n * @remarks The Open routes use {@link createSessionServer} with\n * `createMcpHandler` for dual-era serving; this helper remains for callers\n * that drive a single transport directly.\n */\nexport async function buildSessionServer(\n  options: SessionServerOptions,\n): Promise<BuiltSession> {\n  const { server, tools } = await createSessionServer(options);\n  const transport = new NodeStreamableHTTPServerTransport({\n    sessionIdGenerator: undefined,\n    enableJsonResponse: true,\n  });\n  return { server, transport, tools };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAWA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAmG;;;ACQrG,IAAM,kBAAN,MAAsB;AAAA,EAK3B,YAAY,UAAkC,CAAC,GAAG;AAJlD,SAAiB,UAAU,oBAAI,IAAoB;AAKjD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,iBAAiB,QAAQ,kBAAkB;AAAA,EAClD;AAAA,EAEQ,YAAY,QAAwB;AAC1C,WAAO,WAAW,UAAU,UAAU;AAAA,EACxC;AAAA,EAEQ,SAAS,QAAwB;AACvC,WAAO,WAAW,UAAU,KAAK,iBAAiB,KAAK;AAAA,EACzD;AAAA;AAAA,EAGA,MAAM,cAAsB,QAAmC;AAC7D,UAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,UAAM,MAAM,GAAG,KAAK,YAAY,MAAM,CAAC,IAAI,YAAY;AACvD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,SAAS,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,QAAQ,OAAO,WAAW,IAAI;AAExE,UAAM,cAAc,QAAQ;AAC5B,UAAM,UAAU,MAAM,OAAO;AAC7B,WAAO,SAAS,KAAK,IAAI,OAAO,OAAO,SAAS,UAAU,WAAW;AACrE,WAAO,YAAY;AAEnB,QAAI,OAAO,UAAU,GAAG;AACtB,aAAO,UAAU;AACjB,WAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAEA,SAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,UAAM,UAAU,IAAI,OAAO;AAC3B,WAAO,EAAE,SAAS,OAAO,cAAc,KAAK,KAAK,UAAU,WAAW,EAAE;AAAA,EAC1E;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;;;ADvCA,SAAS,kBAAkB,uBAAuB;AAClD,SAAS,eAAe,oBAAoB;;;AElB5C,SAAS,yCAAyC;AAClD;AAAA,EACE;AAAA,OAEK;AACP,SAAS,SAAS;AAIX,IAAM,uBAAuB;AAAA,EAClC,MAAM;AAAA,EACN,SAAS;AACX;AAcA,SAAS,yBAAyB,OAAiD;AACjF,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,WAAY,MAAqD,WAAW;AAClF,SAAO,OAAO,aAAa,YAAY,aAAa,QAAQ,gBAAgB;AAC9E;AAEA,SAAS,iBAAiB,QAA2D;AACnF,MAAI,yBAAyB,MAAM,EAAG,QAAO;AAC7C,QAAM,YAAY,kBAAkB,EAAE,UAAU,SAAS,EAAE,OAAO,MAAM;AACxE,SAAO;AACT;AAgCA,eAAsB,oBACpB,SAC6D;AAC7D,QAAM,EAAE,SAAS,QAAQ,YAAY,IAAI;AACzC,QAAM,SAAS,IAAI,UAAU,sBAAsB;AAAA,IACjD,cAAc;AAAA;AAAA;AAAA,MAGZ,cAAc,EAAE,8BAA8B,CAAC,EAAE;AAAA,IACnD;AAAA,EACF,CAAC;AACD,aAAW,QAAQ,SAAS;AAC1B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,aAAa,iBAAiB,KAAK,MAAM;AAAA,QACzC,aAAa;AAAA,UACX,cAAc,KAAK,YAAY;AAAA,UAC/B,iBAAiB,KAAK,YAAY;AAAA,QACpC;AAAA,QACA,GAAI,KAAK,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,GAAG,YAAY,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E;AAAA,MACA,OAAO,SAAkB;AACvB,cAAM,SAAS,MAAM,OAAO,KAAK,UAAU,IAAI;AAC/C,eAAO,EAAE,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,eAAe,CAAC,GAAG;AAC1C,UAAM,WAAW,IAAI,YAAY;AACjC,WAAO;AAAA,MACL,WAAW,GAAG;AAAA,MACd;AAAA,MACA;AAAA,QACE;AAAA,QACA,GAAI,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,MACA,OAAO,MAAM;AACX,cAAM,EAAE,MAAM,IAAI,IAAI,MAAM,IAAI,KAAK;AACrC,eAAO;AAAA,UACL,UAAU;AAAA,YACR;AAAA,cACE,KAAK,EAAE;AAAA,cACP;AAAA,cACA,MAAM;AAAA,cACN,GAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,OAAO,QAAQ;AAClC;AAaA,eAAsB,mBACpB,SACuB;AACvB,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,oBAAoB,OAAO;AAC3D,QAAM,YAAY,IAAI,kCAAkC;AAAA,IACtD,oBAAoB;AAAA,IACpB,oBAAoB;AAAA,EACtB,CAAC;AACD,SAAO,EAAE,QAAQ,WAAW,MAAM;AACpC;;;AF3FA,SAAS,cAAc,SAA6C;AAClE,QAAM,SAAS,QAAQ,QAAQ;AAC/B,MAAI,CAAC,QAAQ,WAAW,SAAS,EAAG,QAAO;AAC3C,SAAO,OAAO,MAAM,UAAU,MAAM,EAAE,KAAK,KAAK;AAClD;AAUA,SAAS,qBAAwC;AAC/C,SAAO;AAAA,IACL,OAAO,CAAC;AAAA,IACR,aAAa,oBAAI,IAAI;AAAA,IACrB,SAAS,MAAM;AAAA,IACf,UAAU;AAAA,IACV,QAAQ,OAAO,cAAc;AAAA,MAC3B,SAAS;AAAA,QACP,EAAE,MAAM,QAAQ,MAAM,yCAAyC,QAAQ,GAAG;AAAA,MAC5E;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAGA,IAAM,YAAY;AAAA,EAChB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,cAAc;AAAA,EACd,wBAAwB;AAC1B;AAEO,SAAS,mBACd,KACA,OAAsB,CAAC,GACjB;AACN,QAAM,WACJ,KAAK,YACL,IAAI;AAAA,IACF,gBAAgB,WAAW,WAAW,EAAE;AAAA,IACxC,gBAAgB,WAAW,SAAS,EAAE;AAAA,EACxC;AACF,QAAM,eACJ,KAAK,iBAAiB,CAAC,QAAwB,IAAI;AACrD,QAAM,QACJ,KAAK,UACJ,MAAM;AACL,QAAI;AACF,YAAM,QAAQ,gBAAgB,WAAW,WAAW,EAAE;AACtD,aAAO,IAAI,iBAAiB,KAAK;AAAA,IACnC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AAEL,QAAM,cAAc,KAAK,eAAe,IAAI,gBAAgB;AAC5D,QAAM,aAAa,KAAK;AAExB,QAAM,qBAAqB,KAAK,sBAAsB;AAQtD,QAAM,yBAAyB,OAC7B,QACA,QACA,QACA,aACkC;AAClC,UAAM,OAAO,8BAA8B,QAAQ,QAAQ,MAAM;AACjE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,mBAAmB,QAAQ,EAAE,aAAa,KAAK,GAAG,EAAE,SAAS,CAAC;AAAA,IACjF,QAAQ;AACN,YAAM,IAAI,0BAA0B,oCAAoC,MAAM,EAAE;AAAA,IAClF;AACA,UAAM,QAAQ,IAAI,IAAI,SAAS,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC;AACxD,UAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;AACpD,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,6BAA6B,MAAM,KAAK,QAAQ,KAAK,IAAI,CAAC;AAAA,MAC5D;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,CAAC,UAA8B;AACjD,UAAM,UAAU,aAAa;AAC7B,UAAM,OAAO,gBAAgB,OAAO;AACpC,UAAM,IAAI,UAAU,gBAAgB,OAAO;AAAA,EAC7C;AAEA,QAAM,sBAAsB,OAC1B,SACA,QACkC;AAClC,UAAM,SAAS,aAAa,OAAO;AACnC,UAAM,UAAU,MAAM,YAAY,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,CAAC;AAMnF,UAAM,kBAAkB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAC9D,UAAM,cACJ,KAAK,kBACJ,CAAC,UAAU,cAAc,sBACxB,uBAAuB,UAAU,cAAc,EAAE,kBAAkB,CAAC;AACxE,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,YAAY,QAAQ,UAAU,QAAQ,eAAe;AACpE,UAAI,OAAO,UAAU;AAInB,YAAI;AAAA,UACF,EAAE,UAAU,QAAQ,SAAS;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAId,UAAI;AAAA,QACF,EAAE,UAAU,QAAQ,UAAU,KAAK,MAAM;AAAA,QACzC;AAAA,MACF;AACA,eAAS,mBAAmB;AAAA,IAC9B;AACA,UAAM,gBAAgB,iBAAiB,SAAS,OAAO,KAAK;AAC5D,UAAM,cAAc,IAAI,IAAI;AAAA,MAC1B,GAAG,gCAAgC,MAAM;AAAA,MACzC,GAAG,OAAO;AAAA,IACZ,CAAC;AACD,WAAO;AAAA,MACL,YAAY,EAAE,cAAc,QAAQ,cAAc,MAAM,QAAQ,KAAK;AAAA,MACrE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,QAAQ,OAAO,UAAU,SAAS;AAChC,cAAM,YAAY,KAAK,IAAI;AAC3B,cAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,GAAG,GAAG,IAAI;AACvD,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI;AAExD,YAAI;AACJ,YAAI;AACJ,YAAI,YAAY;AACd,gBAAM,WAAW,MAAM,WAAW;AAAA,YAChC,gBAAgB,UAAU,eAAe;AAAA,YACzC,EAAE,YAAY,QAAQ,aAAa;AAAA,UACrC;AACA,oBAAU,SAAS;AACnB,yBAAe,SAAS,UACpB,SACA,SAAS,oBAAoB;AAAA,QACnC,OAAO;AACL,gBAAM,WAAW,YAAY,MAAM,QAAQ,cAAc,WAAW;AACpE,oBAAU,SAAS;AACnB,yBAAe,SAAS;AAAA,QAC1B;AACA,YAAI,CAAC,SAAS;AACZ,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI;AAAA,cACF,6BAA6B,gBAAgB,GAAI;AAAA,YACnD;AAAA,YACA,EAAE,SAAS,UAAU,aAAa;AAAA,UACpC;AAAA,QACF;AAEA,YAAI;AACF,gBAAM,iBAAiB,MAAM;AAAA,YAC3B;AAAA,YACA;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,UACV;AACA,gBAAM,gBAAgB,OAAO,QAAQ,QAAQ,KAAK,CAAC,gBAAgB,IAAI,QAAQ;AAC/E,gBAAM,YAAqC;AAAA,YACzC,aAAa,QAAQ;AAAA,YACrB,cAAc,QAAQ;AAAA,YACtB,OAAO,QAAQ;AAAA,UACjB;AACA,gBAAM,SAAS,gBACX,MAAM,OAAO,OAAO,UAAU,MAAM;AAAA,YAClC,UAAU,QAAQ;AAAA,YAClB,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB;AAAA,YACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,UAC7C,CAAC,IACD,MAAM,YAAY;AAAA,YAChB;AAAA,YACA;AAAA,cACE,UAAU,QAAQ;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,aAAa,QAAQ;AAAA,cACrB;AAAA,YACF;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACJ,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ,OAAO,UAAU,UAAU;AAAA,YACnC,GAAI,OAAO,UAAU,EAAE,WAAW,kBAAkB,IAAI,CAAC;AAAA,YACzD,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,iBAAO;AAAA,QACT,SAAS,KAAK;AACZ,gBAAM,OACJ,eAAe,4BACX,UAAU,yBACV,eAAe,mBACb,UAAU,eACV,eAAe,sBACb,UAAU,mBACV,eAAe,kBACb,UAAU,oBACV,UAAU;AACtB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WACE,eAAe,4BACX,2BACA,eAAe,mBACb,iBACA,eAAe,sBACb,qBACA,eAAe,kBACb,sBACA;AAAA,YACZ,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YAC1D,EAAE,SAAS,KAAK;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,OACxB,SACA,UACG;AACH,gBAAY,KAAK;AACjB,UAAM,UAAU,MAAM,SAAS,QAAQ,cAAc,OAAO,CAAC;AAC7D,QAAI,CAAC,SAAS;AACZ,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,cAAc,CAAC;AAAA,IACxD;AAYA,UAAM,SAAS;AAAA,MACb,aAEI,MAAM;AAAA,QACJ,MAAM,oBAAoB,SAAS,QAAQ,GAAG;AAAA,MAChD,GACA;AAAA,MACJ;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,CAAC,UAAU;AAClB,kBAAQ,IAAI,KAAK,EAAE,KAAK,MAAM,GAAG,yBAAyB;AAAA,QAC5D;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc,cAAc,QAAQ;AAAA,MACxC,SAAS,CAAC,UAAU;AAClB,gBAAQ,IAAI,KAAK,EAAE,KAAK,MAAM,GAAG,2BAA2B;AAAA,MAC9D;AAAA,IACF,CAAC;AAOD,UAAM,YAAY,QAAQ,IAAI;AAG9B,QAAI,aAAa,OAAO,UAAU,gBAAgB,YAAY;AAC5D,aAAO,eAAe,WAAW,eAAe;AAAA,QAC9C,OAAO,MAAM;AAAA,QACb,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAEA,UAAM,OAAO;AAEb,UAAM,aAAa,MAAM,aAAa,QAAQ,KAAK,QAAQ,IAAI;AAC/D,QAAI,MAAM,gBAAgB,YAAY,QAAQ,IAAI,GAAG;AACnD,YAAM,QAAQ,MAAM;AAAA,QAClB,MAAM,oBAAoB,SAAS,QAAQ,GAAG;AAAA,MAChD;AACA,YAAM,MAAM,OAAO,QAAQ,MAAM,SAAS;AAC1C,YAAMA,SAAQ,MAAY;AACxB,aAAK,MAAM,UAAU,MAAM,EAAE,MAAM,MAAM,MAAS;AAClD,aAAK,MAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,MACjD;AACA,YAAM,IAAI,KAAK,SAASA,MAAK;AAC7B,YAAM,MAAM,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,QAAQ,IAAI;AACxE;AAAA,IACF;AAEA,UAAM,QAAQ,MAAY;AACxB,WAAK,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IAC3C;AACA,UAAM,IAAI,KAAK,SAAS,KAAK;AAC7B,UAAM,YAAY,QAAQ,KAAK,MAAM,KAAK,QAAQ,IAAI;AAAA,EACxD;AAEA,QAAM,mBAAmB,OACvB,UACA,UACG;AACH,UAAM,OAAO,SAAS,MAAM;AAC5B,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,EAC/D;AAEA,MAAI,KAAK,aAAa,iBAAiB;AAEvC,MAAI,KAAK,QAAQ,iBAAiB;AAClC,MAAI,KAAK,SAAS,iBAAiB;AACnC,MAAI,IAAI,QAAQ,gBAAgB;AAChC,MAAI,IAAI,SAAS,gBAAgB;AAKjC,MAAI,IAAI,aAAa,gBAAgB;AACrC,MAAI,IAAI,cAAc,gBAAgB;AACtC,MAAI,OAAO,aAAa,gBAAgB;AACxC,MAAI,OAAO,QAAQ,gBAAgB;AACnC,MAAI,OAAO,SAAS,gBAAgB;AAEtC;","names":["close"]}

package/dist/open-session-CLZT3HVG.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/routes/open-session.ts"],"sourcesContent":["/**\n * Open session exchange: downgrades a share token into a short-lived browser\n * token scoped to the platform browser whitelist. The share link is the key;\n * grants come from the whitelist (V1: kb read-only), not the caller.\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { getStoreLattice } from \"@axiom-lattice/core\";\nimport type { SharedResourceStore } from \"@axiom-lattice/protocols\";\nimport { signOpenToken } from \"../services/open/openToken\";\nimport { BROWSER_GRANTS } from \"../services/open/previewToken\";\nimport type { OpenToolDescriptor } from \"../services/open/openLattice\";\nimport { openLattice } from \"../services/open/openLattice\";\n\nexport function registerOpenSessionRoutes(app: FastifyInstance): void {\n  app.post(\n    \"/open/session\",\n    async (request: FastifyRequest, reply: FastifyReply) => {\n      const body = (request.body ?? {}) as { shareToken?: string };\n      const shareToken = body.shareToken;\n      if (typeof shareToken !== \"string\" || shareToken.length === 0) {\n        return reply.status(400).send({ error: \"SHARE_TOKEN_REQUIRED\" });\n      }\n\n      const store = getStoreLattice(\"default\", \"sharedResource\")\n        .store as SharedResourceStore;\n      const record = await store.findByToken(shareToken);\n      if (!record || record.kind !== \"file\" || record.revoked) {\n        return reply.status(404).send({ error: \"SHARE_NOT_FOUND\" });\n      }\n      if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n        return reply.status(410).send({ error: \"SHARE_EXPIRED\" });\n      }\n\n      const grants = BROWSER_GRANTS;\n      const browserToken = signOpenToken({\n        kind: \"browser_token\",\n        tenantId: record.tenantId,\n        projectId: record.projectId,\n        shareId: record.token,\n        grants,\n      });\n\n      const actions: OpenToolDescriptor[] = await openLattice.catalogFor(grants, { tenantId: record.tenantId });\n\n      return reply.status(200).send({\n        browserToken,\n        expiresAt: Date.now() + 15 * 60 * 1000,\n        actions: actions.map((a) => a.toolName),\n      });\n    },\n  );\n}\n"],"mappings":";;;;;;;;;;;;;AASA;AAFA,SAAS,uBAAuB;AAOzB,SAAS,0BAA0B,KAA4B;AACpE,MAAI;AAAA,IACF;AAAA,IACA,OAAO,SAAyB,UAAwB;AACtD,YAAM,OAAQ,QAAQ,QAAQ,CAAC;AAC/B,YAAM,aAAa,KAAK;AACxB,UAAI,OAAO,eAAe,YAAY,WAAW,WAAW,GAAG;AAC7D,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MACjE;AAEA,YAAM,QAAQ,gBAAgB,WAAW,gBAAgB,EACtD;AACH,YAAM,SAAS,MAAM,MAAM,YAAY,UAAU;AACjD,UAAI,CAAC,UAAU,OAAO,SAAS,UAAU,OAAO,SAAS;AACvD,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,MAC5D;AACA,UAAI,OAAO,aAAa,IAAI,KAAK,OAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC;AAAA,MAC1D;AAEA,YAAM,SAAS;AACf,YAAM,eAAe,cAAc;AAAA,QACjC,MAAM;AAAA,QACN,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS,OAAO;AAAA,QAChB;AAAA,MACF,CAAC;AAED,YAAM,UAAgC,MAAM,YAAY,WAAW,QAAQ,EAAE,UAAU,OAAO,SAAS,CAAC;AAExG,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,QAC5B;AAAA,QACA,WAAW,KAAK,IAAI,IAAI,KAAK,KAAK;AAAA,QAClC,SAAS,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ;AAAA,MACxC,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/registerExposedPlugins-2JGXSMAL.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/resources-YD5DOPGD.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/controllers/resources.ts","../src/services/open/sandboxGrants.ts"],"sourcesContent":["import { FastifyRequest, FastifyReply } from \"fastify\";\nimport type {\n  CreateShareRequest,\n  FileShareRecord,\n  McpAppShareRecord,\n  ResourceAddress,\n  ShareRecord,\n  SharedResourceStore,\n} from \"@axiom-lattice/protocols\";\nimport bcrypt from \"bcryptjs\";\nimport {\n  generateToken,\n  createSharePayload,\n  createMcpAppSharePayload,\n  SharePayloadError,\n  verifyMcpUiScope,\n  TokenCache,\n  SandboxLatticeManager,\n  buildNamedVolumeName,\n} from \"@axiom-lattice/core\";\nimport { getContentTypeFromFilename } from \"../utils/mime\";\nimport { sendBufferWithRange } from \"../utils/http-range\";\nimport { sanitizeShareOpenGrants } from \"../services/open/sandboxGrants\";\n\ninterface ResourceControllerDeps {\n  store: SharedResourceStore;\n  sandboxManager: SandboxLatticeManager;\n  cache: TokenCache;\n  logger: { info: (msg: string, obj?: object) => void; warn: (msg: string, obj?: object) => void; error: (msg: string, obj?: object) => void };\n}\n\nexport class ResourceController {\n  constructor(private deps: ResourceControllerDeps) {}\n\n  async createShare(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const workspaceId = (request.headers[\"x-workspace-id\"] as string) || \"\";\n    const projectId = (request.headers[\"x-project-id\"] as string) || \"\";\n    const body = request.body as CreateShareRequest;\n\n    if (body.kind === \"mcpApp\") {\n      return this.createMcpAppShare(request, reply, body, tenantId, userId, workspaceId, projectId);\n    }\n\n    if (!workspaceId || !projectId) {\n      return reply.status(400).send({ error: \"x-workspace-id and x-project-id headers required\" });\n    }\n\n    const payload = createSharePayload(\n      tenantId,\n      workspaceId,\n      projectId,\n      userId as string,\n      body,\n    );\n    const token = generateToken();\n\n    try {\n      await this.deps.store.create({ ...payload, token });\n      this.deps.logger.info(\n        \"[share] created\",\n        { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId },\n      );\n    } catch {\n      return reply.status(500).send({ error: \"Failed to create share\" });\n    }\n\n    return reply.status(201).send({ token, url: `/s/${token}` });\n  }\n\n  private async createMcpAppShare(\n    request: FastifyRequest,\n    reply: FastifyReply,\n    body: Extract<CreateShareRequest, { kind: \"mcpApp\" }>,\n    tenantId: string,\n    userId: string,\n    workspaceId: string,\n    projectId: string,\n  ) {\n    if (body.visibility !== \"public\" && body.visibility !== \"password\") {\n      return reply.status(400).send({ error: \"INTERNAL_NOT_SUPPORTED\" });\n    }\n    if (body.app.kind === \"plugin\") {\n      const scope = body.app.scope ? verifyMcpUiScope(body.app.scope) : null;\n      if (!scope) return reply.status(400).send({ error: \"SCOPE_REQUIRED\" });\n      if (\n        scope.tid !== tenantId ||\n        scope.plugin !== body.app.pluginType ||\n        scope.resource !== body.app.resource\n      ) {\n        return reply.status(403).send({ error: \"SCOPE_MISMATCH\" });\n      }\n    } else if (!body.app.serverKey || !body.app.resourceUri) {\n      return reply.status(400).send({ error: \"INVALID_REQUEST\" });\n    }\n\n    try {\n      const payload = createMcpAppSharePayload({\n        tenantId,\n        createdBy: userId,\n        workspaceId,\n        projectId,\n        app: body.app,\n        title: body.title,\n        visibility: body.visibility,\n        password: body.password,\n        expiresAt: body.expiresAt ? new Date(body.expiresAt) : undefined,\n        maxAccess: body.maxAccess,\n      });\n      const record = await this.deps.store.create(payload);\n      request.log.info({\n        event: \"share.created\",\n        tenantId,\n        userId,\n        kind: \"mcpApp\",\n        visibility: body.visibility,\n        appKind: body.app.kind,\n        tool: body.app.toolName,\n        tokenPrefix: record.token.slice(0, 8),\n      }, \"share created\");\n      return reply.status(201).send({ token: record.token, url: `/s/${record.token}` });\n    } catch (error) {\n      if (error instanceof SharePayloadError) {\n        const status = error.code === \"PAYLOAD_TOO_LARGE\" ? 413 : 400;\n        return reply.status(status).send({ error: error.code });\n      }\n      request.log.error(error);\n      return reply.status(500).send({ error: \"SHARE_CREATE_FAILED\" });\n    }\n  }\n\n  async listShares(request: FastifyRequest, reply: FastifyReply) {\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const tenantId = (request.headers[\"x-tenant-id\"] as string) || \"default\";\n    const shares = await this.deps.store.listByUser(tenantId, userId as string);\n    return reply.send(shares.filter((r: any) => (r as any).visibility !== \"internal\"));\n  }\n\n  async updateShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n    const patch = request.body as any;\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n    if (record.kind === \"mcpApp\" && patch.visibility === \"internal\") {\n      return reply.status(400).send({ error: \"INTERNAL_NOT_SUPPORTED\" });\n    }\n\n    await this.deps.store.update(token, patch);\n\n    if (patch.revoked) {\n      this.deps.cache.invalidate(token);\n    }\n\n    return reply.send({ ok: true });\n  }\n\n  async revokeShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const userId = (request as any).user\n      ? (request as any).user.id ?? \"unknown\"\n      : \"unknown\";\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.createdBy !== userId) {\n      return reply.status(404).send({ error: \"Share not found\" });\n    }\n\n    await this.deps.store.update(token, { revoked: true });\n    this.deps.cache.invalidate(token);\n\n    return reply.send({ ok: true });\n  }\n\n  async resolveResource(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { token: string; \"*\"?: string };\n    const { token } = params;\n    const subPath = params[\"*\"] ?? \"\";\n\n    this.deps.logger.info(\"[share] resolve start\", { token, subPath });\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime — proxy to sandbox. Detected by /api/ anywhere in subPath.\n    if (isApi) {\n      const record = await this.deps.store.findByToken(token);\n      if (!record || record.revoked) return reply.status(404).send(\"Not found\");\n      if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n        return reply.status(410).send(\"Expired\");\n      }\n      if (record.kind === \"mcpApp\") return reply.status(404).send(\"Not found\");\n      // Auth check for API calls (same as file access)\n      if (!this._isInternalRequest(request)) {\n        if (record.visibility === \"internal\") {\n          return reply.status(401).send({ error: \"Internal access only\" });\n        }\n        if (record.visibility === \"password\") {\n          if (!this._isUnlocked(request, token)) {\n            return reply.status(401).send({ error: \"Password required\" });\n          }\n        }\n      }\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApi(record, subPath, ext, request, reply);\n    }\n\n    // 1. Always validate against the share store before serving. A cached\n    // token may have been revoked (or had its password/visibility changed) on\n    // another replica, so a process-local cache hit must not bypass this check.\n    this.deps.logger.info(\"[share] querying DB\", { token });\n\n    // 2. Single DB lookup\n    const record = await this.deps.store.findByToken(token);\n    if (!record || record.revoked) {\n      this.deps.logger.warn(\"[share] token not found or revoked\", { token, found: !!record, revoked: record?.revoked });\n      return reply.status(404).send(\"Not found\");\n    }\n    if (record.expiresAt && new Date(record.expiresAt) < new Date()) {\n      this.deps.logger.info(\"[share] token expired\", { token, expiresAt: record.expiresAt });\n      return reply.status(410).send(\"Expired\");\n    }\n    if (record.kind === \"mcpApp\") {\n      return this._serveMcpAppShell(record, reply);\n    }\n\n    this.deps.logger.info(\"[share] record found\", {\n      token,\n      volume: record.address.volume,\n      resourcePath: record.address.resourcePath,\n      visibility: record.visibility,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n    });\n\n    // 3. Auth\n    const isInternal = this._isInternalRequest(request);\n    if (!isInternal) {\n      // Internal shares: must be logged in\n      if (record.visibility === \"internal\") {\n        return reply.status(401).send({ error: \"Internal access only\" });\n      }\n      if (record.visibility === \"password\") {\n        const unlocked = this._isUnlocked(request, token);\n        if (!unlocked) {\n          this.deps.logger.info(\"[share] password protected, returning password page\", { token });\n          return reply.type(\"text/html\").send(this._passwordPage(token));\n        }\n        this.deps.logger.info(\"[share] password unlocked\", { token });\n      }\n    }\n\n    // 4. Access count\n    if (record.maxAccess !== null) {\n      const ok = await this.deps.store.atomicIncrementAccess(token);\n      if (!ok) return reply.status(410).send(\"Access limit reached\");\n    } else {\n      this.deps.store.incrementAccess(token).catch(() => {});\n    }\n\n    // 5. Serve (no process-local cache: the store lookup above is authoritative)\n    const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };\n\n    return this._serveFile(record.address, token, subPath, sandboxConfig, reply, request.headers.range);\n  }\n\n  /**\n   * Thin redirect: /f/{uuidHex3}/{path} → /s/{internal-token}/{path}\n   * Decodes 3 UUIDs (no dashes, 96 hex chars), ensures internal share, 302 redirects.\n   */\n  async resolveDirectFile(request: FastifyRequest, reply: FastifyReply) {\n    const params = request.params as unknown as { tid: string; wid: string; pid: string; \"*\"?: string };\n    const tenantId = params.tid;\n    const workspaceId = params.wid;\n    const projectId = params.pid;\n    const subPath = (params[\"*\"] ?? \"\");\n\n    const isApi = subPath && /(^|\\/)api\\//.test(subPath) && (subPath.endsWith(\".js\") || subPath.endsWith(\".py\"));\n\n    // Only API paths accept non-GET methods\n    if (request.method !== \"GET\" && !isApi) {\n      return reply.status(405).send({ error: \"Method not allowed\" });\n    }\n\n    // API runtime\n    if (isApi) {\n      const ext = subPath.endsWith(\".py\") ? \"py\" : \"js\";\n      return this._execApiCore({\n        tenantId, workspaceId, projectId, assistantId: \"\",\n        resourcePath: subPath,\n      }, subPath, ext, request, reply);\n    }\n\n    const volume = buildNamedVolumeName(\"p\", \"project\", tenantId, workspaceId, projectId);\n    return this._resolveAndServe(volume, subPath, reply, `/f/${tenantId}/${workspaceId}/${projectId}`,\n      { tenantId, workspaceId, projectId, assistantId: null },\n      request.headers.range,\n    );\n  }\n\n  async unlockShare(request: FastifyRequest, reply: FastifyReply) {\n    const { token } = request.params as unknown as { token: string };\n    const { password } = request.body as unknown as { password: string };\n\n    const record = await this.deps.store.findByToken(token);\n    if (!record || !record.passwordHash) {\n      return reply.status(404).send({ error: \"Invalid request\" });\n    }\n\n    const valid = await bcrypt.compare(password, record.passwordHash!);\n    if (!valid) {\n      return reply.status(401).send({ error: \"Incorrect password\" });\n    }\n\n    const cookieOpts = [\n      `share_unlock_${token}=1`,\n      \"Max-Age=86400\",\n      `Path=/s/${token}`,\n      \"SameSite=Lax\",\n      \"HttpOnly\",\n    ];\n    if (request.protocol === \"https\") {\n      cookieOpts.push(\"Secure\");\n    }\n    reply.header(\"Set-Cookie\", cookieOpts.join(\"; \"));\n    return reply.send({ ok: true });\n  }\n\n  private _isInternalRequest(request: FastifyRequest): boolean {\n    const user = (request as any).user;\n    if (user && user.id) return true;\n    // Fallback: same-origin browser request (iframe/img embed — no Auth header)\n    const origin = request.headers.origin || request.headers.referer;\n    if (origin) {\n      try {\n        const { hostname } = new URL(origin);\n        if (hostname === request.hostname) return true;\n      } catch { /* malformed */ }\n    }\n    return false;\n  }\n\n  private _isUnlocked(request: FastifyRequest, token: string): boolean {\n    const cookie = request.headers.cookie ?? \"\";\n    return cookie.includes(`share_unlock_${token}=1`);\n  }\n\n  /** Returns true if the path has a file extension indicating it's a file, not a directory */\n  private _isFilePath(path: string): boolean {\n    return /\\.[a-zA-Z0-9]+$/.test(path);\n  }\n\n  /**\n   * Injects a `<base href>` tag into an HTML document when it does not already\n   * declare one. Injects right after `<head>` when present, otherwise prefixes\n   * the document.\n   */\n  private _injectBaseTag(html: string, baseHref: string): string {\n    if (/<base\\b/i.test(html)) return html;\n    const baseTag = `<base href=\"${baseHref}\">`;\n    return html.includes(\"<head>\") ? html.replace(\"<head>\", `<head>${baseTag}`) : baseTag + html;\n  }\n\n  /**\n   * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.\n   */\n  private async _resolveAndServe(\n    volume: string,\n    resourcePath: string,\n    reply: FastifyReply,\n    baseTagPrefix: string,\n    sandboxConfig?: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    rangeHeader?: string,\n  ) {\n    const cleanPath = resourcePath.replace(/\\/+$/, \"\");\n    const entryPath = !cleanPath\n      ? \"index.html\"\n      : this._isFilePath(cleanPath)\n        ? cleanPath\n        : `${cleanPath}/index.html`;\n\n    const address: ResourceAddress = { volume, resourcePath: \"\" };\n\n    let buf: Buffer;\n    try {\n      // Volume FS first\n      const provider = this.deps.sandboxManager.getDefaultProvider();\n      buf = await provider.getResourceResolver().resolve({ ...address, resourcePath: entryPath });\n    } catch {\n      // Sandbox fallback\n      if (!sandboxConfig) return reply.status(404).send(\"File not found\");\n      try {\n        const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n          assistant_id: sandboxConfig.assistantId ?? \"\",\n          thread_id: \"\",\n          tenantId: sandboxConfig.tenantId,\n          workspaceId: sandboxConfig.workspaceId,\n          projectId: sandboxConfig.projectId,\n        });\n        buf = await sandbox.file.downloadFile({ file: `/project/${entryPath}` });\n      } catch {\n        return reply.status(404).send(\"File not found\");\n      }\n    }\n\n    const filename = entryPath.split(\"/\").pop() || \"download\";\n    const contentType = getContentTypeFromFilename(filename);\n\n    // Inject base tag for HTML\n    if (/\\.(html|htm)$/i.test(filename)) {\n      const baseDir = cleanPath\n        ? (this._isFilePath(cleanPath) ? cleanPath.replace(/[^/]+$/, \"\") : cleanPath)\n        : \"\";\n      const baseHref = `${baseTagPrefix}${baseDir ? \"/\" + baseDir : \"\"}/`;\n      buf = Buffer.from(\n        this._injectBaseTag(buf.toString(\"utf-8\"), baseHref),\n        \"utf-8\"\n      );\n    }\n\n    return sendBufferWithRange(reply, buf, contentType, rangeHeader, {\n      \"Content-Disposition\": `inline; filename*=UTF-8''${encodeURIComponent(filename)}`,\n      \"Access-Control-Allow-Origin\": \"*\",\n    });\n  }\n\n  private async _serveMcpAppShell(\n    _record: McpAppShareRecord,\n    reply: FastifyReply,\n  ) {\n    const html = [\n      \"<!doctype html>\",\n      '<html lang=\"en\">',\n      \"  <head>\",\n      '    <meta charset=\"utf-8\" />',\n      '    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />',\n      \"    <title>Shared app</title>\",\n      \"  </head>\",\n      \"  <body>\",\n      '    <div id=\"axiom-mcp-app-root\">Loading…</div>',\n      '    <script type=\"module\" src=\"/embed/mcp-app-page.js\"></script>',\n      \"  </body>\",\n      \"</html>\",\n    ].join(\"\\n\");\n    return reply\n      .header(\"cache-control\", \"no-store\")\n      .header(\"referrer-policy\", \"no-referrer\")\n      .header(\"x-content-type-options\", \"nosniff\")\n      .header(\n        \"content-security-policy\",\n        \"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; connect-src 'self'; frame-src 'self'; frame-ancestors 'none'; base-uri 'none'\",\n      )\n      .type(\"text/html; charset=utf-8\")\n      .send(html);\n  }\n\n  private async _serveFile(\n    address: ResourceAddress,\n    token: string,\n    subPath: string,\n    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },\n    reply: FastifyReply,\n    rangeHeader: string | undefined,\n  ) {\n    const resourcePath = subPath\n      ? this._resolveSafeSubPath(address.resourcePath, subPath)\n      : address.resourcePath;\n    return this._resolveAndServe(\n      address.volume,\n      resourcePath,\n      reply,\n      `/s/${token}`,\n      sandboxConfig,\n      rangeHeader,\n    );\n  }\n\n  private async _execApi(\n    record: FileShareRecord,\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    const basePath = this._isFilePath(record.address.resourcePath)\n      ? \"\"\n      : `${record.address.resourcePath}/`;\n    return this._execApiCore({\n      tenantId: record.tenantId,\n      workspaceId: record.workspaceId,\n      projectId: record.projectId,\n      assistantId: record.assistantId,\n      resourcePath: basePath + apiSubPath,\n      openGrants: record.openGrants,\n    }, apiSubPath, ext, request, reply);\n  }\n\n  private async _execApiCore(\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      assistantId?: string | null;\n      resourcePath: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n    apiSubPath: string,\n    ext: \"js\" | \"py\",\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) {\n    let sandbox: any;\n    try {\n      sandbox = await this.deps.sandboxManager.getSandboxFromConfig({\n        assistant_id: config.assistantId ?? \"\",\n        thread_id: \"\",\n        tenantId: config.tenantId,\n        workspaceId: config.workspaceId,\n        projectId: config.projectId,\n      });\n    } catch (err) {\n      this.deps.logger.error(\"[share] sandbox start failed for API\", { error: (err as Error).message });\n      return reply.status(502).send({ error: \"Sandbox unavailable\" });\n    }\n\n    const scriptPath = `/project/${config.resourcePath}`;\n    const cmd = ext === \"py\" ? `python3 ${scriptPath}` : `node ${scriptPath}`;\n\n    // Pass query params and body via environment\n    const queryStr = request.url.includes(\"?\") ? (request.url as string).split(\"?\")[1] : \"\";\n    const queryObj: Record<string, string> = {};\n    if (queryStr) {\n      for (const [k, v] of new URLSearchParams(queryStr)) {\n        queryObj[k] = v;\n      }\n    }\n\n    const bodyStr = (request.body as string) ?? \"\";\n\n    const envVars = [\n      `export API_QUERY='${JSON.stringify(queryObj).replace(/'/g, \"'\\\\''\")}'`,\n      `export API_BODY='${bodyStr.replace(/'/g, \"'\\\\''\")}'`,\n      `export API_METHOD='${request.method}'`,\n      `export API_GATEWAY_URL='${request.protocol}://${request.headers[\"x-forwarded-host\"] ?? request.headers.host ?? request.hostname}'`,\n      `export API_TENANT_ID='${config.tenantId}'`,\n      `export API_ASSISTANT_ID='${config.assistantId || \"\"}'`,\n      `export OPEN_API_TOKEN='${this._mintSandboxToken(sandbox.name, config)}'`,\n    ].join(\" && \");\n\n    const fullCmd = `${envVars} && ${cmd}`;\n\n    this.deps.logger.info(\"[api] exec\", { scriptPath, cmd: cmd.substring(0, 80) });\n\n    try {\n      const result = await sandbox.shell.execCommand({ command: fullCmd });\n      // Parse stdout as JSON\n      let data: unknown;\n      try {\n        data = JSON.parse(result.output?.trim() || \"{}\");\n      } catch {\n        data = { output: result.output?.trim() || \"\" };\n      }\n      return reply.status(200).type(\"application/json\").send(data);\n    } catch (err) {\n      this.deps.logger.warn(\"[api] exec failed\", { scriptPath, error: (err as Error).message });\n      return reply.status(500).send({ error: (err as Error).message });\n    }\n  }\n\n  private _resolveSafeSubPath(entryFile: string, subPath: string): string {\n    if (!subPath) return entryFile;\n    if (subPath.includes(\"..\")) throw new Error(\"Path traversal denied\");\n    if (subPath.startsWith(entryFile + \"/\") || subPath === entryFile) return subPath;\n    const entryDir = this._isFilePath(entryFile)\n      ? entryFile.replace(/[^/]+$/, \"\")\n      : entryFile + \"/\";\n    return (entryDir + subPath).replace(/\\/+/g, \"/\");\n  }\n\n  private _passwordPage(token: string): string {\n    return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class=\"card\"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id=\"f\"><input type=\"password\" id=\"p\" placeholder=\"Enter password\" required><button type=\"submit\">Unlock</button><div class=\"error\" id=\"e\">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;\n  }\n\n  private _mintSandboxToken(\n    sandboxName: string,\n    config: {\n      tenantId: string;\n      workspaceId: string;\n      projectId: string;\n      openGrants?: import(\"@axiom-lattice/protocols\").OpenGrant[];\n    },\n  ): string {\n    // eslint-disable-next-line @typescript-eslint/no-var-requires\n    const { signOpenToken } = require(\"../services/open/openToken\") as {\n      signOpenToken: (p: unknown) => string;\n    };\n    return signOpenToken({\n      kind: \"sandbox_token\",\n      tenantId: config.tenantId,\n      workspaceId: config.workspaceId,\n      projectId: config.projectId,\n      sandboxName,\n      grants: [\n        {\n          domain: \"sandbox\",\n          items: [\"files_read\", \"files_list\", \"files_write\", \"shell_exec\"],\n        },\n        ...sanitizeShareOpenGrants(config.openGrants),\n      ],\n    });\n  }\n}\n","/**\n * Sandbox-token grant sanitation.\n *\n * Sandbox tokens always carry the self-binding sandbox grant (resolved from\n * the credential's tenant/workspace/project). Shares may append extra\n * Open-door grants, but only within the V1 whitelist: read-only kb access.\n * Anything else is dropped server-side (the share creator cannot widen scope).\n */\n\nimport type { OpenGrant } from \"@axiom-lattice/protocols\";\n\n/** V1 allowlist: domain → permitted (read-only) actions. */\nconst ALLOWED: Record<string, string[]> = {\n  kb: [\"search\", \"entries_read\"],\n};\n\nexport function sanitizeShareOpenGrants(grants: OpenGrant[] | undefined): OpenGrant[] {\n  const out: OpenGrant[] = [];\n  for (const grant of grants ?? []) {\n    const allowed = ALLOWED[grant.domain];\n    if (!allowed) continue;\n    const items =\n      grant.items && grant.items.length > 0\n        ? grant.items.filter((item) => allowed.includes(item))\n        : allowed;\n    if (items.length > 0) out.push({ domain: grant.domain, items });\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;AASA,OAAO,YAAY;AACnB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,OACK;;;ACPP,IAAM,UAAoC;AAAA,EACxC,IAAI,CAAC,UAAU,cAAc;AAC/B;AAEO,SAAS,wBAAwB,QAA8C;AACpF,QAAM,MAAmB,CAAC;AAC1B,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,UAAM,UAAU,QAAQ,MAAM,MAAM;AACpC,QAAI,CAAC,QAAS;AACd,UAAM,QACJ,MAAM,SAAS,MAAM,MAAM,SAAS,IAChC,MAAM,MAAM,OAAO,CAAC,SAAS,QAAQ,SAAS,IAAI,CAAC,IACnD;AACN,QAAI,MAAM,SAAS,EAAG,KAAI,KAAK,EAAE,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAAA,EAChE;AACA,SAAO;AACT;;;ADGO,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAAoB,MAA8B;AAA9B;AAAA,EAA+B;AAAA,EAEnD,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,cAAe,QAAQ,QAAQ,gBAAgB,KAAgB;AACrE,UAAM,YAAa,QAAQ,QAAQ,cAAc,KAAgB;AACjE,UAAM,OAAO,QAAQ;AAErB,QAAI,KAAK,SAAS,UAAU;AAC1B,aAAO,KAAK,kBAAkB,SAAS,OAAO,MAAM,UAAU,QAAQ,aAAa,SAAS;AAAA,IAC9F;AAEA,QAAI,CAAC,eAAe,CAAC,WAAW;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC7F;AAEA,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc;AAE5B,QAAI;AACF,YAAM,KAAK,KAAK,MAAM,OAAO,EAAE,GAAG,SAAS,MAAM,CAAC;AAClD,WAAK,KAAK,OAAO;AAAA,QACf;AAAA,QACA,EAAE,OAAO,cAAc,KAAK,cAAc,gBAAgB,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,QAAQ,QAAQ,OAAO;AAAA,MACjI;AAAA,IACF,QAAQ;AACN,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AAEA,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAc,kBACZ,SACA,OACA,MACA,UACA,QACA,aACA,WACA;AACA,QAAI,KAAK,eAAe,YAAY,KAAK,eAAe,YAAY;AAClE,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AACA,QAAI,KAAK,IAAI,SAAS,UAAU;AAC9B,YAAM,QAAQ,KAAK,IAAI,QAAQ,iBAAiB,KAAK,IAAI,KAAK,IAAI;AAClE,UAAI,CAAC,MAAO,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACrE,UACE,MAAM,QAAQ,YACd,MAAM,WAAW,KAAK,IAAI,cAC1B,MAAM,aAAa,KAAK,IAAI,UAC5B;AACA,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,MAC3D;AAAA,IACF,WAAW,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK,IAAI,aAAa;AACvD,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,QAAI;AACF,YAAM,UAAU,yBAAyB;AAAA,QACvC;AAAA,QACA,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,KAAK,KAAK;AAAA,QACV,OAAO,KAAK;AAAA,QACZ,YAAY,KAAK;AAAA,QACjB,UAAU,KAAK;AAAA,QACf,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,IAAI;AAAA,QACvD,WAAW,KAAK;AAAA,MAClB,CAAC;AACD,YAAM,SAAS,MAAM,KAAK,KAAK,MAAM,OAAO,OAAO;AACnD,cAAQ,IAAI,KAAK;AAAA,QACf,OAAO;AAAA,QACP;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN,YAAY,KAAK;AAAA,QACjB,SAAS,KAAK,IAAI;AAAA,QAClB,MAAM,KAAK,IAAI;AAAA,QACf,aAAa,OAAO,MAAM,MAAM,GAAG,CAAC;AAAA,MACtC,GAAG,eAAe;AAClB,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,GAAG,CAAC;AAAA,IAClF,SAAS,OAAO;AACd,UAAI,iBAAiB,mBAAmB;AACtC,cAAM,SAAS,MAAM,SAAS,sBAAsB,MAAM;AAC1D,eAAO,MAAM,OAAO,MAAM,EAAE,KAAK,EAAE,OAAO,MAAM,KAAK,CAAC;AAAA,MACxD;AACA,cAAQ,IAAI,MAAM,KAAK;AACvB,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,SAAyB,OAAqB;AAC7D,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,WAAY,QAAQ,QAAQ,aAAa,KAAgB;AAC/D,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,WAAW,UAAU,MAAgB;AAC1E,WAAO,MAAM,KAAK,OAAO,OAAO,CAAC,MAAY,EAAU,eAAe,UAAU,CAAC;AAAA,EACnF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AACJ,UAAM,QAAQ,QAAQ;AAEtB,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AACA,QAAI,OAAO,SAAS,YAAY,MAAM,eAAe,YAAY;AAC/D,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,yBAAyB,CAAC;AAAA,IACnE;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,KAAK;AAEzC,QAAI,MAAM,SAAS;AACjB,WAAK,KAAK,MAAM,WAAW,KAAK;AAAA,IAClC;AAEA,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,SAAU,QAAgB,OAC3B,QAAgB,KAAK,MAAM,YAC5B;AAEJ,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,cAAc,QAAQ;AAC1C,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,KAAK,KAAK,MAAM,OAAO,OAAO,EAAE,SAAS,KAAK,CAAC;AACrD,SAAK,KAAK,MAAM,WAAW,KAAK;AAEhC,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,MAAM,gBAAgB,SAAyB,OAAqB;AAClE,UAAM,SAAS,QAAQ;AACvB,UAAM,EAAE,MAAM,IAAI;AAClB,UAAM,UAAU,OAAO,GAAG,KAAK;AAE/B,SAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,QAAQ,CAAC;AAEjE,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAMA,UAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,UAAI,CAACA,WAAUA,QAAO,QAAS,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AACxE,UAAIA,QAAO,aAAa,IAAI,KAAKA,QAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,MACzC;AACA,UAAIA,QAAO,SAAS,SAAU,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AAEvE,UAAI,CAAC,KAAK,mBAAmB,OAAO,GAAG;AACrC,YAAIA,QAAO,eAAe,YAAY;AACpC,iBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,QACjE;AACA,YAAIA,QAAO,eAAe,YAAY;AACpC,cAAI,CAAC,KAAK,YAAY,SAAS,KAAK,GAAG;AACrC,mBAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,UAC9D;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,SAASA,SAAQ,SAAS,KAAK,SAAS,KAAK;AAAA,IAC3D;AAKA,SAAK,KAAK,OAAO,KAAK,uBAAuB,EAAE,MAAM,CAAC;AAGtD,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,OAAO,SAAS;AAC7B,WAAK,KAAK,OAAO,KAAK,sCAAsC,EAAE,OAAO,OAAO,CAAC,CAAC,QAAQ,SAAS,QAAQ,QAAQ,CAAC;AAChH,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,WAAW;AAAA,IAC3C;AACA,QAAI,OAAO,aAAa,IAAI,KAAK,OAAO,SAAS,IAAI,oBAAI,KAAK,GAAG;AAC/D,WAAK,KAAK,OAAO,KAAK,yBAAyB,EAAE,OAAO,WAAW,OAAO,UAAU,CAAC;AACrF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,SAAS;AAAA,IACzC;AACA,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO,KAAK,kBAAkB,QAAQ,KAAK;AAAA,IAC7C;AAEA,SAAK,KAAK,OAAO,KAAK,wBAAwB;AAAA,MAC5C;AAAA,MACA,QAAQ,OAAO,QAAQ;AAAA,MACvB,cAAc,OAAO,QAAQ;AAAA,MAC7B,YAAY,OAAO;AAAA,MACnB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,IACpB,CAAC;AAGD,UAAM,aAAa,KAAK,mBAAmB,OAAO;AAClD,QAAI,CAAC,YAAY;AAEf,UAAI,OAAO,eAAe,YAAY;AACpC,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MACjE;AACA,UAAI,OAAO,eAAe,YAAY;AACpC,cAAM,WAAW,KAAK,YAAY,SAAS,KAAK;AAChD,YAAI,CAAC,UAAU;AACb,eAAK,KAAK,OAAO,KAAK,uDAAuD,EAAE,MAAM,CAAC;AACtF,iBAAO,MAAM,KAAK,WAAW,EAAE,KAAK,KAAK,cAAc,KAAK,CAAC;AAAA,QAC/D;AACA,aAAK,KAAK,OAAO,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC9D;AAAA,IACF;AAGA,QAAI,OAAO,cAAc,MAAM;AAC7B,YAAM,KAAK,MAAM,KAAK,KAAK,MAAM,sBAAsB,KAAK;AAC5D,UAAI,CAAC,GAAI,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,sBAAsB;AAAA,IAC/D,OAAO;AACL,WAAK,KAAK,MAAM,gBAAgB,KAAK,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACvD;AAGA,UAAM,gBAAgB,EAAE,UAAU,OAAO,UAAU,aAAa,OAAO,aAAa,WAAW,OAAO,WAAW,aAAa,OAAO,YAAY;AAEjJ,WAAO,KAAK,WAAW,OAAO,SAAS,OAAO,SAAS,eAAe,OAAO,QAAQ,QAAQ,KAAK;AAAA,EACpG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAkB,SAAyB,OAAqB;AACpE,UAAM,SAAS,QAAQ;AACvB,UAAM,WAAW,OAAO;AACxB,UAAM,cAAc,OAAO;AAC3B,UAAM,YAAY,OAAO;AACzB,UAAM,UAAW,OAAO,GAAG,KAAK;AAEhC,UAAM,QAAQ,WAAW,cAAc,KAAK,OAAO,MAAM,QAAQ,SAAS,KAAK,KAAK,QAAQ,SAAS,KAAK;AAG1G,QAAI,QAAQ,WAAW,SAAS,CAAC,OAAO;AACtC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAGA,QAAI,OAAO;AACT,YAAM,MAAM,QAAQ,SAAS,KAAK,IAAI,OAAO;AAC7C,aAAO,KAAK,aAAa;AAAA,QACvB;AAAA,QAAU;AAAA,QAAa;AAAA,QAAW,aAAa;AAAA,QAC/C,cAAc;AAAA,MAChB,GAAG,SAAS,KAAK,SAAS,KAAK;AAAA,IACjC;AAEA,UAAM,SAAS,qBAAqB,KAAK,WAAW,UAAU,aAAa,SAAS;AACpF,WAAO,KAAK;AAAA,MAAiB;AAAA,MAAQ;AAAA,MAAS;AAAA,MAAO,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS;AAAA,MAC7F,EAAE,UAAU,aAAa,WAAW,aAAa,KAAK;AAAA,MACtD,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,SAAyB,OAAqB;AAC9D,UAAM,EAAE,MAAM,IAAI,QAAQ;AAC1B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,SAAS,MAAM,KAAK,KAAK,MAAM,YAAY,KAAK;AACtD,QAAI,CAAC,UAAU,CAAC,OAAO,cAAc;AACnC,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5D;AAEA,UAAM,QAAQ,MAAM,OAAO,QAAQ,UAAU,OAAO,YAAa;AACjE,QAAI,CAAC,OAAO;AACV,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC/D;AAEA,UAAM,aAAa;AAAA,MACjB,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,WAAW,KAAK;AAAA,MAChB;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,aAAa,SAAS;AAChC,iBAAW,KAAK,QAAQ;AAAA,IAC1B;AACA,UAAM,OAAO,cAAc,WAAW,KAAK,IAAI,CAAC;AAChD,WAAO,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEQ,mBAAmB,SAAkC;AAC3D,UAAM,OAAQ,QAAgB;AAC9B,QAAI,QAAQ,KAAK,GAAI,QAAO;AAE5B,UAAM,SAAS,QAAQ,QAAQ,UAAU,QAAQ,QAAQ;AACzD,QAAI,QAAQ;AACV,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,MAAM;AACnC,YAAI,aAAa,QAAQ,SAAU,QAAO;AAAA,MAC5C,QAAQ;AAAA,MAAkB;AAAA,IAC5B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,YAAY,SAAyB,OAAwB;AACnE,UAAM,SAAS,QAAQ,QAAQ,UAAU;AACzC,WAAO,OAAO,SAAS,gBAAgB,KAAK,IAAI;AAAA,EAClD;AAAA;AAAA,EAGQ,YAAY,MAAuB;AACzC,WAAO,kBAAkB,KAAK,IAAI;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,eAAe,MAAc,UAA0B;AAC7D,QAAI,WAAW,KAAK,IAAI,EAAG,QAAO;AAClC,UAAM,UAAU,eAAe,QAAQ;AACvC,WAAO,KAAK,SAAS,QAAQ,IAAI,KAAK,QAAQ,UAAU,SAAS,OAAO,EAAE,IAAI,UAAU;AAAA,EAC1F;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBACZ,QACA,cACA,OACA,eACA,eACA,aACA;AACA,UAAM,YAAY,aAAa,QAAQ,QAAQ,EAAE;AACjD,UAAM,YAAY,CAAC,YACf,eACA,KAAK,YAAY,SAAS,IACxB,YACA,GAAG,SAAS;AAElB,UAAM,UAA2B,EAAE,QAAQ,cAAc,GAAG;AAE5D,QAAI;AACJ,QAAI;AAEF,YAAM,WAAW,KAAK,KAAK,eAAe,mBAAmB;AAC7D,YAAM,MAAM,SAAS,oBAAoB,EAAE,QAAQ,EAAE,GAAG,SAAS,cAAc,UAAU,CAAC;AAAA,IAC5F,QAAQ;AAEN,UAAI,CAAC,cAAe,QAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAClE,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,UAClE,cAAc,cAAc,eAAe;AAAA,UAC3C,WAAW;AAAA,UACX,UAAU,cAAc;AAAA,UACxB,aAAa,cAAc;AAAA,UAC3B,WAAW,cAAc;AAAA,QAC3B,CAAC;AACD,cAAM,MAAM,QAAQ,KAAK,aAAa,EAAE,MAAM,YAAY,SAAS,GAAG,CAAC;AAAA,MACzE,QAAQ;AACN,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,gBAAgB;AAAA,MAChD;AAAA,IACF;AAEA,UAAM,WAAW,UAAU,MAAM,GAAG,EAAE,IAAI,KAAK;AAC/C,UAAM,cAAc,2BAA2B,QAAQ;AAGvD,QAAI,iBAAiB,KAAK,QAAQ,GAAG;AACnC,YAAM,UAAU,YACX,KAAK,YAAY,SAAS,IAAI,UAAU,QAAQ,UAAU,EAAE,IAAI,YACjE;AACJ,YAAM,WAAW,GAAG,aAAa,GAAG,UAAU,MAAM,UAAU,EAAE;AAChE,YAAM,OAAO;AAAA,QACX,KAAK,eAAe,IAAI,SAAS,OAAO,GAAG,QAAQ;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,WAAO,oBAAoB,OAAO,KAAK,aAAa,aAAa;AAAA,MAC/D,uBAAuB,4BAA4B,mBAAmB,QAAQ,CAAC;AAAA,MAC/E,+BAA+B;AAAA,IACjC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,kBACZ,SACA,OACA;AACA,UAAM,OAAO;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AACX,WAAO,MACJ,OAAO,iBAAiB,UAAU,EAClC,OAAO,mBAAmB,aAAa,EACvC,OAAO,0BAA0B,SAAS,EAC1C;AAAA,MACC;AAAA,MACA;AAAA,IACF,EACC,KAAK,0BAA0B,EAC/B,KAAK,IAAI;AAAA,EACd;AAAA,EAEA,MAAc,WACZ,SACA,OACA,SACA,eACA,OACA,aACA;AACA,UAAM,eAAe,UACjB,KAAK,oBAAoB,QAAQ,cAAc,OAAO,IACtD,QAAQ;AACZ,WAAO,KAAK;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,MAAM,KAAK;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,SACZ,QACA,YACA,KACA,SACA,OACA;AACA,UAAM,WAAW,KAAK,YAAY,OAAO,QAAQ,YAAY,IACzD,KACA,GAAG,OAAO,QAAQ,YAAY;AAClC,WAAO,KAAK,aAAa;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB,aAAa,OAAO;AAAA,MACpB,cAAc,WAAW;AAAA,MACzB,YAAY,OAAO;AAAA,IACrB,GAAG,YAAY,KAAK,SAAS,KAAK;AAAA,EACpC;AAAA,EAEA,MAAc,aACZ,QAQA,YACA,KACA,SACA,OACA;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,KAAK,KAAK,eAAe,qBAAqB;AAAA,QAC5D,cAAc,OAAO,eAAe;AAAA,QACpC,WAAW;AAAA,QACX,UAAU,OAAO;AAAA,QACjB,aAAa,OAAO;AAAA,QACpB,WAAW,OAAO;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,MAAM,wCAAwC,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAChG,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,sBAAsB,CAAC;AAAA,IAChE;AAEA,UAAM,aAAa,YAAY,OAAO,YAAY;AAClD,UAAM,MAAM,QAAQ,OAAO,WAAW,UAAU,KAAK,QAAQ,UAAU;AAGvE,UAAM,WAAW,QAAQ,IAAI,SAAS,GAAG,IAAK,QAAQ,IAAe,MAAM,GAAG,EAAE,CAAC,IAAI;AACrF,UAAM,WAAmC,CAAC;AAC1C,QAAI,UAAU;AACZ,iBAAW,CAAC,GAAG,CAAC,KAAK,IAAI,gBAAgB,QAAQ,GAAG;AAClD,iBAAS,CAAC,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,UAAW,QAAQ,QAAmB;AAE5C,UAAM,UAAU;AAAA,MACd,qBAAqB,KAAK,UAAU,QAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,MACpE,oBAAoB,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAAA,MAClD,sBAAsB,QAAQ,MAAM;AAAA,MACpC,2BAA2B,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,kBAAkB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ;AAAA,MAChI,yBAAyB,OAAO,QAAQ;AAAA,MACxC,4BAA4B,OAAO,eAAe,EAAE;AAAA,MACpD,0BAA0B,KAAK,kBAAkB,QAAQ,MAAM,MAAM,CAAC;AAAA,IACxE,EAAE,KAAK,MAAM;AAEb,UAAM,UAAU,GAAG,OAAO,OAAO,GAAG;AAEpC,SAAK,KAAK,OAAO,KAAK,cAAc,EAAE,YAAY,KAAK,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;AAE7E,QAAI;AACF,YAAM,SAAS,MAAM,QAAQ,MAAM,YAAY,EAAE,SAAS,QAAQ,CAAC;AAEnE,UAAI;AACJ,UAAI;AACF,eAAO,KAAK,MAAM,OAAO,QAAQ,KAAK,KAAK,IAAI;AAAA,MACjD,QAAQ;AACN,eAAO,EAAE,QAAQ,OAAO,QAAQ,KAAK,KAAK,GAAG;AAAA,MAC/C;AACA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,kBAAkB,EAAE,KAAK,IAAI;AAAA,IAC7D,SAAS,KAAK;AACZ,WAAK,KAAK,OAAO,KAAK,qBAAqB,EAAE,YAAY,OAAQ,IAAc,QAAQ,CAAC;AACxF,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAQ,IAAc,QAAQ,CAAC;AAAA,IACjE;AAAA,EACF;AAAA,EAEQ,oBAAoB,WAAmB,SAAyB;AACtE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACnE,QAAI,QAAQ,WAAW,YAAY,GAAG,KAAK,YAAY,UAAW,QAAO;AACzE,UAAM,WAAW,KAAK,YAAY,SAAS,IACvC,UAAU,QAAQ,UAAU,EAAE,IAC9B,YAAY;AAChB,YAAQ,WAAW,SAAS,QAAQ,QAAQ,GAAG;AAAA,EACjD;AAAA,EAEQ,cAAc,OAAuB;AAC3C,WAAO,8tCAA8tC,KAAK;AAAA,EAC5uC;AAAA,EAEQ,kBACN,aACA,QAMQ;AAER,UAAM,EAAE,cAAc,IAAI;AAG1B,WAAO,cAAc;AAAA,MACnB,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,OAAO,CAAC,cAAc,cAAc,eAAe,YAAY;AAAA,QACjE;AAAA,QACA,GAAG,wBAAwB,OAAO,UAAU;AAAA,MAC9C;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":["record"]}

package/dist/sandboxOpenCredentialProvider-RTYOYRCT.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/services/open/sandboxOpenCredentialProvider.ts"],"sourcesContent":["/**\n * Gateway composition-root implementation of the sandbox open-credential seam.\n *\n * Mints a short-lived, self-bound `sandbox_token` for agent `code_eval` so its\n * sandbox code can call the Open MCP endpoint. Plugin handlers do not use this\n * seam: they read the platform API key from their connection config directly and\n * only need the gateway URL, which is exposed through a separate URL seam.\n */\n\nimport type { OpenGrant } from \"@axiom-lattice/protocols\";\nimport type { SandboxOpenCredentialProvider } from \"@axiom-lattice/core\";\nimport {\n  registerSandboxOpenCredentialProvider,\n  registerSandboxOpenGatewayUrlProvider,\n} from \"@axiom-lattice/core\";\nimport { signOpenToken } from \"./openToken\";\nimport {\n  createDefaultAgentReflectionDeps,\n  mergeGrantsByDomain,\n  resolveAgentOpenGrants,\n} from \"./sandboxOpenReflection\";\n\n/** Conservative default grants for sandbox-initiated Open calls (B0). */\nexport const DEFAULT_SANDBOX_OPEN_GRANTS: OpenGrant[] = [\n  { domain: \"sandbox\", items: [\"files_read\", \"files_list\", \"files_write\", \"shell_exec\"] },\n  { domain: \"kb\", items: [\"search\", \"entries_read\"] },\n];\n\n/** Maximum nested sandbox Open orchestration depth before minting is refused. */\nexport const MAX_SANDBOX_OPEN_DEPTH = 5;\n\n/** Reflection seam: how the provider derives caller grants for an agent. */\nexport interface SandboxOpenReflection {\n  /** Reflect an agent caller's own Open capabilities. */\n  agent: (tenantId: string, assistantId: string) => Promise<OpenGrant[]>;\n}\n\n/** Options for {@link createSandboxOpenCredentialProvider}. */\nexport interface SandboxOpenCredentialProviderFactoryOptions {\n  /** Public base URL of this gateway (`PUBLIC_GATEWAY_URL`). Absent ⇒ inject nothing. */\n  gatewayUrl?: string;\n  /** Best-effort hook for structured warnings (e.g. depth cap reached). */\n  onError?: (error: unknown) => void;\n  /** Test seam replacing the live agent reflection resolver. */\n  reflection?: SandboxOpenReflection;\n}\n\n/** Default reflection wired to the live tenant registries. */\nfunction defaultReflection(): SandboxOpenReflection {\n  return {\n    agent: (tenantId, assistantId) =>\n      resolveAgentOpenGrants(tenantId, assistantId, createDefaultAgentReflectionDeps(tenantId)),\n  };\n}\n\n/**\n * Build the provider.\n *\n * Only agent callers are served: the grants come from the caller agent's own\n * configured middleware. Plugin handlers never use this provider — they carry\n * the platform API key in their connection config.\n *\n * Each mint increments the orchestration `depth`; past\n * {@link MAX_SANDBOX_OPEN_DEPTH} the provider refuses to mint, breaking cycles.\n *\n * @param options - Gateway URL, error hook, and optional reflection seam\n * @returns A {@link SandboxOpenCredentialProvider}\n */\nexport function createSandboxOpenCredentialProvider(\n  options: SandboxOpenCredentialProviderFactoryOptions,\n): SandboxOpenCredentialProvider {\n  const reflection = options.reflection ?? defaultReflection();\n  return async (context) => {\n    if (!options.gatewayUrl) return undefined;\n    if (!context.assistantId) return undefined;\n    const depth = (context.depth ?? 0) + 1;\n    if (depth > MAX_SANDBOX_OPEN_DEPTH) {\n      options.onError?.(new Error(\"sandbox open credential depth exceeded\"));\n      return undefined;\n    }\n    const reflected = await reflection.agent(context.tenantId, context.assistantId);\n    const grants = mergeGrantsByDomain([...DEFAULT_SANDBOX_OPEN_GRANTS, ...reflected]);\n    const token = signOpenToken({\n      kind: \"sandbox_token\",\n      tenantId: context.tenantId,\n      workspaceId: context.workspaceId ?? \"\",\n      projectId: context.projectId ?? \"\",\n      sandboxName: context.sandboxName,\n      grants,\n      depth,\n    });\n    return { gatewayUrl: options.gatewayUrl, token };\n  };\n}\n\n/**\n * Register the gateway credential provider and the plugin gateway-URL seam.\n *\n * @param onError - Optional hook for structured warnings when resolution fails\n * @returns An unregister function (for tests/shutdown)\n */\nexport function registerGatewaySandboxOpenCredentialProvider(\n  onError?: (error: unknown) => void,\n): () => void {\n  const gatewayUrl = process.env.PUBLIC_GATEWAY_URL?.trim() || undefined;\n  const unregisterCredential = registerSandboxOpenCredentialProvider(\n    createSandboxOpenCredentialProvider({ gatewayUrl, onError }),\n    { onError },\n  );\n  const unregisterGatewayUrl = registerSandboxOpenGatewayUrlProvider(() => gatewayUrl);\n  return () => {\n    unregisterGatewayUrl();\n    unregisterCredential();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAeA;AAJA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASA,IAAM,8BAA2C;AAAA,EACtD,EAAE,QAAQ,WAAW,OAAO,CAAC,cAAc,cAAc,eAAe,YAAY,EAAE;AAAA,EACtF,EAAE,QAAQ,MAAM,OAAO,CAAC,UAAU,cAAc,EAAE;AACpD;AAGO,IAAM,yBAAyB;AAmBtC,SAAS,oBAA2C;AAClD,SAAO;AAAA,IACL,OAAO,CAAC,UAAU,gBAChB,uBAAuB,UAAU,aAAa,iCAAiC,QAAQ,CAAC;AAAA,EAC5F;AACF;AAeO,SAAS,oCACd,SAC+B;AAC/B,QAAM,aAAa,QAAQ,cAAc,kBAAkB;AAC3D,SAAO,OAAO,YAAY;AACxB,QAAI,CAAC,QAAQ,WAAY,QAAO;AAChC,QAAI,CAAC,QAAQ,YAAa,QAAO;AACjC,UAAM,SAAS,QAAQ,SAAS,KAAK;AACrC,QAAI,QAAQ,wBAAwB;AAClC,cAAQ,UAAU,IAAI,MAAM,wCAAwC,CAAC;AACrE,aAAO;AAAA,IACT;AACA,UAAM,YAAY,MAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,WAAW;AAC9E,UAAM,SAAS,oBAAoB,CAAC,GAAG,6BAA6B,GAAG,SAAS,CAAC;AACjF,UAAM,QAAQ,cAAc;AAAA,MAC1B,MAAM;AAAA,MACN,UAAU,QAAQ;AAAA,MAClB,aAAa,QAAQ,eAAe;AAAA,MACpC,WAAW,QAAQ,aAAa;AAAA,MAChC,aAAa,QAAQ;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO,EAAE,YAAY,QAAQ,YAAY,MAAM;AAAA,EACjD;AACF;AAQO,SAAS,6CACd,SACY;AACZ,QAAM,aAAa,QAAQ,IAAI,oBAAoB,KAAK,KAAK;AAC7D,QAAM,uBAAuB;AAAA,IAC3B,oCAAoC,EAAE,YAAY,QAAQ,CAAC;AAAA,IAC3D,EAAE,QAAQ;AAAA,EACZ;AACA,QAAM,uBAAuB,sCAAsC,MAAM,UAAU;AACnF,SAAO,MAAM;AACX,yBAAqB;AACrB,yBAAqB;AAAA,EACvB;AACF;","names":[]}