@axiom-lattice/gateway 4.10.0 → 4.10.2

package/dist/{open-FJ3BY3CL.mjs → open-GNBMCHYA.mjs}

@@ -6,6 +6,9 @@ import {
   buildTenantOpenPlugins,
   mergeOpenCatalog
 } from "./chunk-FGSFOXIX.mjs";
+import {
+  OpenRateLimiter
+} from "./chunk-GXZFO3VU.mjs";
 import {
   deleteSession,
   getSession,
@@ -28,44 +31,6 @@ import "./chunk-NFEGQTCC.mjs";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { getStoreLattice } from "@axiom-lattice/core";
 
-// src/services/open/openRateLimiter.ts
-var OpenRateLimiter = class {
-  constructor(options = {}) {
-    this.buckets = /* @__PURE__ */ new Map();
-    this.defaultPerMinute = options.defaultPerMinute ?? 60;
-    this.agentPerMinute = options.agentPerMinute ?? 10;
-  }
-  bucketClass(domain) {
-    return domain === "agent" ? "agent" : "default";
-  }
-  limitFor(domain) {
-    return domain === "agent" ? this.agentPerMinute : this.defaultPerMinute;
-  }
-  /** Consume one token; denied calls report how long to wait. */
-  check(credentialId, domain) {
-    const limit = this.limitFor(domain);
-    const key = `${this.bucketClass(domain)}:${credentialId}`;
-    const now = Date.now();
-    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };
-    const refillPerMs = limit / 6e4;
-    const elapsed = now - bucket.updatedAt;
-    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);
-    bucket.updatedAt = now;
-    if (bucket.tokens >= 1) {
-      bucket.tokens -= 1;
-      this.buckets.set(key, bucket);
-      return { allowed: true };
-    }
-    this.buckets.set(key, bucket);
-    const deficit = 1 - bucket.tokens;
-    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };
-  }
-  /** Test helper. */
-  reset() {
-    this.buckets.clear();
-  }
-};
-
 // src/services/open/openMcpServer.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -343,4 +308,4 @@ function registerOpenRoutes(app, deps = {}) {
 export {
   registerOpenRoutes
 };
-//# sourceMappingURL=open-FJ3BY3CL.mjs.map
+//# sourceMappingURL=open-GNBMCHYA.mjs.map

package/dist/open-GNBMCHYA.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/routes/open.ts","../src/services/open/openMcpServer.ts"],"sourcesContent":["/**\n * Open API surface routes: POST/DELETE /open/mcp.\n *\n * The route is a thin shell — credential resolution (OpenAuthService),\n * catalog filtering and invocation (OpenLattice), and session lifecycle\n * (mcpTransportRegistry) live in services/open/*. The transport writes the\n * response itself, so the reply is hijacked (same precedent as the Project\n * Room SSE route).\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { isInitializeRequest } from \"@modelcontextprotocol/sdk/types.js\";\nimport { getStoreLattice } from \"@axiom-lattice/core\";\nimport type { A2AApiKeyStore, OpenAuditStore, OpenGrant, ProjectStore } from \"@axiom-lattice/protocols\";\nimport { OpenCredentialService } from \"../services/open/openCredentialService\";\nimport { OpenAuditService } from \"../services/open/openAuditService\";\nimport { OpenRateLimiter } from \"../services/open/openRateLimiter\";\nimport type { OpenCredential } from \"../services/open/openCredentialService\";\nimport {\n  openLattice,\n  ActionNotFoundError,\n  GrantDeniedError,\n  ValidationError,\n} from \"../services/open/openLattice\";\nimport { buildSessionServer } from \"../services/open/openMcpServer\";\nimport { collectExposedPluginUiResources } from \"../services/open/registerExposedPlugins\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPlugins,\n} from \"../services/open/tenantOpenPlugins\";\nimport { getSession, deleteSession } from \"../services/open/mcpTransportRegistry\";\n\nexport interface OpenRouteDeps {\n  openAuth?: OpenCredentialService;\n  grantsSource?: (ctx: OpenCredential) => OpenGrant[];\n  audit?: OpenAuditService;\n  rateLimiter?: OpenRateLimiter;\n  /**\n   * Test seam: build the credential's tenant sandbox plugin bundle. Defaults to\n   * {@link buildTenantOpenPlugins} with the global catalog's tool names reserved\n   * so a tenant tool can never shadow a global/built-in one.\n   */\n  tenantPlugins?: (\n    tenantId: string,\n    grants: OpenGrant[],\n    reservedToolNames: ReadonlySet<string>,\n  ) => Promise<TenantOpenPlugins>;\n}\n\nfunction extractBearer(request: FastifyRequest): string | undefined {\n  const header = request.headers.authorization;\n  if (!header?.startsWith(\"Bearer \")) return undefined;\n  return header.slice(\"Bearer \".length).trim() || undefined;\n}\n\nfunction readSessionId(request: FastifyRequest): string | undefined {\n  const raw = request.headers[\"mcp-session-id\"];\n  const value = Array.isArray(raw) ? raw[0] : raw;\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\n/**\n * Degraded tenant plugin bundle used when the sandbox catalog cannot be read.\n *\n * A catalog read failure must not 500 the session: the MCP server still builds\n * and serves the global tools. `invoke` is unreachable through normal routing\n * (`hasTool` is always false, so calls route to OpenLattice) but returns an\n * error result if it is ever reached.\n */\nfunction emptyTenantPlugins(): TenantOpenPlugins {\n  return {\n    tools: [],\n    uiResources: new Map(),\n    hasTool: () => false,\n    degraded: true,\n    invoke: async (toolName) => ({\n      content: [\n        { type: \"text\", text: `Tenant plugin catalog unavailable for ${toolName}` },\n      ],\n      isError: true,\n    }),\n  };\n}\n\n/** JSON-RPC error codes used on the Open surface. */\nconst RPC_ERROR = {\n  GRANT_DENIED: -32001,\n  ACTION_NOT_FOUND: -32002,\n  VALIDATION_FAILED: -32003,\n  EXECUTION_ERROR: -32004,\n  RATE_LIMITED: -32005,\n} as const;\n\nexport function registerOpenRoutes(\n  app: FastifyInstance,\n  deps: OpenRouteDeps = {},\n): void {\n  const openAuth =\n    deps.openAuth ??\n    new OpenCredentialService(\n      getStoreLattice(\"default\", \"a2aApiKey\").store as A2AApiKeyStore,\n      getStoreLattice(\"default\", \"project\").store as ProjectStore,\n    );\n  const grantsSource =\n    deps.grantsSource ?? ((ctx: OpenCredential) => ctx.grants);\n  const audit =\n    deps.audit ??\n    (() => {\n      try {\n        const store = getStoreLattice(\"default\", \"openAudit\").store as OpenAuditStore;\n        return new OpenAuditService(store);\n      } catch {\n        return undefined;\n      }\n    })();\n\n  const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();\n\n  app.post(\"/open/mcp\", async (request: FastifyRequest, reply: FastifyReply) => {\n    const context = await openAuth.resolve(extractBearer(request));\n    if (!context) {\n      return reply.status(401).send({ error: \"AUTH_FAILED\" });\n    }\n\n    const body: unknown = request.body;\n    const sessionId = readSessionId(request);\n\n    // Existing session: reuse its server/transport. Bearer must match the\n    // session's credential — a session is not usable by another key.\n    if (sessionId) {\n      const session = await getSession(sessionId);\n      if (\n        !session ||\n        session.credential.credentialId !== context.credentialId\n      ) {\n        return reply.status(404).send({ error: \"SESSION_NOT_FOUND\" });\n      }\n      reply.hijack();\n      await session.transport.handleRequest(request.raw, reply.raw, body);\n      return;\n    }\n\n    // New session: only initialize may create one. Registration into the\n    // session registry happens inside sessionIdGenerator (see openMcpServer).\n    if (!isInitializeRequest(body)) {\n      return reply.status(400).send({ error: \"SESSION_REQUIRED\" });\n    }\n\n    const grants = grantsSource(context);\n    const catalog = await openLattice.catalogFor(grants, { tenantId: context.tenantId });\n    // Tenant sandbox plugins are volume-resident and outside the OpenLattice\n    // registry; merge their grant-filtered tools/UI alongside the globals.\n    // Global/built-in tool names are reserved so a tenant plugin of the same\n    // type (kb/sandbox/agent) can neither crash `registerTool` with a duplicate\n    // nor capture the invoke routing for a global tool.\n    const globalToolNames = new Set(catalog.map((t) => t.toolName));\n    const buildTenant =\n      deps.tenantPlugins ??\n      ((tenantId, tenantGrants, reservedToolNames) =>\n        buildTenantOpenPlugins(tenantId, tenantGrants, { reservedToolNames }));\n    let tenant: TenantOpenPlugins;\n    try {\n      tenant = await buildTenant(context.tenantId, grants, globalToolNames);\n      if (tenant.degraded) {\n        // The catalog's common failure mode is a diagnostic, not a throw\n        // (`ensureLoaded` returns error-level diagnostics). Surface it and\n        // serve global tools only.\n        request.log.warn(\n          { tenantId: context.tenantId },\n          \"open mcp: tenant plugin catalog degraded; serving global tools only\",\n        );\n      }\n    } catch (error) {\n      // Sandbox catalogs are volume-resident and can be transiently\n      // unavailable; degrade to globals-only rather than failing the whole\n      // session so external hosts can still connect. `err` keeps the stack.\n      request.log.warn(\n        { tenantId: context.tenantId, err: error },\n        \"open mcp: tenant plugin catalog unavailable; serving global tools only\",\n      );\n      tenant = emptyTenantPlugins();\n    }\n    const mergedCatalog = mergeOpenCatalog(catalog, tenant.tools);\n    const uiResources = new Map([\n      ...collectExposedPluginUiResources(grants),\n      ...tenant.uiResources,\n    ]);\n    const built = await buildSessionServer({\n      credential: { credentialId: context.credentialId, kind: context.kind },\n      grants,\n      catalog: mergedCatalog,\n      uiResources,\n      invoke: async (toolName, args) => {\n        const startedAt = Date.now();\n        const sep = toolName.indexOf(\"_\");\n        const auditDomain = sep > 0 ? toolName.slice(0, sep) : toolName;\n        const auditAction = sep > 0 ? toolName.slice(sep + 1) : \"\";\n\n        const decision = rateLimiter.check(context.credentialId, auditDomain);\n        if (!decision.allowed) {\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode: \"RATE_LIMITED\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(\n              `RATE_LIMITED: retry after ${decision.retryAfterMs ?? 1000}ms`,\n            ),\n            { rpcCode: RPC_ERROR.RATE_LIMITED },\n          );\n        }\n\n        try {\n          const isTenantRoute = tenant.hasTool(toolName) && !globalToolNames.has(toolName);\n          const runConfig: Record<string, unknown> = {\n            sandboxName: context.sandboxName,\n            credentialId: context.credentialId,\n            depth: context.depth,\n          };\n          const result = isTenantRoute\n            ? await tenant.invoke(toolName, args, {\n                tenantId: context.tenantId,\n                projectId: context.projectId,\n                workspaceId: context.workspaceId,\n                runConfig,\n              })\n            : await openLattice.invoke(\n                grants,\n                {\n                  tenantId: context.tenantId,\n                  projectId: context.projectId,\n                  workspaceId: context.workspaceId,\n                  runConfig,\n                },\n                toolName,\n                args,\n              );\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: result.isError ? \"error\" : \"ok\",\n            ...(result.isError ? { errorCode: \"EXECUTION_ERROR\" } : {}),\n            durationMs: Date.now() - startedAt,\n          });\n          return result;\n        } catch (err) {\n          const code =\n            err instanceof GrantDeniedError\n              ? RPC_ERROR.GRANT_DENIED\n              : err instanceof ActionNotFoundError\n                ? RPC_ERROR.ACTION_NOT_FOUND\n                : err instanceof ValidationError\n                  ? RPC_ERROR.VALIDATION_FAILED\n                  : RPC_ERROR.EXECUTION_ERROR;\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode:\n              err instanceof GrantDeniedError\n                ? \"GRANT_DENIED\"\n                : err instanceof ActionNotFoundError\n                  ? \"ACTION_NOT_FOUND\"\n                  : err instanceof ValidationError\n                    ? \"VALIDATION_FAILED\"\n                    : \"EXECUTION_ERROR\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(err instanceof Error ? err.message : String(err)),\n            { rpcCode: code },\n          );\n        }\n      },\n    });\n    // buildSessionServer no longer connects internally (so it is testable\n    // over InMemoryTransport); the transport still needs an onmessage handler\n    // before handleRequest or initialize is swallowed and the request hangs.\n    await built.server.connect(built.transport);\n    reply.hijack();\n    await built.transport.handleRequest(request.raw, reply.raw, body);\n  });\n\n  app.delete(\n    \"/open/mcp\",\n    async (request: FastifyRequest, reply: FastifyReply) => {\n      const sessionId = readSessionId(request);\n      if (!sessionId) {\n        return reply.status(400).send({ error: \"SESSION_REQUIRED\" });\n      }\n      await deleteSession(sessionId);\n      return reply.status(204).send();\n    },\n  );\n}\n","/**\n * Builds a per-session MCP server instance whose tool list is the\n * credential-filtered OpenLattice catalog. Per-session instances are what\n * make grant-filtered tools/list possible on the official SDK.\n *\n * Session registration happens inside sessionIdGenerator — the SDK invokes\n * it exactly once while handling initialize, which guarantees the registry\n * key equals the transport-generated id that the response header carries.\n *\n * Every tool executor routes through the OpenLattice invoke kernel, so\n * authorization is re-checked on each invocation (default-deny, live grants).\n */\n\nimport { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { randomUUID } from \"crypto\";\nimport type { McpUiCsp, OpenGrant } from \"@axiom-lattice/protocols\";\nimport type { OpenToolDescriptor } from \"./openLattice\";\nimport { registerSession } from \"./mcpTransportRegistry\";\n\nexport const OPEN_MCP_SERVER_INFO = {\n  name: \"axiom-open\",\n  version: \"0.1.0\",\n} as const;\n\n/**\n * A `ui://` HTML resource served by the session. `read` is invoked per\n * `resources/read`, so the caller can fetch plugin UI lazily.\n */\nexport interface OpenUiResource {\n  /** MIME for the resource; defaults to \"text/html;profile=mcp-app\". */\n  mimeType?: string;\n  csp?: McpUiCsp;\n  read: () => Promise<{ html: string; csp?: McpUiCsp }>;\n}\n\nexport interface BuiltSession {\n  server: McpServer;\n  transport: StreamableHTTPServerTransport;\n  tools: OpenToolDescriptor[];\n}\n\n/**\n * Builds (but does not connect) a per-session MCP server. The caller MUST\n * connect it to a transport (`await built.server.connect(built.transport)`)\n * before handling requests — otherwise the transport has no onmessage\n * handler and initialize is swallowed. Deferring connect is what lets tests\n * attach the server to an `InMemoryTransport`.\n */\nexport async function buildSessionServer(options: {\n  credential: { credentialId: string; kind: string };\n  grants: OpenGrant[];\n  catalog: OpenToolDescriptor[];\n  invoke: (\n    toolName: string,\n    args: unknown,\n  ) => Promise<{\n    content: Array<{ type: \"text\"; text: string }>;\n    isError?: boolean;\n  }>;\n  uiResources?: Map<string, OpenUiResource>;\n}): Promise<BuiltSession> {\n  const { credential, catalog, invoke, uiResources } = options;\n  const server = new McpServer(OPEN_MCP_SERVER_INFO, {\n    capabilities: {\n      // The SDK has no `extensions` field; MCP App hosts discover the UI\n      // extension through `experimental`.\n      experimental: { \"io.modelcontextprotocol/ui\": {} },\n    },\n  });\n  for (const tool of catalog) {\n    server.registerTool(\n      tool.toolName,\n      {\n        description: tool.description,\n        inputSchema: tool.schema,\n        annotations: {\n          readOnlyHint: tool.annotations.readOnlyHint,\n          destructiveHint: tool.annotations.destructiveHint,\n        },\n        ...(tool.ui ? { _meta: { ui: { resourceUri: tool.ui.resourceUri } } } : {}),\n      },\n      async (args: unknown) => {\n        const result = await invoke(tool.toolName, args);\n        return { content: result.content, isError: result.isError };\n      },\n    );\n  }\n  for (const [uri, res] of uiResources ?? []) {\n    const mimeType = res.mimeType ?? \"text/html;profile=mcp-app\";\n    server.registerResource(\n      `mcp-app:${uri}`,\n      uri,\n      {\n        mimeType,\n        ...(res.csp ? { _meta: { ui: { csp: res.csp } } } : {}),\n      },\n      async (u) => {\n        const { html, csp } = await res.read();\n        return {\n          contents: [\n            {\n              uri: u.href,\n              mimeType,\n              text: html,\n              ...(csp ? { _meta: { ui: { csp } } } : {}),\n            },\n          ],\n        };\n      },\n    );\n  }\n  const transport = new StreamableHTTPServerTransport({\n    sessionIdGenerator: () => {\n      const sessionId = randomUUID();\n      void registerSession(\n        sessionId,\n        { credentialId: credential.credentialId, kind: credential.kind },\n        { server, transport },\n      );\n      return sessionId;\n    },\n    enableJsonResponse: true,\n    onsessionclosed: (closedId: string) => {\n      void import(\"./mcpTransportRegistry\").then(({ deleteSession }) =>\n        deleteSession(closedId),\n      );\n    },\n  });\n  return { server, transport, tools: catalog };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;;;ACChC,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAC9C,SAAS,kBAAkB;AAKpB,IAAM,uBAAuB;AAAA,EAClC,MAAM;AAAA,EACN,SAAS;AACX;AA0BA,eAAsB,mBAAmB,SAYf;AACxB,QAAM,EAAE,YAAY,SAAS,QAAQ,YAAY,IAAI;AACrD,QAAM,SAAS,IAAI,UAAU,sBAAsB;AAAA,IACjD,cAAc;AAAA;AAAA;AAAA,MAGZ,cAAc,EAAE,8BAA8B,CAAC,EAAE;AAAA,IACnD;AAAA,EACF,CAAC;AACD,aAAW,QAAQ,SAAS;AAC1B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,aAAa,KAAK;AAAA,QAClB,aAAa;AAAA,UACX,cAAc,KAAK,YAAY;AAAA,UAC/B,iBAAiB,KAAK,YAAY;AAAA,QACpC;AAAA,QACA,GAAI,KAAK,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,GAAG,YAAY,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E;AAAA,MACA,OAAO,SAAkB;AACvB,cAAM,SAAS,MAAM,OAAO,KAAK,UAAU,IAAI;AAC/C,eAAO,EAAE,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,eAAe,CAAC,GAAG;AAC1C,UAAM,WAAW,IAAI,YAAY;AACjC,WAAO;AAAA,MACL,WAAW,GAAG;AAAA,MACd;AAAA,MACA;AAAA,QACE;AAAA,QACA,GAAI,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,MACA,OAAO,MAAM;AACX,cAAM,EAAE,MAAM,IAAI,IAAI,MAAM,IAAI,KAAK;AACrC,eAAO;AAAA,UACL,UAAU;AAAA,YACR;AAAA,cACE,KAAK,EAAE;AAAA,cACP;AAAA,cACA,MAAM;AAAA,cACN,GAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,IAAI,8BAA8B;AAAA,IAClD,oBAAoB,MAAM;AACxB,YAAM,YAAY,WAAW;AAC7B,WAAK;AAAA,QACH;AAAA,QACA,EAAE,cAAc,WAAW,cAAc,MAAM,WAAW,KAAK;AAAA,QAC/D,EAAE,QAAQ,UAAU;AAAA,MACtB;AACA,aAAO;AAAA,IACT;AAAA,IACA,oBAAoB;AAAA,IACpB,iBAAiB,CAAC,aAAqB;AACrC,WAAK,OAAO,qCAAwB,EAAE;AAAA,QAAK,CAAC,EAAE,eAAAA,eAAc,MAC1DA,eAAc,QAAQ;AAAA,MACxB;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,EAAE,QAAQ,WAAW,OAAO,QAAQ;AAC7C;;;ADhFA,SAAS,cAAc,SAA6C;AAClE,QAAM,SAAS,QAAQ,QAAQ;AAC/B,MAAI,CAAC,QAAQ,WAAW,SAAS,EAAG,QAAO;AAC3C,SAAO,OAAO,MAAM,UAAU,MAAM,EAAE,KAAK,KAAK;AAClD;AAEA,SAAS,cAAc,SAA6C;AAClE,QAAM,MAAM,QAAQ,QAAQ,gBAAgB;AAC5C,QAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI;AAC5C,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAUA,SAAS,qBAAwC;AAC/C,SAAO;AAAA,IACL,OAAO,CAAC;AAAA,IACR,aAAa,oBAAI,IAAI;AAAA,IACrB,SAAS,MAAM;AAAA,IACf,UAAU;AAAA,IACV,QAAQ,OAAO,cAAc;AAAA,MAC3B,SAAS;AAAA,QACP,EAAE,MAAM,QAAQ,MAAM,yCAAyC,QAAQ,GAAG;AAAA,MAC5E;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAGA,IAAM,YAAY;AAAA,EAChB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,cAAc;AAChB;AAEO,SAAS,mBACd,KACA,OAAsB,CAAC,GACjB;AACN,QAAM,WACJ,KAAK,YACL,IAAI;AAAA,IACF,gBAAgB,WAAW,WAAW,EAAE;AAAA,IACxC,gBAAgB,WAAW,SAAS,EAAE;AAAA,EACxC;AACF,QAAM,eACJ,KAAK,iBAAiB,CAAC,QAAwB,IAAI;AACrD,QAAM,QACJ,KAAK,UACJ,MAAM;AACL,QAAI;AACF,YAAM,QAAQ,gBAAgB,WAAW,WAAW,EAAE;AACtD,aAAO,IAAI,iBAAiB,KAAK;AAAA,IACnC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AAEL,QAAM,cAAc,KAAK,eAAe,IAAI,gBAAgB;AAE5D,MAAI,KAAK,aAAa,OAAO,SAAyB,UAAwB;AAC5E,UAAM,UAAU,MAAM,SAAS,QAAQ,cAAc,OAAO,CAAC;AAC7D,QAAI,CAAC,SAAS;AACZ,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,cAAc,CAAC;AAAA,IACxD;AAEA,UAAM,OAAgB,QAAQ;AAC9B,UAAM,YAAY,cAAc,OAAO;AAIvC,QAAI,WAAW;AACb,YAAM,UAAU,MAAM,WAAW,SAAS;AAC1C,UACE,CAAC,WACD,QAAQ,WAAW,iBAAiB,QAAQ,cAC5C;AACA,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC9D;AACA,YAAM,OAAO;AACb,YAAM,QAAQ,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,IAAI;AAClE;AAAA,IACF;AAIA,QAAI,CAAC,oBAAoB,IAAI,GAAG;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAAA,IAC7D;AAEA,UAAM,SAAS,aAAa,OAAO;AACnC,UAAM,UAAU,MAAM,YAAY,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,CAAC;AAMnF,UAAM,kBAAkB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAC9D,UAAM,cACJ,KAAK,kBACJ,CAAC,UAAU,cAAc,sBACxB,uBAAuB,UAAU,cAAc,EAAE,kBAAkB,CAAC;AACxE,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,YAAY,QAAQ,UAAU,QAAQ,eAAe;AACpE,UAAI,OAAO,UAAU;AAInB,gBAAQ,IAAI;AAAA,UACV,EAAE,UAAU,QAAQ,SAAS;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAId,cAAQ,IAAI;AAAA,QACV,EAAE,UAAU,QAAQ,UAAU,KAAK,MAAM;AAAA,QACzC;AAAA,MACF;AACA,eAAS,mBAAmB;AAAA,IAC9B;AACA,UAAM,gBAAgB,iBAAiB,SAAS,OAAO,KAAK;AAC5D,UAAM,cAAc,IAAI,IAAI;AAAA,MAC1B,GAAG,gCAAgC,MAAM;AAAA,MACzC,GAAG,OAAO;AAAA,IACZ,CAAC;AACD,UAAM,QAAQ,MAAM,mBAAmB;AAAA,MACrC,YAAY,EAAE,cAAc,QAAQ,cAAc,MAAM,QAAQ,KAAK;AAAA,MACrE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,QAAQ,OAAO,UAAU,SAAS;AAChC,cAAM,YAAY,KAAK,IAAI;AAC3B,cAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,GAAG,GAAG,IAAI;AACvD,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI;AAExD,cAAM,WAAW,YAAY,MAAM,QAAQ,cAAc,WAAW;AACpE,YAAI,CAAC,SAAS,SAAS;AACrB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI;AAAA,cACF,6BAA6B,SAAS,gBAAgB,GAAI;AAAA,YAC5D;AAAA,YACA,EAAE,SAAS,UAAU,aAAa;AAAA,UACpC;AAAA,QACF;AAEA,YAAI;AACF,gBAAM,gBAAgB,OAAO,QAAQ,QAAQ,KAAK,CAAC,gBAAgB,IAAI,QAAQ;AAC/E,gBAAM,YAAqC;AAAA,YACzC,aAAa,QAAQ;AAAA,YACrB,cAAc,QAAQ;AAAA,YACtB,OAAO,QAAQ;AAAA,UACjB;AACA,gBAAM,SAAS,gBACX,MAAM,OAAO,OAAO,UAAU,MAAM;AAAA,YAClC,UAAU,QAAQ;AAAA,YAClB,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB;AAAA,UACF,CAAC,IACD,MAAM,YAAY;AAAA,YAChB;AAAA,YACA;AAAA,cACE,UAAU,QAAQ;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,aAAa,QAAQ;AAAA,cACrB;AAAA,YACF;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACJ,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ,OAAO,UAAU,UAAU;AAAA,YACnC,GAAI,OAAO,UAAU,EAAE,WAAW,kBAAkB,IAAI,CAAC;AAAA,YACzD,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,iBAAO;AAAA,QACT,SAAS,KAAK;AACZ,gBAAM,OACJ,eAAe,mBACX,UAAU,eACV,eAAe,sBACb,UAAU,mBACV,eAAe,kBACb,UAAU,oBACV,UAAU;AACpB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WACE,eAAe,mBACX,iBACA,eAAe,sBACb,qBACA,eAAe,kBACb,sBACA;AAAA,YACV,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YAC1D,EAAE,SAAS,KAAK;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAID,UAAM,MAAM,OAAO,QAAQ,MAAM,SAAS;AAC1C,UAAM,OAAO;AACb,UAAM,MAAM,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,IAAI;AAAA,EAClE,CAAC;AAED,MAAI;AAAA,IACF;AAAA,IACA,OAAO,SAAyB,UAAwB;AACtD,YAAM,YAAY,cAAc,OAAO;AACvC,UAAI,CAAC,WAAW;AACd,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAAA,MAC7D;AACA,YAAM,cAAc,SAAS;AAC7B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,IAChC;AAAA,EACF;AACF;","names":["deleteSession"]}

package/dist/{open-files-V3R2BFTV.mjs → open-files-FS5AN6Q6.mjs}

@@ -1,3 +1,6 @@
+import {
+  resolveContextSandbox
+} from "./chunk-PAKR5N7U.mjs";
 import {
   OpenAuditService,
   OpenCredentialService
@@ -5,9 +8,6 @@ import {
 import {
   openLattice
 } from "./chunk-HVIKCUOF.mjs";
-import {
-  resolveContextSandbox
-} from "./chunk-PAKR5N7U.mjs";
 import "./chunk-EXPERMZR.mjs";
 import "./chunk-NFEGQTCC.mjs";
 
@@ -143,4 +143,4 @@ function registerOpenFilesRoutes(app, deps = {}) {
 export {
   registerOpenFilesRoutes
 };
-//# sourceMappingURL=open-files-V3R2BFTV.mjs.map
+//# sourceMappingURL=open-files-FS5AN6Q6.mjs.map

package/dist/openRateLimiter-XEOL3A5G.mjs

@@ -0,0 +1,8 @@
+import {
+  OpenRateLimiter
+} from "./chunk-GXZFO3VU.mjs";
+import "./chunk-NFEGQTCC.mjs";
+export {
+  OpenRateLimiter
+};
+//# sourceMappingURL=openRateLimiter-XEOL3A5G.mjs.map

package/dist/openRateLimiter-XEOL3A5G.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/gateway",
-  "version": "4.10.0",
+  "version": "4.10.2",
   "main": "dist/index.js",
   "files": [
     "dist"
@@ -50,8 +50,8 @@
     "web-push": "^3.6.7",
     "zod": "3.25.76",
     "@axiom-lattice/cli-a2a": "0.2.21",
-    "@axiom-lattice/core": "7.0.1",
-    "@axiom-lattice/pg-stores": "3.3.7",
+    "@axiom-lattice/core": "7.0.2",
+    "@axiom-lattice/pg-stores": "3.3.8",
     "@axiom-lattice/protocols": "4.9.0",
     "@axiom-lattice/queue-redis": "1.1.21"
   },
@@ -77,7 +77,7 @@
     "tsup": "^8.5.0",
     "typescript": "^5.8.2",
     "@axiom-lattice/open-mcp-client": "0.1.0",
-    "@axiom-lattice/react-sdk": "4.10.0"
+    "@axiom-lattice/react-sdk": "4.11.1"
   },
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean --sourcemap && pnpm copy:embed-assets",

package/dist/embed/embed-page-chunk-NR2PTMJ6.js

@@ -1,2 +0,0 @@
-import{M as G,a as de,b as le,r as ce,sb as Ae,ta as ue,tb as ge,ua as q,wa as me,ya as fe}from"./embed-page-chunk-OY4CDWED.js";import{a as S,e as L,f as ne,g as oe,n as ae,r as x,s as ie,v as se,z as pe}from"./embed-page-chunk-H4W4NDIY.js";import{a as M}from"./embed-page-chunk-QV7QAJ4N.js";import{i as V,j as $e,k as Ue,l as Ne,m as Oe}from"./embed-page-chunk-QULNM5O2.js";import{M as te,va as re}from"./embed-page-chunk-MHGVD4EV.js";import{a as ee}from"./embed-page-chunk-R5QL57JJ.js";import{c as T,f as R}from"./embed-page-chunk-QBTAJ2YI.js";var Te=T(O=>{"use strict";Object.defineProperty(O,"__esModule",{value:!0});O.default=void 0;var ot={items_per_page:"\u6761/\u9875",jump_to:"\u8DF3\u81F3",jump_to_confirm:"\u786E\u5B9A",page:"\u9875",prev_page:"\u4E0A\u4E00\u9875",next_page:"\u4E0B\u4E00\u9875",prev_5:"\u5411\u524D 5 \u9875",next_5:"\u5411\u540E 5 \u9875",prev_3:"\u5411\u524D 3 \u9875",next_3:"\u5411\u540E 3 \u9875",page_size:"\u9875\u7801"},Qt=O.default=ot});var Pe=T(j=>{"use strict";var at=$e().default;Object.defineProperty(j,"__esModule",{value:!0});j.default=void 0;var ke=at(Ue()),it=Ne(),st=(0,ke.default)((0,ke.default)({},it.commonLocale),{},{locale:"zh_CN",today:"\u4ECA\u5929",now:"\u6B64\u523B",backToToday:"\u8FD4\u56DE\u4ECA\u5929",ok:"\u786E\u5B9A",timeSelect:"\u9009\u62E9\u65F6\u95F4",dateSelect:"\u9009\u62E9\u65E5\u671F",weekSelect:"\u9009\u62E9\u5468",clear:"\u6E05\u9664",week:"\u5468",month:"\u6708",year:"\u5E74",previousMonth:"\u4E0A\u4E2A\u6708 (\u7FFB\u9875\u4E0A\u952E)",nextMonth:"\u4E0B\u4E2A\u6708 (\u7FFB\u9875\u4E0B\u952E)",monthSelect:"\u9009\u62E9\u6708\u4EFD",yearSelect:"\u9009\u62E9\u5E74\u4EFD",decadeSelect:"\u9009\u62E9\u5E74\u4EE3",previousYear:"\u4E0A\u4E00\u5E74 (Control\u952E\u52A0\u5DE6\u65B9\u5411\u952E)",nextYear:"\u4E0B\u4E00\u5E74 (Control\u952E\u52A0\u53F3\u65B9\u5411\u952E)",previousDecade:"\u4E0A\u4E00\u5E74\u4EE3",nextDecade:"\u4E0B\u4E00\u5E74\u4EE3",previousCentury:"\u4E0A\u4E00\u4E16\u7EAA",nextCentury:"\u4E0B\u4E00\u4E16\u7EAA",yearFormat:"YYYY\u5E74",cellDateFormat:"D",monthBeforeYear:!1}),Vt=j.default=st});var K=T(F=>{"use strict";Object.defineProperty(F,"__esModule",{value:!0});F.default=void 0;var dt={placeholder:"\u8BF7\u9009\u62E9\u65F6\u95F4",rangePlaceholder:["\u5F00\u59CB\u65F6\u95F4","\u7ED3\u675F\u65F6\u95F4"]},Yt=F.default=dt});var Y=T(H=>{"use strict";var Ie=V().default;Object.defineProperty(H,"__esModule",{value:!0});H.default=void 0;var lt=Ie(Pe()),pt=Ie(K()),We={lang:Object.assign({placeholder:"\u8BF7\u9009\u62E9\u65E5\u671F",yearPlaceholder:"\u8BF7\u9009\u62E9\u5E74\u4EFD",quarterPlaceholder:"\u8BF7\u9009\u62E9\u5B63\u5EA6",monthPlaceholder:"\u8BF7\u9009\u62E9\u6708\u4EFD",weekPlaceholder:"\u8BF7\u9009\u62E9\u5468",rangePlaceholder:["\u5F00\u59CB\u65E5\u671F","\u7ED3\u675F\u65E5\u671F"],rangeYearPlaceholder:["\u5F00\u59CB\u5E74\u4EFD","\u7ED3\u675F\u5E74\u4EFD"],rangeMonthPlaceholder:["\u5F00\u59CB\u6708\u4EFD","\u7ED3\u675F\u6708\u4EFD"],rangeQuarterPlaceholder:["\u5F00\u59CB\u5B63\u5EA6","\u7ED3\u675F\u5B63\u5EA6"],rangeWeekPlaceholder:["\u5F00\u59CB\u5468","\u7ED3\u675F\u5468"]},lt.default),timePickerLocale:Object.assign({},pt.default)};We.lang.ok="\u786E\u5B9A";var Zt=H.default=We});var _e=T(B=>{"use strict";var ct=V().default;Object.defineProperty(B,"__esModule",{value:!0});B.default=void 0;var ut=ct(Y()),tr=B.default=ut.default});var xe=T(X=>{"use strict";var z=V().default;Object.defineProperty(X,"__esModule",{value:!0});X.default=void 0;var mt=z(Te()),ft=z(_e()),At=z(Y()),gt=z(K()),y="${label}\u4E0D\u662F\u4E00\u4E2A\u6709\u6548\u7684${type}",ht={locale:"zh-cn",Pagination:mt.default,DatePicker:At.default,TimePicker:gt.default,Calendar:ft.default,global:{placeholder:"\u8BF7\u9009\u62E9",close:"\u5173\u95ED"},Table:{filterTitle:"\u7B5B\u9009",filterConfirm:"\u786E\u5B9A",filterReset:"\u91CD\u7F6E",filterEmptyText:"\u65E0\u7B5B\u9009\u9879",filterCheckAll:"\u5168\u9009",filterSearchPlaceholder:"\u5728\u7B5B\u9009\u9879\u4E2D\u641C\u7D22",emptyText:"\u6682\u65E0\u6570\u636E",selectAll:"\u5168\u9009\u5F53\u9875",selectInvert:"\u53CD\u9009\u5F53\u9875",selectNone:"\u6E05\u7A7A\u6240\u6709",selectionAll:"\u5168\u9009\u6240\u6709",sortTitle:"\u6392\u5E8F",expand:"\u5C55\u5F00\u884C",collapse:"\u5173\u95ED\u884C",triggerDesc:"\u70B9\u51FB\u964D\u5E8F",triggerAsc:"\u70B9\u51FB\u5347\u5E8F",cancelSort:"\u53D6\u6D88\u6392\u5E8F"},Modal:{okText:"\u786E\u5B9A",cancelText:"\u53D6\u6D88",justOkText:"\u77E5\u9053\u4E86"},Tour:{Next:"\u4E0B\u4E00\u6B65",Previous:"\u4E0A\u4E00\u6B65",Finish:"\u7ED3\u675F\u5BFC\u89C8"},Popconfirm:{cancelText:"\u53D6\u6D88",okText:"\u786E\u5B9A"},Transfer:{titles:["",""],searchPlaceholder:"\u8BF7\u8F93\u5165\u641C\u7D22\u5185\u5BB9",itemUnit:"\u9879",itemsUnit:"\u9879",remove:"\u5220\u9664",selectCurrent:"\u5168\u9009\u5F53\u9875",removeCurrent:"\u5220\u9664\u5F53\u9875",selectAll:"\u5168\u9009\u6240\u6709",deselectAll:"\u53D6\u6D88\u5168\u9009",removeAll:"\u5220\u9664\u5168\u90E8",selectInvert:"\u53CD\u9009\u5F53\u9875"},Upload:{uploading:"\u6587\u4EF6\u4E0A\u4F20\u4E2D",removeFile:"\u5220\u9664\u6587\u4EF6",uploadError:"\u4E0A\u4F20\u9519\u8BEF",previewFile:"\u9884\u89C8\u6587\u4EF6",downloadFile:"\u4E0B\u8F7D\u6587\u4EF6"},Empty:{description:"\u6682\u65E0\u6570\u636E"},Icon:{icon:"\u56FE\u6807"},Text:{edit:"\u7F16\u8F91",copy:"\u590D\u5236",copied:"\u590D\u5236\u6210\u529F",expand:"\u5C55\u5F00",collapse:"\u6536\u8D77"},Form:{optional:"\uFF08\u53EF\u9009\uFF09",defaultValidateMessages:{default:"\u5B57\u6BB5\u9A8C\u8BC1\u9519\u8BEF${label}",required:"\u8BF7\u8F93\u5165${label}",enum:"${label}\u5FC5\u987B\u662F\u5176\u4E2D\u4E00\u4E2A[${enum}]",whitespace:"${label}\u4E0D\u80FD\u4E3A\u7A7A\u5B57\u7B26",date:{format:"${label}\u65E5\u671F\u683C\u5F0F\u65E0\u6548",parse:"${label}\u4E0D\u80FD\u8F6C\u6362\u4E3A\u65E5\u671F",invalid:"${label}\u662F\u4E00\u4E2A\u65E0\u6548\u65E5\u671F"},types:{string:y,method:y,array:y,object:y,number:y,date:y,boolean:y,integer:y,float:y,regexp:y,email:y,url:y,hex:y},string:{len:"${label}\u987B\u4E3A${len}\u4E2A\u5B57\u7B26",min:"${label}\u6700\u5C11${min}\u4E2A\u5B57\u7B26",max:"${label}\u6700\u591A${max}\u4E2A\u5B57\u7B26",range:"${label}\u987B\u5728${min}-${max}\u5B57\u7B26\u4E4B\u95F4"},number:{len:"${label}\u5FC5\u987B\u7B49\u4E8E${len}",min:"${label}\u6700\u5C0F\u503C\u4E3A${min}",max:"${label}\u6700\u5927\u503C\u4E3A${max}",range:"${label}\u987B\u5728${min}-${max}\u4E4B\u95F4"},array:{len:"\u987B\u4E3A${len}\u4E2A${label}",min:"\u6700\u5C11${min}\u4E2A${label}",max:"\u6700\u591A${max}\u4E2A${label}",range:"${label}\u6570\u91CF\u987B\u5728${min}-${max}\u4E4B\u95F4"},pattern:{mismatch:"${label}\u4E0E\u6A21\u5F0F\u4E0D\u5339\u914D${pattern}"}}},Image:{preview:"\u9884\u89C8"},QRCode:{expired:"\u4E8C\u7EF4\u7801\u8FC7\u671F",refresh:"\u70B9\u51FB\u5237\u65B0",scanned:"\u5DF2\u626B\u63CF"},ColorPicker:{presetEmpty:"\u6682\u65E0",transparent:"\u65E0\u8272",singleColor:"\u5355\u8272",gradientColor:"\u6E10\u53D8\u8272"}},nr=X.default=ht});var Le=T((ar,ve)=>{"use strict";ve.exports=xe()});var m=R(ee());var g=class extends Error{code;retryable;status;constructor(t,r,n,a){super(r),this.name="AgentWebAppRuntimeClientError",this.code=t,this.retryable=n,this.status=a}};function k(){return new g("STREAM_FAILED","Stream failed",!0)}var je=new Set(["WEB_APP_NOT_FOUND","WEB_APP_DISABLED","USER_ID_REQUIRED","INVALID_USER_ID","PROJECT_NOT_ALLOWED","PROJECT_SELECTOR_DISABLED","MODEL_NOT_ALLOWED","FEATURE_DISABLED","THREAD_NOT_FOUND","STREAM_CONFLICT","STREAM_FAILED","INVALID_REQUEST","INTERNAL_ERROR"]);function P(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function w(e,t){return Object.keys(e).length===t.length&&t.every(n=>n in e)}function Fe(e){return P(e)&&w(e,["code","message","retryable"])&&typeof e.code=="string"&&je.has(e.code)&&typeof e.message=="string"&&typeof e.retryable=="boolean"}function He(e){if(!P(e))return!1;let t=e.data===void 0?["id","type","prompt"]:["id","type","prompt","data"];return w(e,t)&&typeof e.id=="string"&&typeof e.type=="string"&&typeof e.prompt=="string"&&(e.data===void 0||P(e.data))}var Be=new Set([S.HUMAN,S.AI,S.TOOL,S.INTERRUPT,S.MESSAGE_COMPLETED,S.MESSAGE_FAILED,S.THREAD_IDLE]);function ze(e,t){let r;try{r=JSON.parse(e)}catch{throw k()}if(!P(r)||typeof r.type!="string")throw k();if(Be.has(r.type)||r.type==="error"&&P(r.data)&&!P(r.error)){let n=oe(r,t);return n.length===0?[]:n}switch(r.type){case"message.delta":if(w(r,["type","text"])&&typeof r.text=="string")return[r];break;case"message.completed":if(w(r,["type","messageId"])&&typeof r.messageId=="string")return[r];break;case"tool.started":if(w(r,["type","id","name"])&&typeof r.id=="string"&&typeof r.name=="string")return[r];break;case"tool.completed":if(w(r,["type","id"])&&typeof r.id=="string")return[r];break;case"interrupt.created":if(w(r,["type","interrupt"])&&He(r.interrupt))return[r];break;case"genui.render":if(w(r,["type","block"])&&L(r.block))return[r];break;case"error":if(w(r,["type","error"])&&Fe(r.error))return[r];break;case"stream.completed":if(w(r,["type"]))return[r];break}throw k()}function Xe(e){return e instanceof Error&&e.name==="AbortError"}async function he(e,t){let r=ne({allowGenUI:!0,allowInterrupts:!0}),n=e.getReader(),a=new TextDecoder,o="",i=!1,d=!1;try{for(;!i;){let l;try{l=await n.read()}catch(p){if(Xe(p))return;throw k()}l.done&&(d=!0);try{o+=a.decode(l.value,{stream:!l.done})}catch{throw k()}let C=o.split(/\r?\n\r?\n/);o=l.done?"":C.pop()??"";for(let p of C){let A=p.split(/\r?\n/).filter(u=>u==="data"||u.startsWith("data:")).map(u=>u==="data"?"":u.slice(5).replace(/^ /,""));if(A.length!==0){for(let u of ze(A.join(`
-`),r))if(await t(u),i=u.type==="stream.completed",i)break;if(i)break}}if(l.done)break}if(!i)throw k()}finally{if(!d)try{await n.cancel()}catch{}n.releaseLock()}}var Qe=new Set(["WEB_APP_NOT_FOUND","WEB_APP_DISABLED","USER_ID_REQUIRED","INVALID_USER_ID","PROJECT_NOT_ALLOWED","PROJECT_SELECTOR_DISABLED","MODEL_NOT_ALLOWED","FEATURE_DISABLED","THREAD_NOT_FOUND","STREAM_CONFLICT","STREAM_FAILED","INVALID_REQUEST","INTERNAL_ERROR"]);function f(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function h(e,t,r=[]){let n=Object.keys(e);return t.every(a=>a in e)&&n.every(a=>t.includes(a)||r.includes(a))}function s(e){return typeof e=="string"}function D(e){if(!f(e)||!h(e,["id","projectId","createdAt","updatedAt"],["label"])||!s(e.id)||!s(e.projectId)||e.label!==void 0&&!s(e.label)||!s(e.createdAt)||!s(e.updatedAt))return;let t=new Date(e.createdAt),r=new Date(e.updatedAt);if(!(Number.isNaN(t.getTime())||Number.isNaN(r.getTime())))return{id:e.id,projectId:e.projectId,...e.label===void 0?{}:{label:e.label},createdAt:t,updatedAt:r}}function be(e){if(!f(e)||e.success!==!1||!f(e.error))return!1;let t=e.error;return h(e,["success","error"])&&h(t,["code","message","retryable"])&&typeof t.code=="string"&&Qe.has(t.code)&&typeof t.message=="string"&&typeof t.retryable=="boolean"}function Ge(e){if(!f(e))return!1;let t=["projectSelector","modelSelector","threadManagement","attachments","hitl","genUI"];return h(e,t,["files"])&&t.every(r=>typeof e[r]=="boolean")&&(e.files===void 0||typeof e.files=="boolean")}function Ve(e){return Array.isArray(e)&&e.length<=6&&e.every(t=>f(t)&&h(t,["label","text"])&&s(t.label)&&t.label.length>=1&&t.label.length<=40&&s(t.text)&&t.text.length>=1&&t.text.length<=500)}function Ke(e){return f(e)&&h(e,[],["title","welcomeMessage","primaryColor","quickPrompts"])&&(e.title===void 0||s(e.title))&&(e.welcomeMessage===void 0||s(e.welcomeMessage))&&(e.primaryColor===void 0||s(e.primaryColor))&&(e.quickPrompts===void 0||Ve(e.quickPrompts))}function Ye(e){if(!f(e)||!h(e,["webApp","projects","models"],["thread"])||!f(e.webApp))return;let t=e.webApp;if(!h(t,["id","name","assistant","defaultProjectId","features","appearance","identityAssurance"],["description","defaultModelKey"])||!s(t.id)||!s(t.name)||!s(t.defaultProjectId)||t.description!==void 0&&!s(t.description)||t.defaultModelKey!==void 0&&!s(t.defaultModelKey)||t.identityAssurance!=="unverified"||!f(t.assistant)||!h(t.assistant,["id","name"],["description"])||!s(t.assistant.id)||!s(t.assistant.name)||t.assistant.description!==void 0&&!s(t.assistant.description)||!Ge(t.features)||!Ke(t.appearance)||!Array.isArray(e.projects)||!e.projects.every(n=>f(n)&&h(n,["id","name"])&&s(n.id)&&s(n.name))||!Array.isArray(e.models)||!e.models.every(n=>f(n)&&h(n,["key","label"])&&s(n.key)&&s(n.label)))return;let r=e.thread===void 0?void 0:D(e.thread);if(!(e.thread!==void 0&&!r))return{...e,...r?{thread:r}:{}}}function Je(e){if(!f(e)||!h(e,["records","total"])||!Array.isArray(e.records)||typeof e.total!="number")return;let t=e.records.map(D);return t.every(r=>r!==void 0)?{records:t,total:e.total}:void 0}function Ze(e){return f(e)&&s(e.id)&&(e.role==="human"||e.role==="ai")&&(e.content===void 0||s(e.content)||Array.isArray(e.content)&&e.content.every(t=>L(t)!==void 0))}function et(e){return f(e)&&h(e,["messages"])&&Array.isArray(e.messages)&&e.messages.every(Ze)?e:void 0}function tt(e){return f(e)&&h(e,["ref","name","mimeType","size"])&&s(e.ref)&&s(e.name)&&s(e.mimeType)&&typeof e.size=="number"?e:void 0}function ye(e,t){return r=>f(r)&&h(r,e)&&t(r)?r:void 0}var $=class{constructor(t){this.options=t;this.baseUrl=`${t.gatewayUrl.replace(/\/+$/,"")}/api/web-apps/${encodeURIComponent(t.webAppId)}/runtime`,this.fetchImplementation=t.fetch??globalThis.fetch.bind(globalThis),this.translate=t.translate}baseUrl;fetchImplementation;translate;async bootstrap(t={},r){return this.request("bootstrap",Ye,{query:t,signal:r})}async listThreads(t={},r){return this.request("threads",Je,{query:t,signal:r})}async createThread(t={},r){return this.request("threads",D,{method:"POST",body:t,signal:r})}async updateThread(t,r,n){return this.request(`threads/${encodeURIComponent(t)}`,D,{method:"PATCH",body:r,signal:n})}async deleteThread(t,r={},n){await this.request(`threads/${encodeURIComponent(t)}`,ye(["id"],a=>s(a.id)),{method:"DELETE",query:r,signal:n})}async getMessages(t,r={},n){return this.request(`threads/${encodeURIComponent(t)}/messages`,et,{query:r,signal:n})}async streamMessage(t,r,n,a){return this.streamRequest(`threads/${encodeURIComponent(t)}/messages/stream`,r,n,a)}async resumeInterrupt(t,r,n,a,o){return this.streamRequest(`threads/${encodeURIComponent(t)}/interrupts/${encodeURIComponent(r)}/resume`,n,a,o)}async streamRequest(t,r,n,a){let o;try{o=await this.fetchRequest(t,{method:"POST",body:r,signal:a})}catch(i){throw Ce(i)||i instanceof g?i:new g("STREAM_FAILED",this.translate?.("integration.error.streamFailed")??"Stream failed",!0)}if(o.ok||await this.throwResponseError(o),!o.body||!o.headers.get("content-type")?.toLowerCase().includes("text/event-stream")){if(o.body)try{await o.body.cancel()}catch{}throw new g("STREAM_FAILED",this.translate?.("integration.error.streamFailed")??"Stream failed",!0,o.status)}await he(o.body,n)}async abort(t,r={},n){await this.request(`threads/${encodeURIComponent(t)}/abort`,ye(["aborted"],a=>typeof a.aborted=="boolean"),{method:"POST",query:r,signal:n})}async uploadAttachment(t,r,n={},a){let o=new FormData,i=typeof File<"u"&&r instanceof File?r.name:"attachment";return o.append("file",r,i),this.request(`threads/${encodeURIComponent(t)}/attachments`,tt,{method:"POST",query:n,body:o,signal:a})}async request(t,r,n={}){let a;try{a=await this.fetchRequest(t,n)}catch(d){throw Ce(d)||d instanceof g?d:new g("INTERNAL_ERROR",this.translate?.("integration.error.requestFailed")??"Request failed",!0)}let o;try{o=await a.json()}catch{throw this.internalError(a.status)}if(be(o))throw new g(o.error.code,o.error.message,o.error.retryable,a.status);if(!a.ok||!f(o)||!h(o,["success","data"])||o.success!==!0)throw this.internalError(a.status);let i=r(o.data);if(i===void 0)throw this.internalError(a.status);return i}async fetchRequest(t,r){let n=await this.options.identityProvider.getIdentity(r.signal),a=new URL(`${this.baseUrl}/${t}`);for(let[d,l]of Object.entries(r.query??{}))l!==void 0&&a.searchParams.set(d,l);let o=new Headers;n.bearerToken!==void 0?o.set("Authorization",`Bearer ${n.bearerToken}`):o.set("X-Axiom-External-User-Id",n.externalUserId??"");let i;return r.body instanceof FormData?i=r.body:r.body!==void 0&&(o.set("Content-Type","application/json"),i=JSON.stringify(r.body)),this.fetchImplementation(a,{method:r.method??"GET",headers:o,body:i,signal:r.signal,credentials:"omit"})}async throwResponseError(t){let r;try{r=await t.json()}catch{throw this.internalError(t.status)}throw be(r)?new g(r.error.code,r.error.message,r.error.retryable,t.status):this.internalError(t.status)}internalError(t){return new g("INTERNAL_ERROR",this.translate?.("integration.error.invalidServerResponse")??"Invalid server response",!1,t)}};function Ce(e){return typeof e=="object"&&e!==null&&"name"in e&&e.name==="AbortError"}var U=R(ee());var I=R(M());function we(){let e=x(),{createThread:t}=q(),{menuCollapsed:r,setMenuCollapsed:n}=me();(0,U.useEffect)(()=>{r===void 0&&n(!0)},[r,n]);let a=(0,U.useCallback)(async()=>{try{await t(e("integration.sidebar.newThread"))}catch(p){console.error("Failed to create new thread:",p)}},[t,e]),o=r??!0,i={id:"new-analysis",builtin:"new-analysis",type:"action",name:e("integration.sidebar.newThread"),icon:(0,I.jsx)(ce,{size:20}),order:0},d={id:"thread-history-toggle",type:"action",name:e("integration.sidebar.history"),icon:(0,I.jsx)(G,{size:20}),order:1},l={id:"thread-history",builtin:"thread-history",type:"drawer",name:e("integration.sidebar.history"),icon:(0,I.jsx)(G,{size:20}),order:1,title:e("integration.sidebar.historyTitle"),width:320,inline:!0,inlineDefaultExpanded:!0,content:(0,I.jsx)(Ae,{})},C=[i,...o?[d]:[l]];return(0,I.jsx)(fe,{items:C,showBranding:!1,showToggle:!0,showNewAnalysis:!1,defaultExpanded:!o,collapsed:o,onCollapsedChange:n,onNewAnalysis:a,onItemClick:p=>{p.type==="action"&&p.builtin==="new-analysis"?a():p.type==="action"&&p.id==="thread-history-toggle"&&n(!1)}},o?"agent-chat-sidebar-collapsed":"agent-chat-sidebar-expanded")}function Ee(e){if(typeof window>"u"||typeof XMLHttpRequest>"u")return()=>{};let t=`${e.gatewayUrl.replace(/\/+$/,"")}/api/web-apps/${encodeURIComponent(e.webAppId)}/runtime/`,r=XMLHttpRequest.prototype.open,n=XMLHttpRequest.prototype.send,a=new WeakMap;return XMLHttpRequest.prototype.open=function(i,d){a.set(this,String(d)),r.call(this,i,d,!0)},XMLHttpRequest.prototype.send=function(i){let d=a.get(this)??"";if(!d.startsWith(t)||!/\/sandbox\/uploadfile$/.test(d)){n.call(this,i);return}if(e.identity.mode==="unverified"){this.setRequestHeader("X-Axiom-External-User-Id",e.identity.userId),n.call(this,i);return}e.identity.tokenProvider().then(l=>{this.setRequestHeader("Authorization",`Bearer ${l}`),n.call(this,i)}).catch(()=>{n.call(this,i)})},()=>{XMLHttpRequest.prototype.open=r,XMLHttpRequest.prototype.send=n}}var rt=/^#[0-9A-Fa-f]{6}$/;function nt(e){return typeof e=="string"&&rt.test(e)}function Re(e){return nt(e)?e:void 0}function N(e,t){let r=parseInt(e.replace("#",""),16),n=Math.round(2.55*t),a=(r>>16)+n,o=(r>>8&255)+n,i=(r&255)+n;return"#"+(16777216+(a<255?a<1?0:a:255)*65536+(o<255?o<1?0:o:255)*256+(i<255?i<1?0:i:255)).toString(16).slice(1)}function Se(e){if(e!==void 0)return{token:{colorPrimary:e,colorPrimaryHover:N(e,20),colorPrimaryActive:N(e,-15),colorPrimaryBg:N(e,45)+"20"}}}var Me=R(Oe()),qe=R(Le()),c=R(M()),bt={"en-US":Me.default,"zh-CN":qe.default};function yt(e,t){let r=J(e.welcome),n=J(t.title),a=r??J(t.welcomeMessage),o=e.quickPrompts??t.quickPrompts??[],i=Re(t.primaryColor);return{...n!==void 0?{title:n}:{},...a!==void 0?{welcome:a}:{},quickPrompts:o,...i!==void 0?{primaryColor:i}:{}}}function J(e){return typeof e=="string"&&e.length>0?e:void 0}function Ct(e){if(!e.gatewayUrl.trim())throw new Error("AgentChatApp requires gatewayUrl");try{new URL(e.gatewayUrl)}catch{throw new Error("AgentChatApp gatewayUrl must be a valid URL")}if(!e.webAppId.trim())throw new Error("AgentChatApp requires webAppId");if(e.identity.mode==="unverified"){if(!e.identity.userId.trim())throw new Error("AgentChatApp requires identity.userId")}else if(typeof e.identity.tokenProvider!="function")throw new Error("AgentChatApp requires identity.tokenProvider");if(!e.fetch&&typeof globalThis.fetch!="function")throw new Error("AgentChatApp requires a fetch implementation")}function wt(e,t){return e instanceof g?e:new g("INTERNAL_ERROR",t("integration.error.requestFailed"),!0)}function Et(e){return e.mode==="unverified"?`unverified:${e.userId}`:"verified:token"}function wr(e){Ct(e);let t=`${e.gatewayUrl}\0${e.webAppId}\0${Et(e.identity)}`;return(0,c.jsx)(ie,{locale:e.locale,children:(0,c.jsx)(Rt,{...e},t)})}function Rt({gatewayUrl:e,webAppId:t,identity:r,onError:n,onChatReady:a,onChatMessage:o,fetch:i,className:d,welcome:l,quickPrompts:C,locale:p="en-US"}){let A=x(),[u,E]=(0,m.useState)({status:"loading"}),v=(0,m.useRef)(r);v.current=r;let W=(0,m.useRef)(n);W.current=n;let _=(0,m.useRef)();return _.current||(_.current=new $({gatewayUrl:e,webAppId:t,identityProvider:{getIdentity:async()=>{let b=v.current;if(b.mode!=="verified")return{externalUserId:b.userId};try{return{bearerToken:await b.tokenProvider()}}catch{throw new g("USER_ID_REQUIRED",A("integration.error.identityTokenFailed"),!0)}}},translate:A,...i?{fetch:i}:{}})),(0,m.useEffect)(()=>Ee({gatewayUrl:e,webAppId:t,identity:r}),[e,t,r]),(0,m.useEffect)(()=>{let b=!1,De=_.current;return(async()=>{try{let Q=await De.bootstrap({});if(b)return;E({status:"ready",bootstrap:Q})}catch(Q){if(b)return;let Z=wt(Q,A);E({status:"error",error:Z}),W.current?.(Z)}})(),()=>{b=!0}},[]),u.status==="loading"?(0,c.jsx)("div",{className:d}):u.status==="error"?(0,c.jsxs)("div",{className:d,role:"alert",children:[(0,c.jsx)("strong",{children:A("integration.chat.loadFailed")}),(0,c.jsx)("div",{children:u.error.code}),(0,c.jsx)("button",{type:"button",onClick:()=>E({status:"loading"}),children:A("common.retry")})]}):(0,c.jsx)(Tt,{className:d,gatewayUrl:e,webAppId:t,identity:r,bootstrap:u.bootstrap,onChatReady:a,onChatMessage:o,welcome:l,quickPrompts:C,locale:p})}function St(e){return{id:e.id,name:e.name,...e.description!==void 0?{description:e.description}:{},graphDefinition:void 0,createdAt:new Date(0),updatedAt:new Date(0)}}function Tt({gatewayUrl:e,webAppId:t,identity:r,bootstrap:n,onChatReady:a,onChatMessage:o,className:i,welcome:d,quickPrompts:l,locale:C="en-US"}){let p=(0,m.useMemo)(()=>St(n.webApp.assistant),[n.webApp.assistant]),A=(0,m.useMemo)(()=>yt({welcome:d,quickPrompts:l},n.webApp.appearance),[d,l,n.webApp.appearance]),u=(0,m.useMemo)(()=>Se(A.primaryColor),[A.primaryColor]),E=(0,m.useMemo)(()=>r.mode==="unverified"?{mode:"unverified",userId:r.userId}:{mode:"verified",tokenProvider:r.tokenProvider},[r]),v=(0,m.useCallback)(b=>new ae({gatewayUrl:e,webAppId:t,identity:E,assistantId:b.assistantId,transport:b.transport,...b.timeout!==void 0?{timeout:b.timeout}:{},...b.headers!==void 0?{headers:b.headers}:{}}),[e,t,E]),W=(0,m.useMemo)(()=>({baseURL:`${e.replace(/\/$/,"")}/api/web-apps/${t}/runtime`,apiKey:"",transport:"sse",assistantId:p.id,enableSkillSlot:!1,enableDatabaseSlot:!1,enableAgentSlot:!1,enableMetricsDataSourceSlot:!1,enableModelSelector:!1,enableWorkspace:!1,enableCustomMenu:!1,showSideMenu:!1,enableAssistantCreation:!1,enableAssistantEditing:!1,enableThreadCreation:!0,enableThreadList:!0}),[p.id,e,t]),_=(0,m.useMemo)(()=>({assistants:[p],currentAssistant:p,isLoading:!1,error:null,listAssistants:async()=>{},getAssistant:async()=>p,createAssistant:async()=>{throw new Error("Not implemented in a Web App")},updateAssistant:async()=>{throw new Error("Not implemented in a Web App")},deleteAssistant:async()=>{},selectAssistant:async()=>{},clearCurrentAssistant:()=>{},refresh:async()=>{}}),[p]);return(0,c.jsx)(te,{theme:u,locale:bt[C],children:(0,c.jsx)(se,{config:{baseURL:W.baseURL,apiKey:"",assistantId:"__BASE__",transport:"sse"},createClient:v,children:(0,c.jsx)(pe,{initialConfig:W,persistToLocalStorage:!1,children:(0,c.jsx)(de.Provider,{value:_,children:(0,c.jsx)(ue,{children:(0,c.jsx)(kt,{className:i,onChatReady:a,onChatMessage:o,title:A.title,welcome:A.welcome,quickPrompts:A.quickPrompts})})})})})})}function kt({className:e,onChatReady:t,onChatMessage:r,title:n,welcome:a,quickPrompts:o=[]}){let i=x(),{threadId:d}=q(),{currentAssistant:l}=le();if(!l)return null;let C=d??"";if(!C)return(0,c.jsx)("div",{style:{display:"flex",alignItems:"center",justifyContent:"center",height:"100%"},children:(0,c.jsx)(re,{tip:i("integration.chat.creatingConversation")})});let p=n??a,A=n!==void 0&&a!==void 0?a:"";return(0,c.jsx)("div",{className:e,children:(0,c.jsx)(ge,{thread_id:C,assistant_id:l.id,name:l.name,description:l.description,menu:(0,c.jsx)(we,{}),showProjectSelector:!1,showSkillSlot:!1,showDatabaseSlot:!1,showAgentSlot:!1,showMetricsDataSourceSlot:!1,headerRight:null,emptyStateGreeting:p?(0,c.jsx)("span",{children:p}):void 0,emptyStateQuestion:A,senderPromptsItems:o.length>0?o.map((u,E)=>({key:`quick-${E}`,label:u.label,description:u.text})):void 0,showSkillPrompts:!1,showQuickAnalysis:!1,onChatReady:t,onChatMessage:r})})}export{rt as a,wr as b};

package/dist/open-FJ3BY3CL.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/routes/open.ts","../src/services/open/openRateLimiter.ts","../src/services/open/openMcpServer.ts"],"sourcesContent":["/**\n * Open API surface routes: POST/DELETE /open/mcp.\n *\n * The route is a thin shell — credential resolution (OpenAuthService),\n * catalog filtering and invocation (OpenLattice), and session lifecycle\n * (mcpTransportRegistry) live in services/open/*. The transport writes the\n * response itself, so the reply is hijacked (same precedent as the Project\n * Room SSE route).\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { isInitializeRequest } from \"@modelcontextprotocol/sdk/types.js\";\nimport { getStoreLattice } from \"@axiom-lattice/core\";\nimport type { A2AApiKeyStore, OpenAuditStore, OpenGrant, ProjectStore } from \"@axiom-lattice/protocols\";\nimport { OpenCredentialService } from \"../services/open/openCredentialService\";\nimport { OpenAuditService } from \"../services/open/openAuditService\";\nimport { OpenRateLimiter } from \"../services/open/openRateLimiter\";\nimport type { OpenCredential } from \"../services/open/openCredentialService\";\nimport {\n  openLattice,\n  ActionNotFoundError,\n  GrantDeniedError,\n  ValidationError,\n} from \"../services/open/openLattice\";\nimport { buildSessionServer } from \"../services/open/openMcpServer\";\nimport { collectExposedPluginUiResources } from \"../services/open/registerExposedPlugins\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPlugins,\n} from \"../services/open/tenantOpenPlugins\";\nimport { getSession, deleteSession } from \"../services/open/mcpTransportRegistry\";\n\nexport interface OpenRouteDeps {\n  openAuth?: OpenCredentialService;\n  grantsSource?: (ctx: OpenCredential) => OpenGrant[];\n  audit?: OpenAuditService;\n  rateLimiter?: OpenRateLimiter;\n  /**\n   * Test seam: build the credential's tenant sandbox plugin bundle. Defaults to\n   * {@link buildTenantOpenPlugins} with the global catalog's tool names reserved\n   * so a tenant tool can never shadow a global/built-in one.\n   */\n  tenantPlugins?: (\n    tenantId: string,\n    grants: OpenGrant[],\n    reservedToolNames: ReadonlySet<string>,\n  ) => Promise<TenantOpenPlugins>;\n}\n\nfunction extractBearer(request: FastifyRequest): string | undefined {\n  const header = request.headers.authorization;\n  if (!header?.startsWith(\"Bearer \")) return undefined;\n  return header.slice(\"Bearer \".length).trim() || undefined;\n}\n\nfunction readSessionId(request: FastifyRequest): string | undefined {\n  const raw = request.headers[\"mcp-session-id\"];\n  const value = Array.isArray(raw) ? raw[0] : raw;\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\n/**\n * Degraded tenant plugin bundle used when the sandbox catalog cannot be read.\n *\n * A catalog read failure must not 500 the session: the MCP server still builds\n * and serves the global tools. `invoke` is unreachable through normal routing\n * (`hasTool` is always false, so calls route to OpenLattice) but returns an\n * error result if it is ever reached.\n */\nfunction emptyTenantPlugins(): TenantOpenPlugins {\n  return {\n    tools: [],\n    uiResources: new Map(),\n    hasTool: () => false,\n    degraded: true,\n    invoke: async (toolName) => ({\n      content: [\n        { type: \"text\", text: `Tenant plugin catalog unavailable for ${toolName}` },\n      ],\n      isError: true,\n    }),\n  };\n}\n\n/** JSON-RPC error codes used on the Open surface. */\nconst RPC_ERROR = {\n  GRANT_DENIED: -32001,\n  ACTION_NOT_FOUND: -32002,\n  VALIDATION_FAILED: -32003,\n  EXECUTION_ERROR: -32004,\n  RATE_LIMITED: -32005,\n} as const;\n\nexport function registerOpenRoutes(\n  app: FastifyInstance,\n  deps: OpenRouteDeps = {},\n): void {\n  const openAuth =\n    deps.openAuth ??\n    new OpenCredentialService(\n      getStoreLattice(\"default\", \"a2aApiKey\").store as A2AApiKeyStore,\n      getStoreLattice(\"default\", \"project\").store as ProjectStore,\n    );\n  const grantsSource =\n    deps.grantsSource ?? ((ctx: OpenCredential) => ctx.grants);\n  const audit =\n    deps.audit ??\n    (() => {\n      try {\n        const store = getStoreLattice(\"default\", \"openAudit\").store as OpenAuditStore;\n        return new OpenAuditService(store);\n      } catch {\n        return undefined;\n      }\n    })();\n\n  const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();\n\n  app.post(\"/open/mcp\", async (request: FastifyRequest, reply: FastifyReply) => {\n    const context = await openAuth.resolve(extractBearer(request));\n    if (!context) {\n      return reply.status(401).send({ error: \"AUTH_FAILED\" });\n    }\n\n    const body: unknown = request.body;\n    const sessionId = readSessionId(request);\n\n    // Existing session: reuse its server/transport. Bearer must match the\n    // session's credential — a session is not usable by another key.\n    if (sessionId) {\n      const session = await getSession(sessionId);\n      if (\n        !session ||\n        session.credential.credentialId !== context.credentialId\n      ) {\n        return reply.status(404).send({ error: \"SESSION_NOT_FOUND\" });\n      }\n      reply.hijack();\n      await session.transport.handleRequest(request.raw, reply.raw, body);\n      return;\n    }\n\n    // New session: only initialize may create one. Registration into the\n    // session registry happens inside sessionIdGenerator (see openMcpServer).\n    if (!isInitializeRequest(body)) {\n      return reply.status(400).send({ error: \"SESSION_REQUIRED\" });\n    }\n\n    const grants = grantsSource(context);\n    const catalog = await openLattice.catalogFor(grants, { tenantId: context.tenantId });\n    // Tenant sandbox plugins are volume-resident and outside the OpenLattice\n    // registry; merge their grant-filtered tools/UI alongside the globals.\n    // Global/built-in tool names are reserved so a tenant plugin of the same\n    // type (kb/sandbox/agent) can neither crash `registerTool` with a duplicate\n    // nor capture the invoke routing for a global tool.\n    const globalToolNames = new Set(catalog.map((t) => t.toolName));\n    const buildTenant =\n      deps.tenantPlugins ??\n      ((tenantId, tenantGrants, reservedToolNames) =>\n        buildTenantOpenPlugins(tenantId, tenantGrants, { reservedToolNames }));\n    let tenant: TenantOpenPlugins;\n    try {\n      tenant = await buildTenant(context.tenantId, grants, globalToolNames);\n      if (tenant.degraded) {\n        // The catalog's common failure mode is a diagnostic, not a throw\n        // (`ensureLoaded` returns error-level diagnostics). Surface it and\n        // serve global tools only.\n        request.log.warn(\n          { tenantId: context.tenantId },\n          \"open mcp: tenant plugin catalog degraded; serving global tools only\",\n        );\n      }\n    } catch (error) {\n      // Sandbox catalogs are volume-resident and can be transiently\n      // unavailable; degrade to globals-only rather than failing the whole\n      // session so external hosts can still connect. `err` keeps the stack.\n      request.log.warn(\n        { tenantId: context.tenantId, err: error },\n        \"open mcp: tenant plugin catalog unavailable; serving global tools only\",\n      );\n      tenant = emptyTenantPlugins();\n    }\n    const mergedCatalog = mergeOpenCatalog(catalog, tenant.tools);\n    const uiResources = new Map([\n      ...collectExposedPluginUiResources(grants),\n      ...tenant.uiResources,\n    ]);\n    const built = await buildSessionServer({\n      credential: { credentialId: context.credentialId, kind: context.kind },\n      grants,\n      catalog: mergedCatalog,\n      uiResources,\n      invoke: async (toolName, args) => {\n        const startedAt = Date.now();\n        const sep = toolName.indexOf(\"_\");\n        const auditDomain = sep > 0 ? toolName.slice(0, sep) : toolName;\n        const auditAction = sep > 0 ? toolName.slice(sep + 1) : \"\";\n\n        const decision = rateLimiter.check(context.credentialId, auditDomain);\n        if (!decision.allowed) {\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode: \"RATE_LIMITED\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(\n              `RATE_LIMITED: retry after ${decision.retryAfterMs ?? 1000}ms`,\n            ),\n            { rpcCode: RPC_ERROR.RATE_LIMITED },\n          );\n        }\n\n        try {\n          const isTenantRoute = tenant.hasTool(toolName) && !globalToolNames.has(toolName);\n          const runConfig: Record<string, unknown> = {\n            sandboxName: context.sandboxName,\n            credentialId: context.credentialId,\n            depth: context.depth,\n          };\n          const result = isTenantRoute\n            ? await tenant.invoke(toolName, args, {\n                tenantId: context.tenantId,\n                projectId: context.projectId,\n                workspaceId: context.workspaceId,\n                runConfig,\n              })\n            : await openLattice.invoke(\n                grants,\n                {\n                  tenantId: context.tenantId,\n                  projectId: context.projectId,\n                  workspaceId: context.workspaceId,\n                  runConfig,\n                },\n                toolName,\n                args,\n              );\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: result.isError ? \"error\" : \"ok\",\n            ...(result.isError ? { errorCode: \"EXECUTION_ERROR\" } : {}),\n            durationMs: Date.now() - startedAt,\n          });\n          return result;\n        } catch (err) {\n          const code =\n            err instanceof GrantDeniedError\n              ? RPC_ERROR.GRANT_DENIED\n              : err instanceof ActionNotFoundError\n                ? RPC_ERROR.ACTION_NOT_FOUND\n                : err instanceof ValidationError\n                  ? RPC_ERROR.VALIDATION_FAILED\n                  : RPC_ERROR.EXECUTION_ERROR;\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode:\n              err instanceof GrantDeniedError\n                ? \"GRANT_DENIED\"\n                : err instanceof ActionNotFoundError\n                  ? \"ACTION_NOT_FOUND\"\n                  : err instanceof ValidationError\n                    ? \"VALIDATION_FAILED\"\n                    : \"EXECUTION_ERROR\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(err instanceof Error ? err.message : String(err)),\n            { rpcCode: code },\n          );\n        }\n      },\n    });\n    // buildSessionServer no longer connects internally (so it is testable\n    // over InMemoryTransport); the transport still needs an onmessage handler\n    // before handleRequest or initialize is swallowed and the request hangs.\n    await built.server.connect(built.transport);\n    reply.hijack();\n    await built.transport.handleRequest(request.raw, reply.raw, body);\n  });\n\n  app.delete(\n    \"/open/mcp\",\n    async (request: FastifyRequest, reply: FastifyReply) => {\n      const sessionId = readSessionId(request);\n      if (!sessionId) {\n        return reply.status(400).send({ error: \"SESSION_REQUIRED\" });\n      }\n      await deleteSession(sessionId);\n      return reply.status(204).send();\n    },\n  );\n}\n","/**\n * In-memory per-credential rate limiter (token bucket). The agent domain gets\n * a stricter bucket because each call consumes LLM budget.\n *\n * Process-local by design (V1 single-gateway); a distributed limiter is V2.\n */\n\nexport interface RateLimitDecision {\n  allowed: boolean;\n  retryAfterMs?: number;\n}\n\ninterface Bucket {\n  tokens: number;\n  updatedAt: number;\n}\n\nexport interface OpenRateLimiterOptions {\n  /** Default requests per minute per credential. */\n  defaultPerMinute?: number;\n  /** Stricter limit for the agent domain. */\n  agentPerMinute?: number;\n}\n\nexport class OpenRateLimiter {\n  private readonly buckets = new Map<string, Bucket>();\n  private readonly defaultPerMinute: number;\n  private readonly agentPerMinute: number;\n\n  constructor(options: OpenRateLimiterOptions = {}) {\n    this.defaultPerMinute = options.defaultPerMinute ?? 60;\n    this.agentPerMinute = options.agentPerMinute ?? 10;\n  }\n\n  private bucketClass(domain: string): string {\n    return domain === \"agent\" ? \"agent\" : \"default\";\n  }\n\n  private limitFor(domain: string): number {\n    return domain === \"agent\" ? this.agentPerMinute : this.defaultPerMinute;\n  }\n\n  /** Consume one token; denied calls report how long to wait. */\n  check(credentialId: string, domain: string): RateLimitDecision {\n    const limit = this.limitFor(domain);\n    const key = `${this.bucketClass(domain)}:${credentialId}`;\n    const now = Date.now();\n    const bucket = this.buckets.get(key) ?? { tokens: limit, updatedAt: now };\n\n    const refillPerMs = limit / 60_000;\n    const elapsed = now - bucket.updatedAt;\n    bucket.tokens = Math.min(limit, bucket.tokens + elapsed * refillPerMs);\n    bucket.updatedAt = now;\n\n    if (bucket.tokens >= 1) {\n      bucket.tokens -= 1;\n      this.buckets.set(key, bucket);\n      return { allowed: true };\n    }\n\n    this.buckets.set(key, bucket);\n    const deficit = 1 - bucket.tokens;\n    return { allowed: false, retryAfterMs: Math.ceil(deficit / refillPerMs) };\n  }\n\n  /** Test helper. */\n  reset(): void {\n    this.buckets.clear();\n  }\n}\n","/**\n * Builds a per-session MCP server instance whose tool list is the\n * credential-filtered OpenLattice catalog. Per-session instances are what\n * make grant-filtered tools/list possible on the official SDK.\n *\n * Session registration happens inside sessionIdGenerator — the SDK invokes\n * it exactly once while handling initialize, which guarantees the registry\n * key equals the transport-generated id that the response header carries.\n *\n * Every tool executor routes through the OpenLattice invoke kernel, so\n * authorization is re-checked on each invocation (default-deny, live grants).\n */\n\nimport { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport { randomUUID } from \"crypto\";\nimport type { McpUiCsp, OpenGrant } from \"@axiom-lattice/protocols\";\nimport type { OpenToolDescriptor } from \"./openLattice\";\nimport { registerSession } from \"./mcpTransportRegistry\";\n\nexport const OPEN_MCP_SERVER_INFO = {\n  name: \"axiom-open\",\n  version: \"0.1.0\",\n} as const;\n\n/**\n * A `ui://` HTML resource served by the session. `read` is invoked per\n * `resources/read`, so the caller can fetch plugin UI lazily.\n */\nexport interface OpenUiResource {\n  /** MIME for the resource; defaults to \"text/html;profile=mcp-app\". */\n  mimeType?: string;\n  csp?: McpUiCsp;\n  read: () => Promise<{ html: string; csp?: McpUiCsp }>;\n}\n\nexport interface BuiltSession {\n  server: McpServer;\n  transport: StreamableHTTPServerTransport;\n  tools: OpenToolDescriptor[];\n}\n\n/**\n * Builds (but does not connect) a per-session MCP server. The caller MUST\n * connect it to a transport (`await built.server.connect(built.transport)`)\n * before handling requests — otherwise the transport has no onmessage\n * handler and initialize is swallowed. Deferring connect is what lets tests\n * attach the server to an `InMemoryTransport`.\n */\nexport async function buildSessionServer(options: {\n  credential: { credentialId: string; kind: string };\n  grants: OpenGrant[];\n  catalog: OpenToolDescriptor[];\n  invoke: (\n    toolName: string,\n    args: unknown,\n  ) => Promise<{\n    content: Array<{ type: \"text\"; text: string }>;\n    isError?: boolean;\n  }>;\n  uiResources?: Map<string, OpenUiResource>;\n}): Promise<BuiltSession> {\n  const { credential, catalog, invoke, uiResources } = options;\n  const server = new McpServer(OPEN_MCP_SERVER_INFO, {\n    capabilities: {\n      // The SDK has no `extensions` field; MCP App hosts discover the UI\n      // extension through `experimental`.\n      experimental: { \"io.modelcontextprotocol/ui\": {} },\n    },\n  });\n  for (const tool of catalog) {\n    server.registerTool(\n      tool.toolName,\n      {\n        description: tool.description,\n        inputSchema: tool.schema,\n        annotations: {\n          readOnlyHint: tool.annotations.readOnlyHint,\n          destructiveHint: tool.annotations.destructiveHint,\n        },\n        ...(tool.ui ? { _meta: { ui: { resourceUri: tool.ui.resourceUri } } } : {}),\n      },\n      async (args: unknown) => {\n        const result = await invoke(tool.toolName, args);\n        return { content: result.content, isError: result.isError };\n      },\n    );\n  }\n  for (const [uri, res] of uiResources ?? []) {\n    const mimeType = res.mimeType ?? \"text/html;profile=mcp-app\";\n    server.registerResource(\n      `mcp-app:${uri}`,\n      uri,\n      {\n        mimeType,\n        ...(res.csp ? { _meta: { ui: { csp: res.csp } } } : {}),\n      },\n      async (u) => {\n        const { html, csp } = await res.read();\n        return {\n          contents: [\n            {\n              uri: u.href,\n              mimeType,\n              text: html,\n              ...(csp ? { _meta: { ui: { csp } } } : {}),\n            },\n          ],\n        };\n      },\n    );\n  }\n  const transport = new StreamableHTTPServerTransport({\n    sessionIdGenerator: () => {\n      const sessionId = randomUUID();\n      void registerSession(\n        sessionId,\n        { credentialId: credential.credentialId, kind: credential.kind },\n        { server, transport },\n      );\n      return sessionId;\n    },\n    enableJsonResponse: true,\n    onsessionclosed: (closedId: string) => {\n      void import(\"./mcpTransportRegistry\").then(({ deleteSession }) =>\n        deleteSession(closedId),\n      );\n    },\n  });\n  return { server, transport, tools: catalog };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;;;ACYzB,IAAM,kBAAN,MAAsB;AAAA,EAK3B,YAAY,UAAkC,CAAC,GAAG;AAJlD,SAAiB,UAAU,oBAAI,IAAoB;AAKjD,SAAK,mBAAmB,QAAQ,oBAAoB;AACpD,SAAK,iBAAiB,QAAQ,kBAAkB;AAAA,EAClD;AAAA,EAEQ,YAAY,QAAwB;AAC1C,WAAO,WAAW,UAAU,UAAU;AAAA,EACxC;AAAA,EAEQ,SAAS,QAAwB;AACvC,WAAO,WAAW,UAAU,KAAK,iBAAiB,KAAK;AAAA,EACzD;AAAA;AAAA,EAGA,MAAM,cAAsB,QAAmC;AAC7D,UAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,UAAM,MAAM,GAAG,KAAK,YAAY,MAAM,CAAC,IAAI,YAAY;AACvD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,SAAS,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,QAAQ,OAAO,WAAW,IAAI;AAExE,UAAM,cAAc,QAAQ;AAC5B,UAAM,UAAU,MAAM,OAAO;AAC7B,WAAO,SAAS,KAAK,IAAI,OAAO,OAAO,SAAS,UAAU,WAAW;AACrE,WAAO,YAAY;AAEnB,QAAI,OAAO,UAAU,GAAG;AACtB,aAAO,UAAU;AACjB,WAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAEA,SAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,UAAM,UAAU,IAAI,OAAO;AAC3B,WAAO,EAAE,SAAS,OAAO,cAAc,KAAK,KAAK,UAAU,WAAW,EAAE;AAAA,EAC1E;AAAA;AAAA,EAGA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AACF;;;ACxDA,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAC9C,SAAS,kBAAkB;AAKpB,IAAM,uBAAuB;AAAA,EAClC,MAAM;AAAA,EACN,SAAS;AACX;AA0BA,eAAsB,mBAAmB,SAYf;AACxB,QAAM,EAAE,YAAY,SAAS,QAAQ,YAAY,IAAI;AACrD,QAAM,SAAS,IAAI,UAAU,sBAAsB;AAAA,IACjD,cAAc;AAAA;AAAA;AAAA,MAGZ,cAAc,EAAE,8BAA8B,CAAC,EAAE;AAAA,IACnD;AAAA,EACF,CAAC;AACD,aAAW,QAAQ,SAAS;AAC1B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,aAAa,KAAK;AAAA,QAClB,aAAa;AAAA,UACX,cAAc,KAAK,YAAY;AAAA,UAC/B,iBAAiB,KAAK,YAAY;AAAA,QACpC;AAAA,QACA,GAAI,KAAK,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,GAAG,YAAY,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E;AAAA,MACA,OAAO,SAAkB;AACvB,cAAM,SAAS,MAAM,OAAO,KAAK,UAAU,IAAI;AAC/C,eAAO,EAAE,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,eAAe,CAAC,GAAG;AAC1C,UAAM,WAAW,IAAI,YAAY;AACjC,WAAO;AAAA,MACL,WAAW,GAAG;AAAA,MACd;AAAA,MACA;AAAA,QACE;AAAA,QACA,GAAI,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,MACA,OAAO,MAAM;AACX,cAAM,EAAE,MAAM,IAAI,IAAI,MAAM,IAAI,KAAK;AACrC,eAAO;AAAA,UACL,UAAU;AAAA,YACR;AAAA,cACE,KAAK,EAAE;AAAA,cACP;AAAA,cACA,MAAM;AAAA,cACN,GAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,IAAI,8BAA8B;AAAA,IAClD,oBAAoB,MAAM;AACxB,YAAM,YAAY,WAAW;AAC7B,WAAK;AAAA,QACH;AAAA,QACA,EAAE,cAAc,WAAW,cAAc,MAAM,WAAW,KAAK;AAAA,QAC/D,EAAE,QAAQ,UAAU;AAAA,MACtB;AACA,aAAO;AAAA,IACT;AAAA,IACA,oBAAoB;AAAA,IACpB,iBAAiB,CAAC,aAAqB;AACrC,WAAK,OAAO,qCAAwB,EAAE;AAAA,QAAK,CAAC,EAAE,eAAAA,eAAc,MAC1DA,eAAc,QAAQ;AAAA,MACxB;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,EAAE,QAAQ,WAAW,OAAO,QAAQ;AAC7C;;;AFhFA,SAAS,cAAc,SAA6C;AAClE,QAAM,SAAS,QAAQ,QAAQ;AAC/B,MAAI,CAAC,QAAQ,WAAW,SAAS,EAAG,QAAO;AAC3C,SAAO,OAAO,MAAM,UAAU,MAAM,EAAE,KAAK,KAAK;AAClD;AAEA,SAAS,cAAc,SAA6C;AAClE,QAAM,MAAM,QAAQ,QAAQ,gBAAgB;AAC5C,QAAM,QAAQ,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI;AAC5C,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAUA,SAAS,qBAAwC;AAC/C,SAAO;AAAA,IACL,OAAO,CAAC;AAAA,IACR,aAAa,oBAAI,IAAI;AAAA,IACrB,SAAS,MAAM;AAAA,IACf,UAAU;AAAA,IACV,QAAQ,OAAO,cAAc;AAAA,MAC3B,SAAS;AAAA,QACP,EAAE,MAAM,QAAQ,MAAM,yCAAyC,QAAQ,GAAG;AAAA,MAC5E;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAGA,IAAM,YAAY;AAAA,EAChB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,cAAc;AAChB;AAEO,SAAS,mBACd,KACA,OAAsB,CAAC,GACjB;AACN,QAAM,WACJ,KAAK,YACL,IAAI;AAAA,IACF,gBAAgB,WAAW,WAAW,EAAE;AAAA,IACxC,gBAAgB,WAAW,SAAS,EAAE;AAAA,EACxC;AACF,QAAM,eACJ,KAAK,iBAAiB,CAAC,QAAwB,IAAI;AACrD,QAAM,QACJ,KAAK,UACJ,MAAM;AACL,QAAI;AACF,YAAM,QAAQ,gBAAgB,WAAW,WAAW,EAAE;AACtD,aAAO,IAAI,iBAAiB,KAAK;AAAA,IACnC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AAEL,QAAM,cAAc,KAAK,eAAe,IAAI,gBAAgB;AAE5D,MAAI,KAAK,aAAa,OAAO,SAAyB,UAAwB;AAC5E,UAAM,UAAU,MAAM,SAAS,QAAQ,cAAc,OAAO,CAAC;AAC7D,QAAI,CAAC,SAAS;AACZ,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,cAAc,CAAC;AAAA,IACxD;AAEA,UAAM,OAAgB,QAAQ;AAC9B,UAAM,YAAY,cAAc,OAAO;AAIvC,QAAI,WAAW;AACb,YAAM,UAAU,MAAM,WAAW,SAAS;AAC1C,UACE,CAAC,WACD,QAAQ,WAAW,iBAAiB,QAAQ,cAC5C;AACA,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MAC9D;AACA,YAAM,OAAO;AACb,YAAM,QAAQ,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,IAAI;AAClE;AAAA,IACF;AAIA,QAAI,CAAC,oBAAoB,IAAI,GAAG;AAC9B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAAA,IAC7D;AAEA,UAAM,SAAS,aAAa,OAAO;AACnC,UAAM,UAAU,MAAM,YAAY,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,CAAC;AAMnF,UAAM,kBAAkB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAC9D,UAAM,cACJ,KAAK,kBACJ,CAAC,UAAU,cAAc,sBACxB,uBAAuB,UAAU,cAAc,EAAE,kBAAkB,CAAC;AACxE,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,YAAY,QAAQ,UAAU,QAAQ,eAAe;AACpE,UAAI,OAAO,UAAU;AAInB,gBAAQ,IAAI;AAAA,UACV,EAAE,UAAU,QAAQ,SAAS;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAId,cAAQ,IAAI;AAAA,QACV,EAAE,UAAU,QAAQ,UAAU,KAAK,MAAM;AAAA,QACzC;AAAA,MACF;AACA,eAAS,mBAAmB;AAAA,IAC9B;AACA,UAAM,gBAAgB,iBAAiB,SAAS,OAAO,KAAK;AAC5D,UAAM,cAAc,IAAI,IAAI;AAAA,MAC1B,GAAG,gCAAgC,MAAM;AAAA,MACzC,GAAG,OAAO;AAAA,IACZ,CAAC;AACD,UAAM,QAAQ,MAAM,mBAAmB;AAAA,MACrC,YAAY,EAAE,cAAc,QAAQ,cAAc,MAAM,QAAQ,KAAK;AAAA,MACrE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,QAAQ,OAAO,UAAU,SAAS;AAChC,cAAM,YAAY,KAAK,IAAI;AAC3B,cAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,GAAG,GAAG,IAAI;AACvD,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI;AAExD,cAAM,WAAW,YAAY,MAAM,QAAQ,cAAc,WAAW;AACpE,YAAI,CAAC,SAAS,SAAS;AACrB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI;AAAA,cACF,6BAA6B,SAAS,gBAAgB,GAAI;AAAA,YAC5D;AAAA,YACA,EAAE,SAAS,UAAU,aAAa;AAAA,UACpC;AAAA,QACF;AAEA,YAAI;AACF,gBAAM,gBAAgB,OAAO,QAAQ,QAAQ,KAAK,CAAC,gBAAgB,IAAI,QAAQ;AAC/E,gBAAM,YAAqC;AAAA,YACzC,aAAa,QAAQ;AAAA,YACrB,cAAc,QAAQ;AAAA,YACtB,OAAO,QAAQ;AAAA,UACjB;AACA,gBAAM,SAAS,gBACX,MAAM,OAAO,OAAO,UAAU,MAAM;AAAA,YAClC,UAAU,QAAQ;AAAA,YAClB,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB;AAAA,UACF,CAAC,IACD,MAAM,YAAY;AAAA,YAChB;AAAA,YACA;AAAA,cACE,UAAU,QAAQ;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,aAAa,QAAQ;AAAA,cACrB;AAAA,YACF;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACJ,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ,OAAO,UAAU,UAAU;AAAA,YACnC,GAAI,OAAO,UAAU,EAAE,WAAW,kBAAkB,IAAI,CAAC;AAAA,YACzD,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,iBAAO;AAAA,QACT,SAAS,KAAK;AACZ,gBAAM,OACJ,eAAe,mBACX,UAAU,eACV,eAAe,sBACb,UAAU,mBACV,eAAe,kBACb,UAAU,oBACV,UAAU;AACpB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WACE,eAAe,mBACX,iBACA,eAAe,sBACb,qBACA,eAAe,kBACb,sBACA;AAAA,YACV,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YAC1D,EAAE,SAAS,KAAK;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAID,UAAM,MAAM,OAAO,QAAQ,MAAM,SAAS;AAC1C,UAAM,OAAO;AACb,UAAM,MAAM,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,IAAI;AAAA,EAClE,CAAC;AAED,MAAI;AAAA,IACF;AAAA,IACA,OAAO,SAAyB,UAAwB;AACtD,YAAM,YAAY,cAAc,OAAO;AACvC,UAAI,CAAC,WAAW;AACd,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,mBAAmB,CAAC;AAAA,MAC7D;AACA,YAAM,cAAc,SAAS;AAC7B,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,IAChC;AAAA,EACF;AACF;","names":["deleteSession"]}