@besales/mcp 0.47.1 → 1.0.0-beta.2

package/README.md

@@ -4,6 +4,15 @@ Model Context Protocol server for Animaly / Besales.
 
 Status: public npm package candidate.
 
+[Онлайн-MCP: подключение коллег к Claude Code и Codex CLI](docs/connect.ru.md#онлайн-mcp-подключение-коллег).
+
+Channel responses include `desiredActive`, `isActive`, `readinessIssue`, and a localized
+`readinessIssueText` on activation and settings surfaces. The client forwards `Accept-Language`
+when a locale is configured. Missing permissions use a human explanation and remediation;
+`requiredConnectScopes` and `deniedBy` preserve the structured recovery details. A permission
+lost by the key creator names the scopes actually granted to that key. API contract types
+must be regenerated from the updated API description with `BESALES_API_CONTRACTS_DIR=/path/to/besales-api/contracts yarn types:gen:api`.
+
 ## Install
 
 Requirements:
@@ -20,10 +29,10 @@ npx -y @besales/mcp status
 npx -y @besales/mcp
 ```
 
-`connect` opens the browser consent flow and stores an MCP API key plus the
-selected workspace in the local keychain. With one connection or an explicit session pin,
-workspace-level tools resolve it automatically. With several unpinned connections they refuse
-the call as ambiguous; inspect `besales_workspace_current` and select one deliberately.
+`connect` opens the browser consent flow and stores an MCP API key plus the selected workspace in
+the local keychain. With one connection or an explicit session pin, workspace-level tools resolve
+it automatically. With several unpinned connections they refuse the call as ambiguous; inspect
+`besales_workspace_current` and select one deliberately.
 
 For production, do not set `BESALES_API_BASE_URL` or
 `BESALES_OAUTH_AUTHORIZE_URL`. They default to:
@@ -31,24 +40,24 @@ For production, do not set `BESALES_API_BASE_URL` or
 - `BESALES_API_BASE_URL` → `https://core.besales.ai/api/v2` (backend API host —
   used for MCP tool calls)
 - `BESALES_OAUTH_AUTHORIZE_URL` →
-  `https://app.besales.ai/settings/mcp/consent` (frontend bridge page — opened
-  in the browser during `connect`; it mints a one-time setup ticket and forwards
-  to the backend consent page. After approval `connect` receives a one-time `code`
-  on the loopback callback and exchanges it with the PKCE `code_verifier` at
-  `/api/v2/auth/mcp-token` — the API key never travels in a URL)
+  `https://core.besales.ai/api/v2/auth/mcp-connect/start` (the connect page served by the
+  API itself — opened in the browser during `connect`: sign in, choose the workspace and
+  approve the whole permission set; the page names every permission in words and which ones
+  your role does not allow. When unset it follows `BESALES_API_BASE_URL`. After approval
+  `connect` receives a one-time `code` on the loopback callback and exchanges it with the
+  PKCE `code_verifier` at `/api/v2/auth/mcp-token` — the API key never travels in a URL)
 
 For staging or local development override them per command:
 
 ```bash
 BESALES_API_BASE_URL=http://localhost:3000/api/v2 \
-BESALES_OAUTH_AUTHORIZE_URL=http://localhost:5173/settings/mcp/consent \
+BESALES_OAUTH_AUTHORIZE_URL=http://localhost:3000/api/v2/auth/mcp-connect/start \
   npx -y @besales/mcp connect
 ```
 
 ## Configure Your MCP Host
 
-Step-by-step guide in Russian (Claude Code, Codex, several workspaces, updating):
-[docs/connect.ru.md](docs/connect.ru.md). Release order for maintainers: [RELEASING.md](RELEASING.md).
+Сетевой режим работает без сессий: каждый POST независим, простой и перезапуск между запросами не требуют переподключения. Для подключения Claude Code и Codex к `https://mcp.besales.ai/mcp` с ключом из `besales-mcp key [workspace-id]` см. [сетевой режим](docs/modules/network-mode.md#подключение-claude-code-и-codex).
 
 After `connect`, add the server to your MCP host and restart the host.
 
@@ -85,13 +94,13 @@ command = "npx"
 args = ["-y", "@besales/mcp"]
 ```
 
-For staging/local backends, include both backend and frontend bridge URLs in the
-host env. For example:
+For staging/local backends, set the backend URL in the host env; the connect page
+follows it. For example:
 
 ```toml
 [mcp_servers.besales.env]
 BESALES_API_BASE_URL = "http://localhost:3000/api/v2"
-BESALES_OAUTH_AUTHORIZE_URL = "http://localhost:5173/settings/mcp/consent"
+BESALES_OAUTH_AUTHORIZE_URL = "http://localhost:3000/api/v2/auth/mcp-connect/start"
 ```
 
 ## Multiple Workspaces
@@ -142,23 +151,16 @@ Workspace selection precedence, per tool call:
 2. an explicit `workspace_id` argument (only when the env var is not set).
 3. the session binding set by the `besales_workspace_use` tool (in-memory, this
    session/process only — see below).
-4. the only connected workspace.
-5. otherwise the call is refused — several workspaces are connected and none was
-   chosen.
-
-**The global `active` workspace is not an implicit fallback.** It is set on the
-very first `connect` and never revisited, so using it silently would send calls
-to whichever workspace you happened to connect first — returning another
-workspace's data with no error at all. When several workspaces are connected and
-nothing above selects one, the call fails closed; the error names the current
-`active` so you can pass it explicitly if that is what you meant. With exactly
-one connection nothing changes. `besales_workspace_current` reports
-`source: "ambiguous"` and `workspace_id: null` in the same situation, so the
-diagnostic never claims a binding the real call would not use.
-
-`BESALES_WORKSPACE_ID` always overrides everything. `besales_workspace_current`
-lists names, safe account labels, UUIDs, the selection source, and label freshness.
-The assistant shows those names to the user and passes the chosen UUID itself.
+4. the only connected workspace (error if several are connected and none chosen).
+
+The global `active` workspace set by `besales-mcp use <id>` is **not** an implicit
+fallback: it is set on the very first `connect` and never revisited, so a call
+without an explicit choice used to reach a different tenant and return its data
+without any error. Ambiguity is now fail-closed — with several workspaces
+connected you must pick one, and `active` is only suggested in the error text.
+With exactly one connection nothing changed. `besales_workspace_current` lists
+names, safe account labels, UUIDs, the selection source, and label freshness. The
+assistant shows those names to the user and passes the chosen UUID itself.
 
 ### GUI hosts without per-session env (e.g. Claude Desktop)
 
@@ -186,9 +188,12 @@ Ask the assistant to call **`besales_workspace_use <workspaceId>`** to bind the
 current session in-memory. Each host session runs its own `besales-mcp` process,
 so it is per-session and touches neither the global `active` nor other sessions.
 Caveat: the binding is **in-memory only** — when the host respawns the server
-(reconnect, which GUI hosts do often), it is **lost and falls back to the global
-`active`**. Use it for a stable stretch, not as a durable lock; for that use the
-pinned named servers above. `besales_workspace_current` shows the current binding
+(reconnect, which GUI hosts do often), it is **lost**, and with several
+workspaces connected every call then fails until the assistant binds again.
+There is no silent fallback to the global `active`: that fallback was removed
+because it delivered another tenant's data without an error. Use the binding for
+a stable stretch, not as a durable lock; for that use the pinned named servers
+above. `besales_workspace_current` shows the current binding
 + source and lists connected workspaces; it is **refused** under a
 `BESALES_WORKSPACE_ID` pin (env wins).
 
@@ -216,20 +221,16 @@ Expected quick checks:
 4. External flows use `*_get_instructions`, execute stages locally in the host,
    then call the matching `*_submit` tool.
 
-If the host does not expose MCP resources to the model, ask the same request in ordinary words.
-The model can call `besales_help_search` and then `besales_help_get`; both tools read the same
-packaged documents as `besales://...` resources. `besales_help_get` returns a compact heading index
-by default, one section with `section`, or the complete document with `full=true`. See
+If the host does not expose resources to the model, use `besales_help_search` and
+`besales_help_get`. They read the same packaged documents as `besales://...`; get returns a heading
+index by default, one section with `section`, or the whole document with `full=true`. See
 [`docs/help-navigation.md`](docs/help-navigation.md).
 
-Hosts with MCP prompts may also show five optional task entries: configure an agent, improve an
-agent, audit dialogues, build a campaign report, and diagnose a failure. They expand to the same
-ordinary instructions and tool navigation; a host without prompts loses no operation.
-
 To switch workspace, connect each one once (see [Multiple Workspaces](#multiple-workspaces))
-and either set `BESALES_WORKSPACE_ID` per host session or run
-`npx -y @besales/mcp use <workspaceId>`. No browser re-auth is needed once a
-workspace is connected.
+and then choose it explicitly: set `BESALES_WORKSPACE_ID` per host session, or ask
+the assistant for `besales_workspace_use <workspaceId>`. `npx -y @besales/mcp use
+<workspaceId>` marks the workspace for CLI commands only — tools do not fall back
+to it. No browser re-auth is needed once a workspace is connected.
 
 If a call asks for `workspace_id`, first run `besales_workspace_current`: the cause may be a real
 multi-workspace ambiguity, an env pin conflict, a missing key, or an old schema. Restart the host
@@ -243,14 +244,25 @@ marks their source. It never unions permissions from other MCP keys in the same
 
 ```bash
 yarn install
-yarn types:gen:api
-yarn types:gen:mcp
+BESALES_API_CONTRACTS_DIR=/path/to/besales-api/contracts yarn contracts:sync:api
 yarn build
 ```
 
+`contracts:sync:api` regenerates API types, selected tool schemas, the complete local route map and tool inventory from the explicit API checkout. It checks every HTTP tool and variant against the API method/path; the customer-only CRM reveal route is checked against its registered controller. It writes a working-tree audit and route export to `.codex-artifacts-bridge-train2/`, without modifying the API checkout or Git index. Signed `publish:mcp-registry` remains a separate step after the chair commits the bridge.
+
 The generated files in `src/types/` and `src/schemas/` are committed because
 the source contracts live outside this independent repository.
 
+Prompt generation accepts optional `output_language`; prompt analysis accepts
+optional `source_language`. The bridge sends them as `outputLanguage` and
+`sourceLanguage`, without changing case or adding a default. Both accept
+`ru`, `en`, `es`, `id`, `uz` and other valid external bot language codes such as `kk`.
+When omitted, the API keeps the bot language, then the workspace language.
+`style_hints.language` (`ru`/`en`) controls stage reasoning only. Follow the returned
+`languageContext` throughout authoring and show the selected language before applying.
+The Zod definitions are the source for these fields in `mcp-tools.json`; derive them
+with `z.toJSONSchema` (`io: 'input'`) and preserve the surrounding registry metadata.
+
 Run a lightweight local mock API for MCP Inspector tool-call smoke tests:
 
 Terminal 1:
@@ -271,7 +283,7 @@ real `besales-mcp connect` credentials. They can overwrite or clear a local real
 connection for the current macOS user.
 
 The mock server only verifies request wiring. Live tool E2E depends on the
-matching `ai-aniomaly` `/api/v2/*` endpoints.
+matching `besales-api` `/api/v2/*` endpoints.
 Remove seeded mock credentials after smoke testing:
 
 ```bash
@@ -283,7 +295,7 @@ yarn dev:mock:clear
 ```bash
 node bin/besales-mcp.js connect              # connect (or refresh) a workspace
 node bin/besales-mcp.js connections          # list connected workspaces (* = active)
-node bin/besales-mcp.js use <workspaceId>    # set the active (default) workspace
+node bin/besales-mcp.js use <workspaceId>    # mark a workspace active for CLI commands
 node bin/besales-mcp.js status               # show the active workspace
 node bin/besales-mcp.js disconnect           # disconnect the active workspace only
 node bin/besales-mcp.js disconnect <id>      # disconnect one workspace
@@ -293,8 +305,9 @@ node bin/besales-mcp.js                       # start the MCP server
 
 `BESALES_API_BASE_URL` defaults to `https://core.besales.ai/api/v2` (backend).
 `BESALES_OAUTH_AUTHORIZE_URL` defaults to
-`https://app.besales.ai/settings/mcp/consent` (frontend bridge). For local
-development point them at your local backend and frontend respectively.
+`https://core.besales.ai/api/v2/auth/mcp-connect/start` (connect page on the API; follows
+`BESALES_API_BASE_URL` when unset). For local development point the API URL at your local
+backend.
 
 `BESALES_MCP_RESULT_ENVELOPE=on` turns on the response size ceiling: oversized
 answers are shaped or refused instead of flooding the caller's context. It is
@@ -323,66 +336,47 @@ For production users, do not set `BESALES_API_BASE_URL` or
 npx -y @besales/mcp connect
 ```
 
-The browser consent flow stores the connected workspace key in the local
-keychain. Workspace-level tools default to the session's workspace, so users
-should not provide `workspace_id` manually. To work with several workspaces,
-connect each once and pin sessions via `BESALES_WORKSPACE_ID` (or switch the
-global default with `besales-mcp use <id>`) — see
+The browser consent flow stores the connected workspace key in the local keychain. One connection
+or a session pin resolves automatically; several unpinned connections remain ambiguous. To work
+with several workspaces, connect each once and pin sessions via `BESALES_WORKSPACE_ID` (or switch
+the global default with `besales-mcp use <id>`) — see
 [Multiple Workspaces](#multiple-workspaces).
 
-## Available tools (253 tools by category)
+## Available tools (by category)
 
-Итог и категории строятся из активных имён `src/schemas/mcp-tools.json`. Тест сверяет этот блок,
-`summary.tools_by_category` и сумму категорий с `tools.length`.
+The total and categories come from active names in `src/schemas/mcp-tools.json`.
+`node scripts/generate-crm-rotation-contract.mjs` regenerates the summary and table below
+from those names after building the package. A test compares this block and
+`summary.tools_by_category` with `tools.length`.
 
 <!-- BEGIN GENERATED TOOL INVENTORY -->
+
 | Category | Tools | Name prefixes |
 |---|---:|---|
 | Workspace, help, tasks and audit | 18 | `workspace_*`, `help_*`, `task_*`, `audit_*` |
-| Agents, behavior and routing | 14 | `agent_*`, `behavior_*`, `facts_*`, `pipeline_*`, `routing_*`, `router_*` |
-| Prompts, sandbox and evaluation | 33 | `prompt_*`, `qa_*`, `sandbox_*`, `simulation_*`, `test_*`, `model_*` |
-| ICP | 9 | `icp_*` |
-| Knowledge, workbooks, files and variables | 50 | `knowledge_*`, `workbook_*`, `feedback_*`, `variable_*`, `file_*` |
-| CRM and data sources | 27 | `crm_*`, `datasource_*` |
-| Channels and external API credentials | 14 | `platform_*`, `external_*` |
-| Dialogues and contacts | 16 | `dialogue_*`, `dialogues_*`, `dialog_*`, `contact_*` |
+| Agents, behavior and routing | 15 | `agent_*`, `behavior_*`, `facts_*`, `pipeline_*`, `routing_*`, `router_*` |
+| Prompts, sandbox and evaluation | 40 | `prompt_*`, `qa_*`, `sandbox_*`, `simulation_*`, `test_*`, `model_*`, `improvement_*` |
+| ICP | 11 | `icp_*` |
+| Knowledge, workbooks, files and variables | 52 | `knowledge_*`, `workbook_*`, `feedback_*`, `variable_*`, `file_*` |
+| CRM and data sources | 30 | `crm_*`, `datasource_*` |
+| Channels and external API credentials | 16 | `platform_*`, `external_*`, `get_*` |
+| Dialogues and contacts | 33 | `dialogue_*`, `dialogues_*`, `dialog_*`, `contact_*` |
 | Triggers | 5 | `trigger_*` |
-| Outbound, follow-up and analytics | 67 | `broadcast_*`, `getcourse_*`, `wazzup_*`, `followup_*`, `scheduled_*`, `tracked_*`, `link_*`, `inbound_*`, `funnel_*`, `ai_*`, `custom_*` |
+| Outbound, follow-up and analytics | 72 | `broadcast_*`, `getcourse_*`, `wazzup_*`, `followup_*`, `scheduled_*`, `tracked_*`, `link_*`, `ai_*`, `funnel_*`, `inbound_*`, `custom_*` |
+
 <!-- END GENERATED TOOL INVENTORY -->
 
 Recent capabilities:
 
-- **Intent navigation** — `besales_workspace_navigate` combines the requested task, bot type,
-  selected objects and live workspace overview into one next tool call, required user input and a
-  result check. It does not perform the recommended mutation.
-- **Complete async lifecycle** — every background start has a read-only status tool; see
-  [docs/async-operation-lifecycle.md](docs/async-operation-lifecycle.md). Contact imports and a
-  single cold-welcome launch use `besales_getcourse_contact_import_status`; anchor refresh uses
-  `besales_getcourse_anchor_refresh_status` and reports a lost worker as `STALLED`.
-- **Funnel test outside the web UI** — `besales_followup_funnel_test_plan` freezes expanded
-  texts and dynamic generations under one `runId`; `start` sends exactly that snapshot to the
-  live contact and requires both `explicit_confirmation=true` and `confirmation_reason`.
-  Status/cancel wrap the durable 15-second-gap run. All four tools require the dedicated
-  `mcp:funnel-test` scope, which is not covered by `mcp:*`.
-- **Prompt lint diagnostics** — a rejected `besales_prompt_patch_commit` now carries the
-  backend's `lintIssues` (up to 3, e.g. the exact character count over the 80000 hard
-  limit) instead of a bare 400. `besales_prompt_headroom` answers the same question
-  *before* a draft is built; `besales_prompt_diff` compares two agents' prompts without
-  pulling both full texts into context.
-- **Fleet prompt rollout** — `besales_prompt_batch_start` applies one set of patch
-  operations across many agents as a background run (33 agents × 3 calls do not fit the
-  60s client timeout). Every agent is prepared and fully linted first; only those that
-  pass are committed. Poll `besales_prompt_batch_status`; roll forward the failures with
-  `besales_prompt_batch_resume` — never by starting a second run.
 - **OAuth PKCE provisioning** — `besales_platform_create_oauth_init` opens the
   authorization flow in the browser for Instagram/Avito so the OAuth code never
   passes through the LLM.
 - **CRM connection via browser-secrets** — `besales_crm_create_init` provisions
   AmoCRM/Bitrix24 (and GetCourse/Telegram) using the Setup URL pattern, where the
   user pastes credentials in the browser instead of through the chat.
-- **External API credential handoff** — channel create/key rotation/secret rotation
-  return `revealUrl` and its expiry. The signed-in user opens that page to receive
-  credentials once; keys and webhook secrets never enter MCP content or host logs.
+- **External API credential handoff** — create and rotate tools return a short-lived
+  `revealUrl`; a signed-in user opens it to receive credentials without exposing them
+  to the MCP transcript. The previous credentials remain valid until that page is opened.
 - **Setup URL pattern** — `*_init` returns a one-time URL; the user completes
   sensitive input in the browser and the host polls `*_status` until ready.
 - **External execution pairs** — schemas returned by `*_get_instructions` use canonical
@@ -393,32 +387,14 @@ Recent capabilities:
 - **Platform provisioning & clone** — create channels and clone an existing
   platform configuration (`besales_platform_clone_preview` / `_execute`).
 - **Knowledge ingestion** — full namespace/document/Q&A/website/table CRUD plus
-  workbook ingestion from xlsx and Google Sheets. `besales_workbook_inspect` inventories
-  sheets and returns a bounded sample; `besales_workbook_sheet_read` pages through late rows
-  and columns with source identity and a page fingerprint. Metadata/classification and
-  archival are available through dedicated workbook tools. Namespace/table reindex returns
-  a job ID; poll the matching `_reindex_status` tool to a terminal state instead of reading
-  worker logs.
-- **GetCourse wave-run batches** — queue 1–10 status-mode segments sequentially
-  through `besales_getcourse_wave_run_batch_start`; use one `_batch_status` poll,
-  reuse a generated `batch_key` on retry, and resume only after resolving two
-  consecutive rejected segments. `UNKNOWN` и небезопасный `FAILED` жёстко
-  блокируются между волнами; repeat mode не является обходом неопределённого исхода.
-  Контакты import/run/batch принимают `email`, `phone`, `first_name`, `last_name` и передают их
-  backend-у без потери snake_case→camelCase.
-- **Broadcast mailing variants** — `besales_broadcast_mailing_variant_list/create/update/delete`;
-  архивирование через delete или `update(archived=true)` требует `explicit_confirmation=true`
-  управляют workspace-каталогом «Вариантов рассылки». Передавай выбранный UUID как
-  `mailing_variant_id` в direct, durable или batch GetCourse wave; analytics принимает тот же
-  фильтр. Удаление использованного варианта архивирует его и сохраняет историю когорт.
-- **GetCourse school bindings** — `besales_platform_settings_update` принимает
-  `getcourse_settings.wave_field_bindings`: роли `launch_type/product/segment/funnel/channels`
-  связываются с numeric custom-field ID сделки; `product_value_source` выбирает код или название
-  продукта, а `null` очищает настройку школы.
+  workbook ingestion from xlsx and Google Sheets. Inspect is a bounded inventory;
+  `besales_workbook_sheet_read` traverses late rows and columns with source identity,
+  truncation evidence and a page fingerprint. Dedicated tools expose saved classification
+  and archival state.
 
 ## Resources
 
-The package exposes 38 MCP resources. The dialogue-audit workflow is:
+The package exposes the MCP resources declared in `src/schemas/mcp-tools.json`. The dialogue-audit workflow is:
 
 - `besales://workflows/audit-dialogues`
 
@@ -438,7 +414,10 @@ Inspect them locally:
 yarn dlx @modelcontextprotocol/inspector node bin/besales-mcp.js
 ```
 
-The Inspector should show 253 tools, 38 resources, and 5 optional prompts.
+The Inspector should show all active tools declared in `src/schemas/mcp-tools.json`,
+the resources declared in `src/schemas/mcp-tools.json`, and 5 optional task prompts. Prompts are shortcuts for configuring
+or improving an agent, dialogue audit, campaign reporting, and diagnostics; the
+same scenarios remain available as ordinary requests on hosts without prompts.
 
 ## Codex Dialogue Audit Skill
 
@@ -476,59 +455,25 @@ Host-specific local setup and smoke steps for MCP Inspector, Claude Desktop,
 Claude Code, and Codex CLI are documented in
 [docs/host-setup.md](docs/host-setup.md).
 
+Правило переноса возможностей прежней линии (домен в `besales-api` раньше инструмента) и
+состояние переноса зафиксированы в
+[docs/main-transfer-dependencies.md](docs/main-transfer-dependencies.md).
+
 ## Scope
 
 - Claude Desktop / Claude Code / Codex call this package through MCP.
-- This package calls Animaly only through `ai-aniomaly` `/api/v2/*`.
+- This package calls Besales only through `besales-api` `/api/v2/*`.
 - Direct calls to `prompt-services` are intentionally out of scope.
 
-The package exposes 253 active MCP tools from `src/schemas/mcp-tools.json`.
+The package exposes the MCP tools declared in `src/schemas/mcp-tools.json`.
 
 ### Token scopes
 
-`besales-mcp connect` requests one canonical set, declared as `MCP_OAUTH_SCOPES`
-in `src/auth/oauth-client.ts`:
-
-| Scope | Covers |
-|---|---|
-| `mcp:*` | composite base — reads, PromptHub, ICP, sandbox, knowledge, dialogue export, analytics aggregates |
-| `mcp:platform-setup` | setup mutations: knowledge ingestion, variables, CRM pipelines, platform settings/provisioning, clone, the Platform Setup Bridge, waves |
-| `mcp:funnel-test` | frozen follow-up funnel test against a live person |
-| `read:campaigns` | cold-welcome preview, broadcast reads and their message texts |
-| `launch:campaigns` | cold-welcome and broadcast launches |
-| `read:contacts` | contact search, cards, and safe diagnostics |
-| `write:operators` | CAS-protected workspace-operator assignment; no message send or CRM mutation |
-
-None of these is implied by another: a plain `mcp:*` key authorizes neither setup
-mutations nor campaigns, and `mcp:platform-setup` does not imply the right to send
-to real people. Existing connections are never widened silently — after upgrading,
-reconnect once to be granted a newly added scope.
-
-> **⚠️ Invariant — the scope set only ever GROWS.**
-> A new scope is **appended** to `MCP_OAUTH_SCOPES`; existing entries are never removed,
-> renamed or reordered. Replacing an entry silently narrows every key issued from then on,
-> and `connect` gives no sign of it: consent opens, the key is issued, tools load, and the
-> loss only surfaces much later as a 403 from one endpoint. That is exactly how
-> `read:campaigns` + `launch:campaigns` were lost when `mcp:funnel-test` was added
-> (2026-08-19) — the set used to be one flat string, and the string was rewritten.
-> The same rule applies to the backend's `MCP_OPTIONAL_CONNECT_SCOPES`, the consent-page
-> allowlist `OPTIONAL_OAUTH_SCOPES`, and the `scope` enum in the OpenAPI contract:
-> add a line, never swap one.
-
-`connect` prints the granted set, and warns on stderr when the new key carries fewer
-permissions than the one it replaces:
-
-```
-Connected to workspace Animaly [de86534d-…] (key: mcp_a1b2…, account: o***@besales.ai).
-Scopes: mcp:* mcp:platform-setup mcp:funnel-test read:campaigns launch:campaigns read:contacts write:operators
-Active workspace: de86534d-….
-
-WARNING: this key has FEWER permissions than the one it replaced.
-  Lost: read:campaigns, launch:campaigns
-  Tools needing them will fail with 403 "API key does not have required scopes".
-  Update the client (npx -y @besales/mcp@latest) and run `besales-mcp connect` again.
-```
+Read and PromptHub/ICP/sandbox operations are covered by the composite `mcp:*`
+scope granted during `connect`. Setup mutations (knowledge ingestion, variables,
+CRM pipelines, platform settings/provisioning, clone, the Platform Setup Bridge,
+etc.) additionally require the `mcp:platform-setup` scope — a plain `mcp:*` key
+on its own does not authorize setup mutations.
 
-The comparison is made by the backend (`dropped_scopes` in the `/auth/mcp-token`
-response) against the newest live MCP key of that workspace — the client cannot read
-an old key's scopes on its own.
+Приём прежних настроек пересказа диалога и поиска по знаниям описан в
+[docs/legacy-action-settings.md](docs/legacy-action-settings.md).

package/README.onprem.ru.md

@@ -0,0 +1,35 @@
+# MCP для собственной установки
+
+Мост запускается на компьютере пользователя MCP-хоста, не на сервере API. Поставщик передаёт архив под его ОС/архитектуру, готовые production dependencies (включая native keytar), `onprem.json` и Node.js ≥20. Сборка и доступ к npm клиенту не нужны. На Linux нужен libsecret и работающая пользовательская служба Secret Service; macOS использует Keychain, Windows — Credential Manager.
+
+Распакуй архив в постоянный каталог. Проверь SHA-256, полученный с поставкой. Используй отдельный профиль ОС для этой установки: стандартный keychain service `@besales/mcp` общий с облачным мостом. Не копируй облачные credentials. Затем:
+
+```sh
+node /absolute/besales-mcp/bin/besales-onprem.mjs connect
+node /absolute/besales-mcp/bin/besales-onprem.mjs status
+```
+
+Браузер открывает `https://<домен-клиента>/api/v2/auth/mcp-connect/start`. Одноразовый код возвращается на `http://127.0.0.1:<случайный-порт>/oauth-callback`; PKCE-обмен идёт на `https://<домен-клиента>/api/v2/auth/mcp-token`. Нужен браузер на этом же компьютере и доступ к HTTPS API. API должен иметь собственный `MCP_CONNECT_CONSENT_SECRET` (создаётся `init-config.sh`). Все проверки доступа, согласие, scopes и PKCE остаются штатными.
+
+Настройка MCP-хоста (обычный stdio):
+
+```json
+{
+  "mcpServers": {
+    "besales-client": {
+      "command": "node",
+      "args": ["/absolute/besales-mcp/bin/besales-onprem.mjs"],
+      "env": {
+        "BESALES_API_BASE_URL": "https://app.customer.example/api/v2",
+        "BESALES_OAUTH_AUTHORIZE_URL": "https://app.customer.example/api/v2/auth/mcp-connect/start"
+      }
+    }
+  }
+}
+```
+
+В этой поставке launcher всегда берёт оба адреса из `onprem.json` до загрузки клиента: чужие значения окружения MCP-хоста не переключают установку на облако. Не запускай `dist/cli.js` напрямую. При смене домена получи новый конфигурационный файл от администратора и подключись заново.
+
+На сервере мост не хранит данные и не нуждается в PostgreSQL/Redis/томе. Архив и `onprem.json` сохраняются вместе с поставкой; ключи — в защищённом хранилище ОС пользователя. Для восстановления на другом компьютере распакуй архив подходящей платформы и выполни `connect` заново. Для отзыва используй штатное отключение ключа в API и `disconnect --all`.
+
+Поставщику: в отдельной Linux/macOS/Windows build-копии с immutable install выполни `node scripts/build-onprem.mjs https://app.customer.example/api/v2 /new/output`, затем архивируй output и передай SHA-256. Скрипт переводит build-копию зависимостей в production, поэтому не запускай его в рабочем дереве разработчика.

package/bin/besales-mcp-http.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+
+import { runHttpMcpServer } from '../dist/http-server.js';
+import { logger } from '../dist/utils/logger.js';
+
+runHttpMcpServer().catch(() => {
+  logger.error('Could not start Besales MCP HTTP server');
+  process.exit(1);
+});

package/bin/besales-onprem.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// Конфигурация поставщика обязательна; настройки чужого MCP-хоста её не заменяют.
+import { readFileSync } from 'node:fs';
+const config = JSON.parse(readFileSync(new URL('../onprem.json', import.meta.url), 'utf8'));
+const base = new URL(config.apiBaseUrl);
+if (
+  base.protocol !== 'https:' ||
+  base.username ||
+  base.password ||
+  base.search ||
+  base.hash ||
+  base.pathname !== '/api/v2' ||
+  config.oauthAuthorizeUrl !== `${base.href}/auth/mcp-connect/start`
+)
+  throw new Error('Invalid customer MCP configuration');
+process.env.BESALES_API_BASE_URL = base.href;
+process.env.BESALES_OAUTH_AUTHORIZE_URL = config.oauthAuthorizeUrl;
+const { runCli } = await import('../dist/cli.js');
+process.exitCode = await runCli();

package/dist/auth/connection-store.d.ts

@@ -46,7 +46,9 @@ export declare class ConnectionStore {
      * на rejected состоянии и повторить при следующем вызове.
      */
     migrateLegacy(): Promise<void>;
-    list(): Promise<ConnectionMeta[]>;
+    list({ strict }?: {
+        readonly strict?: boolean;
+    }): Promise<ConnectionMeta[]>;
     getKey(workspaceId: string): Promise<string | null>;
     getActive(): Promise<string | null>;
     setActive(workspaceId: string): Promise<void>;

package/dist/auth/connection-store.js

@@ -45,8 +45,8 @@ export class ConnectionStore {
         }
         return this.legacyMigrationPromise;
     }
-    async list() {
-        return this.readIndex();
+    async list({ strict = false } = {}) {
+        return this.readIndex(strict);
     }
     async getKey(workspaceId) {
         return this.storage.get(keyAccount(workspaceId));
@@ -193,7 +193,7 @@ export class ConnectionStore {
         await this.storage.delete(LEGACY_WORKSPACE_ID_ACCOUNT);
         logger.info({ workspaceId: legacyWorkspaceId }, 'Migrated legacy credentials to multi-workspace store');
     }
-    async readIndex() {
+    async readIndex(strict = false) {
         const raw = await this.storage.get(INDEX_ACCOUNT);
         if (!raw) {
             return [];
@@ -201,11 +201,17 @@ export class ConnectionStore {
         try {
             const parsed = JSON.parse(raw);
             if (!Array.isArray(parsed)) {
+                if (strict)
+                    throw new Error('Connection index is corrupt.');
                 return [];
             }
+            if (strict && !parsed.every(isConnectionMeta))
+                throw new Error('Connection index is corrupt.');
             return parsed.filter(isConnectionMeta);
         }
         catch {
+            if (strict)
+                throw new Error('Connection index is corrupt.');
             logger.warn('Connection index is corrupt — treating as empty');
             return [];
         }

package/dist/auth/connection-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection-store.js","sourceRoot":"","sources":["../../src/auth/connection-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAEL,sBAAsB,EACtB,2BAA2B,EAC3B,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO,GAAG,kBAAkB,GAAG,WAAW,EAAE,CAAC;AAC/C,CAAC;AAuBD;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAIG;IAHrB,sBAAsB,CAAiB;IACvC,kBAAkB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE9D,YAA6B,UAA2B,IAAI,YAAY,EAAE;QAA7C,YAAO,GAAP,OAAO,CAAsC;IAAG,CAAC;IAE9E;;;;OAIG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC/E,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,sBAAsB,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,wBAAwB,CAChC,aAAa,WAAW,uDAAuD,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAAiF;QAEjF,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,IAAI,CACnC,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,WAAmB,EACnB,MAAiF;QAEjF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,wBAAwB,CAAC,aAAa,WAAW,oBAAoB,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,OAAO,GAAmB;YAC9B,GAAG,OAAO;YACV,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa;SAC7D,CAAC;QACF,MAAM,IAAI,CAAC,UAAU,CACnB,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC3F,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAAc,EACd,SAA2B,EAAE;QAE7B,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;YAExD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YACxF,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC;YAChE,MAAM,IAAI,GAAmB;gBAC3B,WAAW;gBACX,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC;gBAC7B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,EAAE,aAAa;gBAClE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,YAAY;gBACzF,cAAc,EAAE,cAAc;oBAC5B,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC1B,CAAC,CAAC,YAAY,EAAE,cAAc;gBAChC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,EAAE,aAAa;aACnE,CAAC;YACF,MAAM,IAAI,GAAG;gBACX,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC;gBACvE,IAAI;aACL,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAE5B,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACnE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,8EAA8E;QAC9E,iDAAiD;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;YAC9B,aAAa;YACb,cAAc;YACd,sBAAsB;YACtB,2BAA2B;SAC5B,CAAC,CAAC;QAEH,KAAK,MAAM,UAAU,IAAI,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACpD,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBAC3C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAC5D,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QAC/E,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,iBAAiB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,UAAU,CAAC;YACpB;gBACE,WAAW,EAAE,iBAAiB;gBAC9B,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;gBAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACtC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;QAE1D,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAEvD,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAClC,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,WAA6B;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,WAAmB,EACnB,OAAsB,EACtB,YAA2B,EAC3B,UAAyB;QAEzB,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,aAA4B;QACxE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,CACL,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,gBAAgB,CAAC,SAAS,CAAC,aAAa,CAAC;QACzC,wBAAwB,CAAC,SAAS,CAAC,YAAY,CAAC;QAChD,gBAAgB,CAAC,SAAS,CAAC,cAAc,CAAC;QAC1C,qBAAqB,CAAC,SAAS,CAAC,aAAa,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC1D,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC5E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;AAC1G,CAAC"}
+{"version":3,"file":"connection-store.js","sourceRoot":"","sources":["../../src/auth/connection-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAEL,sBAAsB,EACtB,2BAA2B,EAC3B,YAAY,GACb,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AACvC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO,GAAG,kBAAkB,GAAG,WAAW,EAAE,CAAC;AAC/C,CAAC;AAuBD;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAIG;IAHrB,sBAAsB,CAAiB;IACvC,kBAAkB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE9D,YAA6B,UAA2B,IAAI,YAAY,EAAE;QAA7C,YAAO,GAAP,OAAO,CAAsC;IAAG,CAAC;IAE9E;;;;OAIG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACjC,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC/E,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,sBAAsB,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,KAAoC,EAAE;QAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,wBAAwB,CAChC,aAAa,WAAW,uDAAuD,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAAiF;QAEjF,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,IAAI,CACnC,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,WAAmB,EACnB,MAAiF;QAEjF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,wBAAwB,CAAC,aAAa,WAAW,oBAAoB,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,OAAO,GAAmB;YAC9B,GAAG,OAAO;YACV,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa;SAC7D,CAAC;QACF,MAAM,IAAI,CAAC,UAAU,CACnB,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAC3F,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,MAAc,EACd,SAA2B,EAAE;QAE7B,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;YAExD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YACxF,MAAM,cAAc,GAAG,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC;YAChE,MAAM,IAAI,GAAmB;gBAC3B,WAAW;gBACX,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC;gBAC7B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,EAAE,aAAa;gBAClE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,YAAY;gBACzF,cAAc,EAAE,cAAc;oBAC5B,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAC1B,CAAC,CAAC,YAAY,EAAE,cAAc;gBAChC,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,EAAE,aAAa;aACnE,CAAC;YACF,MAAM,IAAI,GAAG;gBACX,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC;gBACvE,IAAI;aACL,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAE5B,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YACnE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,8EAA8E;QAC9E,iDAAiD;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;YAC9B,aAAa;YACb,cAAc;YACd,sBAAsB;YACtB,2BAA2B;SAC5B,CAAC,CAAC;QAEH,KAAK,MAAM,UAAU,IAAI,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACpD,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBAC3C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAC5D,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QAC/E,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,iBAAiB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,UAAU,CAAC;YACpB;gBACE,WAAW,EAAE,iBAAiB;gBAC9B,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;gBAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACtC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;QAE1D,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;QAEvD,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,iBAAiB,EAAE,EAClC,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,KAAK;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,IAAI,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAC5D,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAE/F,OAAO,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC/D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,WAA6B;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,WAAmB,EACnB,OAAsB,EACtB,YAA2B,EAC3B,UAAyB;QAEzB,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,aAA4B;QACxE,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,CACL,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QACvC,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;QACzC,gBAAgB,CAAC,SAAS,CAAC,aAAa,CAAC;QACzC,wBAAwB,CAAC,SAAS,CAAC,YAAY,CAAC;QAChD,gBAAgB,CAAC,SAAS,CAAC,cAAc,CAAC;QAC1C,qBAAqB,CAAC,SAAS,CAAC,aAAa,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC1D,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AAC5E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;AAC1G,CAAC"}