@evalops/maestro 0.10.50 → 0.10.51

package/dist/agent/transport/tool-execution-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-execution-bridge.js","sourceRoot":"","sources":["../../../src/agent/transport/tool-execution-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,2CAA2C,EAC3C,oBAAoB,EACpB,+BAA+B,EAC/B,oCAAoC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAWN,uBAAuB,EACvB,qCAAqC,EACrC,iCAAiC,EACjC,+BAA+B,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAWxE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,MAAM,GAAG,YAAY,CAAC,iCAAiC,CAAC,CAAC;AAE/D,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAC9C,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,uBAAuB,GAAG;IAC/B,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,UAAU;IACV,SAAS;IACT,eAAe;IACf,eAAe;IACf,UAAU;IACV,YAAY;IACZ,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,UAAU;IACV,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,MAAM;IACN,OAAO;CACP,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAEtC,MAAM,qBAAqB,GAAG;IAC7B,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,uIAAuI;IACvI,YAAY;IACZ,SAAS;IACT,uDAAuD;IACvD,yCAAyC;IACzC,iBAAiB;IACjB,SAAS;IACT,eAAe;IACf,UAAU;IACV,YAAY;IACZ,0CAA0C;IAC1C,wCAAwC;IACxC,0DAA0D;IAC1D,yCAAyC;IACzC,iBAAiB;CACR,CAAC;AAEX,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO;IACP,QAAQ;IACR,UAAU;IACV,eAAe;IACf,aAAa;IACb,aAAa;IACb,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,IAAI;CACJ,CAAC,CAAC;AAwGH,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC/C,mHAAmH;IACnH,MAAM,UAAU,GAAG,KAAK,EAAE,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,eAAe,GAAG,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACnD,MAAM;QACP,CAAC;QACD,MAAM,IAAI,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACpD,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,0BAA0B;IAClC,IAAI,CAAC;QACJ,OAAO,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtE,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,uBAAuB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACxE,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAkB;IACrD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAChB,CAAC,GAAG,EAAE,EAAE,CACP,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAC1B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,IACC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QAChC,mCAAmC,CAAC,IAAI,CAAC,UAAU,CAAC;QACpD,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC;QACrC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAC1C,CAAC;QACF,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAC9E,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC9B,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO;QACN,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9D,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,QAAkB,EAClB,OAA8B,EAC9B,OAGC;IAED,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,OAAO,GACZ,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;YAC7C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO;YAC5B,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GACT,UAAU,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACjE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO;YACN,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC;YACtC,IAAI,EAAE;gBACL,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;gBACxC,UAAU,EAAE,mBAAmB;gBAC/B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;gBAChE,UAAU,EAAE,UAAU;gBACtB,eAAe,EAAE,CAAC,UAAU;aAC5B;SACD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAuB,OAAO,CAAC,eAAe;QACvD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACrE,OAAO;QACN,MAAM,EAAE,KAAK;QACb,IAAI;QACJ,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB;QAC7D,IAAI,EAAE;YACL,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACxC,UAAU,EAAE,OAAO,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE;YACvG,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,QAAQ;YACpB,eAAe,EAAE,CAAC,QAAQ;SAC1B;QACD,SAAS,EAAE;YACV,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,YAAY,EAAE,YAAY;SAC1B;KACD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA4B,CAAC;AACrE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI;QACrB,qCAAqC;QACrC,uCAAuC;QACvC,4BAA4B;KAC5B,EAAE,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB;IAIrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO;SACzB,MAAM,CACN,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CACtE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;gBACtB,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,gBAAgB;YACnB,UAAU,EAAE,EAAE;SACd,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC1D,MAAM,SAAS,GACd,SAAS,CAAC,MAAM,GAAG,iCAAiC;QACnD,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAiC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK;QAC7E,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO;QACN,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAC/B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAyB,EACzB,UAA8B;IAE9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG;QAClB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;QAC/C,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,UAAU;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;KACxB,CAAC;IACF,OAAO;QACN,UAAU;QACV,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,kBAAkB;QAC/B,GAAG,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACpB,GAAmB,EACnB,QAAkB,EAClB,cAAkC,EAClC,WAAmB,EACnB,cAA6D;IAE7D,MAAM,SAAS,GACd,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC;QACrC,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GACf,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC;QACtC,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvC,OAAO;QACN,WAAW,EAAE,UAAU,CAAC,cAAc,EAAE,WAAW,CAAC,IAAI,WAAW;QACnE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,EACN,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC;YACnC,WAAW,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACjC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxC,SAAS;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC;QAClD,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtE,OAAO,EAAE,WAAW,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,SAAS;QACtD,SAAS,EAAE,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAC9C,aAAa,EAAE,GAAG,SAAS,IAAI,SAAS,IAAI,QAAQ,CAAC,EAAE,EAAE;KACzD,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CACnC,OAA6B;IAE7B,MAAM,GAAG,GACR,mBAAmB,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,0BAA0B,EAAE,CAAC;IACtE,MAAM,aAAa,GAAG,mBAAmB,CAAC;QACzC,wBAAwB;QACxB,gBAAgB;KAChB,CAAC,CAAC;IACH,MAAM,cAAc,GACnB,mBAAmB,CAAC;QACnB,yBAAyB;QACzB,mBAAmB;QACnB,kBAAkB;KAClB,CAAC,IAAI,aAAa,CAAC;IACrB,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACtC,wBAAwB;QACxB,mBAAmB;QACnB,iBAAiB;KACjB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC;QACrC,oBAAoB;QACpB,iBAAiB;QACjB,iBAAiB;QACjB,oBAAoB;QACpB,uBAAuB;KACvB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC;QACrC,oBAAoB;QACpB,YAAY;QACZ,eAAe;QACf,uBAAuB;KACvB,CAAC,CAAC;IAEH,OAAO;QACN,GAAG,CAAC,OAAO,CAAC,cAAc;YACzB,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,cAAc,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,yBAAyB,EAAE,OAAO,CAAC,MAAM;QACzC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,aAAa;YACxB,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,aAAa,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,KAA+B,EAC/B,cAA2C,EAC3C,OAA6B,EAC7B,cAA6D;IAE7D,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAoC,CAAC;IACzE,MAAM,iBAAiB,GACtB,eAAe,CAAC,YAAY,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,SAAS,GACd,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACjC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC;QACrC,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrC,MAAM,qBAAqB,GAC1B,UAAU,CAAC,cAAc,EAAE,qBAAqB,CAAC;QACjD,WAAW,CAAC;YACX,kCAAkC;YAClC,2BAA2B;SAC3B,CAAC,CAAC;IACJ,OAAO;QACN,mBAAmB,EAAE,cAAc,CAAC,IAAI;QACxC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QACvC,GAAG,2BAA2B,CAAC,OAAO,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,qBAAqB;YACxB,CAAC,CAAC,EAAE,gCAAgC,EAAE,qBAAqB,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,KAAK,CAAC,YAAY;YACrB,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,YAAY,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,iBAAiB;YAC1B,CAAC,CAAC,EAAE,0BAA0B,EAAE,KAAK,CAAC,iBAAiB,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,0BAA0B,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrD,mBAAmB,EAAE,cAAc,CAAC,MAAM;QAC1C,qCAAqC,EAAE,MAAM,CAC5C,cAAc,CAAC,IAAI,KAAK,UAAU,CAClC;KACD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,KAA+B,EAC/B,MAAkC,EAClC,cAA2C,EAC3C,cAA6D;IAE7D,MAAM,OAAO,GAAG,YAAY,CAC3B,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,QAAQ,EACd,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,EACnC,cAAc,CACd,CAAC;IACF,OAAO;QACN,OAAO;QACP,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,GAAG,CAAC,cAAc,CAAC,SAAS;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACN,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC;QAC3C,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,WAAW,EAAE;YACZ,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;YACjB,UAAU,EAAE,CAAC;YACb,uBAAuB,EAAE,KAAK;SAC9B;QACD,cAAc,EAAE,WAAW,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE;QAC9C,QAAQ,EAAE,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC;KACvE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,cAA2C,EAC3C,MAAkC,EAClC,OAAmC,EACnC,QAAqC;IAErC,OAAO;QACN,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,UAAU;QAChB,cAAc;QACd,MAAM;QACN,OAAO;QACP,QAAQ,EAAE;YACT,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;YACtC,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB;SACrE;QACD,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW;KACzD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,KAA+B,EAC/B,IAA+B,EAC/B,SAAsC;IAEtC,OAAO;QACN,EAAE,EACD,SAAS,CAAC,YAAY,EAAE,iBAAiB;YACzC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YAC/B,KAAK,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,IAAI,EAAE,KAAK,CAAC,aAAa;QACzB,MAAM,EACL,SAAS,CAAC,YAAY,EAAE,MAAM;YAC9B,SAAS,CAAC,YAAY;YACtB,6CAA6C;QAC9C,QAAQ,EAAE;YACT,MAAM,EAAE,gBAAgB;YACxB,eAAe,EAAE,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC9D,iBAAiB,EAChB,SAAS,CAAC,YAAY,EAAE,iBAAiB;gBACzC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;SAChC;KACD,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB;IAChC,OAAO,oBAAoB,CAAC,2CAA2C,CAAC,CAAC;AAC1E,CAAC;AA0BD,MAAM,OAAO,kCAAkC;IAK9C,YAAY,UAAqD,EAAE;QAClE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CACZ,KAA+B,EAC/B,MAAoB;QAEpB,IAAI,wBAAwB,EAAE,EAAE,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,OAAO,GAAG;YACf,cAAc,EACb,+BAA+B,EAAE;gBACjC,oCAAoC,EAAE;YACvC,eAAe,EAAE,oCAAoC,EAAE;SACvD,CAAC;QACF,MAAM,cAAc,GAAG,qBAAqB,CAC3C,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,EACb,OAAO,CACP,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iCAAiC,EAAE,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,OAAO,GAAG,mBAAmB,CAClC,KAAK,EACL,MAAM,EACN,cAAc,EACd,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAC1C,CAAC;QACF,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO;gBACN,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,SAAS;oBACf,cAAc;oBACd,MAAM;oBACN,OAAO;oBACP,QAAQ,EAAE,EAAE;iBACZ;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzE,QAAQ,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAClC,KAAK,6BAA6B;oBACjC,OAAO;wBACN,MAAM,EAAE,MAAM;wBACd,IAAI;wBACJ,MAAM,EACL,QAAQ,CAAC,SAAS,CAAC,YAAY;4BAC/B,yCAAyC;qBAC1C,CAAC;gBACH,KAAK,uCAAuC;oBAC3C,OAAO;wBACN,MAAM,EAAE,eAAe;wBACvB,IAAI;wBACJ,OAAO,EAAE,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC;qBAC7D,CAAC;gBACH;oBACC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACnC,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,uCAAuC,OAAO,EAAE;aACxD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,KAA+B,EAC/B,IAA+B,EAC/B,QAAgC,EAChC,MAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC3D,OAAO,QAAQ,CAAC,QAAQ;gBACvB,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC3B,CAAC,CAAC;oBACA,MAAM,EAAE,MAAM;oBACd,IAAI;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,iBAAiB;iBAC5C,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAuC;YACnD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE;YAChD,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YAClD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EACR,QAAQ,CAAC,UAAU,KAAK,MAAM;gBAC7B,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;gBAC5C,CAAC,CAAC,QAAQ;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACrD,IAAI,CAAC,MAAM,EACX,OAAO,EACP,MAAM,CACN,CAAC;YACF,MAAM,QAAQ,GAA8B;gBAC3C,GAAG,IAAI;gBACP,QAAQ,EAAE;oBACT,eAAe,EACd,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;oBACvD,iBAAiB,EAChB,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB;wBAClD,IAAI,CAAC,QAAQ,CAAC,iBAAiB;iBAChC;aACD,CAAC;YACF,QAAQ,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAClC,KAAK,6BAA6B,CAAC;gBACnC,KAAK,6BAA6B,CAAC;gBACnC,KAAK,gCAAgC;oBACpC,OAAO;wBACN,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,QAAQ;wBACd,MAAM,EACL,QAAQ,CAAC,SAAS,CAAC,YAAY;4BAC/B,QAAQ,CAAC,MAAM;4BACf,0CAA0C;qBAC3C,CAAC;gBACH;oBACC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC7C,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,QAAQ;gBACvB,CAAC,CAAC;oBACA,MAAM,EAAE,MAAM;oBACd,IAAI;oBACJ,MAAM,EAAE,gDAAgD,OAAO,EAAE;iBACjE;gBACF,CAAC,CAAC;oBACA,MAAM,EAAE,MAAM;oBACd,IAAI;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,oBAAoB,OAAO,GAAG;iBACzD,CAAC;QACL,CAAC;IACF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACtB,IAA8B,EAC9B,MAAyB,EACzB,MAAoB;QAEpB,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAA+B;YAC3C,GAAG,IAAI,CAAC,OAAO;YACf,QAAQ,EAAE;gBACT,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;gBACxB,mBAAmB,EAAE,SAAS;gBAC9B,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;gBAC9D,4BAA4B,EAAE,OAAO,CAAC,OAAO;gBAC7C,+BAA+B,EAC9B,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM;aACtE;SACD,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC7C,IAAI,CAAC,MAAM,EACX,OAAO,EACP,MAAM,CACN,CAAC;YACF,OAAO;gBACN,QAAQ,EAAE;oBACT,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;oBACtC,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB;iBACrE;aACD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC3D,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC;gBACtC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;gBAChC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB;aACvD,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,oBAAoB,CACzB,IAA+B,EAC/B,MAAyB,EACzB,UAAmB,EACnB,MAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAA6C;YACzD,WAAW;YACX,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;YAC9C,QAAQ,EAAE;gBACT,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;gBACxB,mBAAmB,EAAE,UAAU;gBAC/B,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;gBAC9D,oBAAoB,EAAE,MAAM,CAAC,UAAU;aACvC;SACD,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC3D,IAAI,CAAC,MAAM,EACX,OAAO,EACP,MAAM,CACN,CAAC;YACF,OAAO;gBACN,QAAQ,EAAE;oBACT,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,WAAW;oBACrD,iBAAiB,EAChB,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB;wBAClD,IAAI,CAAC,QAAQ,CAAC,iBAAiB;iBAChC;aACD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;gBAC9D,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC;gBACtC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,WAAW;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;IACF,CAAC;CACD;AAED,SAAS,qBAAqB,CAC7B,QAA+D;IAE/D,OAAO,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED,IAAI,aAAa,GAAuC,IAAI,CAAC;AAE7D,MAAM,UAAU,qCAAqC;IACpD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,aAAa,GAAG,IAAI,kCAAkC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,IAAyC,EACzC,WAAmD;IAEnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,OAAO;QACN,eAAe,EACd,WAAW,EAAE,QAAQ,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;QACvE,iBAAiB,EAChB,WAAW,EAAE,QAAQ,CAAC,iBAAiB;YACvC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;KAChC,CAAC;AACH,CAAC","sourcesContent":["import {\n\tMAESTRO_PLATFORM_RUNTIME_BRIDGE_KILL_SWITCH,\n\tisFeatureFlagEnabled,\n\tisPlatformRuntimeObserveEnabled,\n\tisPlatformToolExecutionBridgeEnabled,\n} from \"../../config/feature-flags.js\";\nimport {\n\ttype ExecutePlatformToolRequest,\n\ttype ExecutePlatformToolResponse,\n\ttype PlatformConnectorRef,\n\ttype PlatformToolExecutionRecord,\n\ttype PlatformToolRef,\n\ttype RecordPlatformToolExecutionOutputRequest,\n\ttype ResumePlatformToolExecutionRequest,\n\ttype ToolExecutionLinkage,\n\ttype ToolExecutionRiskLevel,\n\ttype ToolExecutionServiceConfig,\n\texecuteToolWithPlatform,\n\trecordToolExecutionOutputWithPlatform,\n\tresolveToolExecutionServiceConfig,\n\tresumeToolExecutionWithPlatform,\n} from \"../../platform/tool-execution-client.js\";\nimport { isReadOnlyTool } from \"../../tools/parallel-execution.js\";\nimport { isAbortError } from \"../../utils/abort-error.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nimport { sanitizeWithStaticMask } from \"../../utils/secret-redactor.js\";\nimport type {\n\tActionApprovalDecision,\n\tActionApprovalRequest,\n} from \"../action-approval.js\";\nimport type {\n\tAgentRunConfig,\n\tAgentTool,\n\tToolCall,\n\tToolResultMessage,\n} from \"../types.js\";\nimport { stableStringify } from \"./stable-stringify.js\";\n\nconst logger = createLogger(\"transport:tool-execution-bridge\");\n\nconst OBSERVE_OUTPUT_SUMMARY_MAX_LENGTH = 280;\nconst METADATA_VALUE_MAX_LENGTH = 512;\nconst READ_ONLY_BASH_PREFIXES = [\n\t\"cat\",\n\t\"cd\",\n\t\"df\",\n\t\"du\",\n\t\"echo\",\n\t\"env\",\n\t\"find\",\n\t\"git diff\",\n\t\"git log\",\n\t\"git remote -v\",\n\t\"git rev-parse\",\n\t\"git show\",\n\t\"git status\",\n\t\"grep\",\n\t\"head\",\n\t\"ls\",\n\t\"pwd\",\n\t\"printenv\",\n\t\"ps\",\n\t\"rg\",\n\t\"sed -n\",\n\t\"tail\",\n\t\"which\",\n].map((value) => value.toLowerCase());\n\nconst BASH_MUTATION_MARKERS = [\n\t/\\bchmod\\b/u,\n\t/\\bchown\\b/u,\n\t/\\bcp\\b/u,\n\t/\\bgit\\s+(add|am|apply|branch|checkout|cherry-pick|clean|commit|merge|mv|pull|push|rebase|reset|restore|revert|rm|stash|switch|tag)\\b/u,\n\t/\\bmkdir\\b/u,\n\t/\\bmv\\b/u,\n\t/\\bnpm\\s+(install|publish|uninstall|update|version)\\b/u,\n\t/\\bpnpm\\s+(add|install|remove|update)\\b/u,\n\t/\\bpython\\b.*-c/u,\n\t/\\brm\\b/u,\n\t/\\bsed\\s+-i\\b/u,\n\t/\\btee\\b/u,\n\t/\\btouch\\b/u,\n\t/\\byarn\\s+(add|install|remove|upgrade)\\b/u,\n\t/\\bbun\\s+(add|install|remove|update)\\b/u,\n\t/\\bkubectl\\s+(apply|create|delete|patch|replace|scale)\\b/u,\n\t/\\bterraform\\s+(apply|destroy|import)\\b/u,\n\t/(^|[^<])>{1,2}/u,\n] as const;\n\nconst READ_ONLY_GIT_BRANCH_ARGS = new Set([\n\t\"--all\",\n\t\"--list\",\n\t\"--merged\",\n\t\"--no-contains\",\n\t\"--no-merged\",\n\t\"--points-at\",\n\t\"--remotes\",\n\t\"-a\",\n\t\"-l\",\n\t\"-r\",\n]);\n\nexport type PlatformBridgeMode = \"observe\" | \"governed\";\n\nexport interface ToolExecutionBridgeMetadata {\n\ttoolExecutionId?: string;\n\tapprovalRequestId?: string;\n}\n\nexport interface ObserveToolExecutionPlan {\n\tkind: \"observe\";\n\tmode: \"observe\";\n\tclassification: ToolExecutionClassification;\n\tconfig: ToolExecutionServiceConfig;\n\trequest: ExecutePlatformToolRequest;\n\tmetadata: ToolExecutionBridgeMetadata;\n}\n\nexport interface GovernedToolExecutionPlan {\n\tkind: \"governed\";\n\tmode: \"governed\";\n\tclassification: ToolExecutionClassification;\n\tconfig: ToolExecutionServiceConfig;\n\trequest: ExecutePlatformToolRequest;\n\tmetadata: ToolExecutionBridgeMetadata;\n\tresumeToken?: string;\n}\n\nexport type ToolExecutionBridgePlan =\n\t| ObserveToolExecutionPlan\n\t| GovernedToolExecutionPlan;\n\nexport type ToolExecutionBridgePreparation =\n\t| {\n\t\t\tstatus: \"skip\";\n\t  }\n\t| {\n\t\t\tstatus: \"observe\";\n\t\t\tplan: ObserveToolExecutionPlan;\n\t  }\n\t| {\n\t\t\tstatus: \"allow\";\n\t\t\tplan: GovernedToolExecutionPlan;\n\t  }\n\t| {\n\t\t\tstatus: \"wait_approval\";\n\t\t\tplan: GovernedToolExecutionPlan;\n\t\t\trequest: ActionApprovalRequest;\n\t  }\n\t| {\n\t\t\tstatus: \"deny\";\n\t\t\tplan?: GovernedToolExecutionPlan;\n\t\t\treason: string;\n\t  };\n\nexport type ToolExecutionBridgeApprovalResolution =\n\t| {\n\t\t\tstatus: \"allow\";\n\t\t\tplan: GovernedToolExecutionPlan;\n\t  }\n\t| {\n\t\t\tstatus: \"deny\";\n\t\t\tplan: GovernedToolExecutionPlan;\n\t\t\treason: string;\n\t  };\n\nexport interface ObserveToolExecutionResult {\n\tmetadata: ToolExecutionBridgeMetadata;\n}\n\nexport interface ToolExecutionBridgeInput {\n\tcfg: AgentRunConfig;\n\ttoolCall: ToolCall;\n\ttoolDef?: AgentTool;\n\tsanitizedArgs: Record<string, unknown>;\n\tdisplayName?: string;\n\tsummaryLabel?: string;\n\tactionDescription?: string;\n}\n\nexport interface ToolExecutionBridgeRuntimeLinkage {\n\tagentRunId?: string;\n\tagentId?: string;\n\tworkspaceId?: string;\n\tsessionId?: string;\n\tremoteRunnerSessionId?: string;\n}\n\nexport type ToolExecutionBridgeRuntimeLinkageProvider =\n\t| ToolExecutionBridgeRuntimeLinkage\n\t| (() => ToolExecutionBridgeRuntimeLinkage | undefined);\n\nexport interface DefaultPlatformToolExecutionBridgeOptions {\n\truntimeLinkage?: ToolExecutionBridgeRuntimeLinkageProvider;\n}\n\ninterface ToolExecutionClassification {\n\tfamily: \"bash\" | \"mcp\";\n\tmode: PlatformBridgeMode;\n\triskLevel: ToolExecutionRiskLevel;\n\ttool: PlatformToolRef;\n\tconnector?: PlatformConnectorRef;\n}\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction getEnvValue(names: readonly string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = trimString(process.env[name]);\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction metadataValue(value: string | undefined): string | undefined {\n\t// biome-ignore lint/suspicious/noControlCharactersInRegex: metadata must neutralize C0 control characters and DEL.\n\tconst normalized = value?.replace(/[\\x00-\\x1f\\x7f]/gu, \" \");\n\tconst trimmed = trimString(normalized);\n\tif (!trimmed) {\n\t\treturn undefined;\n\t}\n\tif (trimmed.length <= METADATA_VALUE_MAX_LENGTH) {\n\t\treturn trimmed;\n\t}\n\tconst suffix = \"...\";\n\tconst maxPrefixLength = METADATA_VALUE_MAX_LENGTH - suffix.length;\n\tlet prefix = \"\";\n\tfor (const char of trimmed) {\n\t\tif (prefix.length + char.length > maxPrefixLength) {\n\t\t\tbreak;\n\t\t}\n\t\tprefix += char;\n\t}\n\treturn `${prefix.trimEnd()}${suffix}`;\n}\n\nfunction getMetadataEnvValue(names: readonly string[]): string | undefined {\n\treturn metadataValue(getEnvValue(names));\n}\n\nfunction getCurrentWorkingDirectory(): string | undefined {\n\ttry {\n\t\treturn metadataValue(process.cwd());\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction buildShellCommandSummary(command: string): string {\n\tconst normalized = command.replace(/\\s+/gu, \" \").trim();\n\tif (normalized.length <= 96) {\n\t\treturn normalized;\n\t}\n\treturn `${normalized.slice(0, 93).trimEnd()}...`;\n}\n\nfunction isReadOnlyBashCommand(command: string): boolean {\n\tconst normalized = command.replace(/\\s+/gu, \" \").trim().toLowerCase();\n\tif (!normalized) {\n\t\treturn false;\n\t}\n\tif (isReadOnlyGitBranchCommand(normalized)) {\n\t\treturn true;\n\t}\n\tif (BASH_MUTATION_MARKERS.some((pattern) => pattern.test(normalized))) {\n\t\treturn false;\n\t}\n\treturn READ_ONLY_BASH_PREFIXES.some(\n\t\t(prefix) => normalized === prefix || normalized.startsWith(`${prefix} `),\n\t);\n}\n\nfunction isReadOnlyGitBranchCommand(normalized: string): boolean {\n\tconst parts = normalized.split(\" \");\n\tif (parts[0] !== \"git\" || parts[1] !== \"branch\") {\n\t\treturn false;\n\t}\n\tconst args = parts.slice(2);\n\tif (args.length === 0) {\n\t\treturn true;\n\t}\n\treturn args.every(\n\t\t(arg) =>\n\t\t\tREAD_ONLY_GIT_BRANCH_ARGS.has(arg) ||\n\t\t\targ.startsWith(\"--format=\") ||\n\t\t\targ.startsWith(\"--sort=\"),\n\t);\n}\n\nfunction inferBashRiskLevel(command: string): ToolExecutionRiskLevel {\n\tconst normalized = command.toLowerCase();\n\tif (\n\t\t/\\brm\\s+-rf\\b/u.test(normalized) ||\n\t\t/\\bgit\\s+push(\\s+--force|\\s+-f)\\b/u.test(normalized) ||\n\t\t/\\bnpm\\s+publish\\b/u.test(normalized) ||\n\t\t/\\bkubectl\\s+delete\\b/u.test(normalized) ||\n\t\t/\\bterraform\\s+destroy\\b/u.test(normalized)\n\t) {\n\t\treturn \"RISK_LEVEL_CRITICAL\";\n\t}\n\treturn isReadOnlyBashCommand(command) ? \"RISK_LEVEL_LOW\" : \"RISK_LEVEL_HIGH\";\n}\n\nfunction normalizeCapabilitySegment(value: string): string {\n\treturn value.replace(/[^a-zA-Z0-9_.-]/gu, \"_\");\n}\n\nfunction parseBridgeMcpToolName(\n\tname: string,\n): { server: string; tool?: string } | null {\n\tconst parts = name.split(\"__\");\n\tif (parts[0] !== \"mcp\" || parts.length < 2) {\n\t\treturn null;\n\t}\n\tconst server = parts[1];\n\tif (!server) {\n\t\treturn null;\n\t}\n\treturn {\n\t\tserver,\n\t\ttool: parts.length > 2 ? parts.slice(2).join(\"__\") : undefined,\n\t};\n}\n\nfunction classifyToolExecution(\n\ttoolCall: ToolCall,\n\ttoolDef: AgentTool | undefined,\n\trollout: {\n\t\tobserveEnabled: boolean;\n\t\tgovernedEnabled: boolean;\n\t},\n): ToolExecutionClassification | null {\n\tif (!rollout.observeEnabled && !rollout.governedEnabled) {\n\t\treturn null;\n\t}\n\n\tif (toolCall.name === \"bash\") {\n\t\tconst command =\n\t\t\ttypeof toolCall.arguments.command === \"string\"\n\t\t\t\t? toolCall.arguments.command\n\t\t\t\t: \"\";\n\t\tconst isReadOnly = isReadOnlyBashCommand(command);\n\t\tconst mode: PlatformBridgeMode =\n\t\t\tisReadOnly || !rollout.governedEnabled ? \"observe\" : \"governed\";\n\t\tif (mode === \"observe\" && !rollout.observeEnabled) {\n\t\t\treturn null;\n\t\t}\n\t\treturn {\n\t\t\tfamily: \"bash\",\n\t\t\tmode,\n\t\t\triskLevel: inferBashRiskLevel(command),\n\t\t\ttool: {\n\t\t\t\tnamespace: \"maestro\",\n\t\t\t\tname: \"bash\",\n\t\t\t\tversion: process.env.npm_package_version,\n\t\t\t\tcapability: \"maestro.tool.bash\",\n\t\t\t\toperation: command ? buildShellCommandSummary(command) : \"shell\",\n\t\t\t\tidempotent: isReadOnly,\n\t\t\t\tmutatesResource: !isReadOnly,\n\t\t\t},\n\t\t};\n\t}\n\n\tconst mcpTool = parseBridgeMcpToolName(toolCall.name);\n\tif (!mcpTool) {\n\t\treturn null;\n\t}\n\tconst mode: PlatformBridgeMode = rollout.governedEnabled\n\t\t? \"governed\"\n\t\t: \"observe\";\n\tconst toolName = mcpTool.tool ?? toolCall.name;\n\tconst readOnly = isReadOnlyTool(toolCall.name, toolDef?.annotations);\n\treturn {\n\t\tfamily: \"mcp\",\n\t\tmode,\n\t\triskLevel: readOnly ? \"RISK_LEVEL_MEDIUM\" : \"RISK_LEVEL_HIGH\",\n\t\ttool: {\n\t\t\tnamespace: \"mcp\",\n\t\t\tname: toolName,\n\t\t\tversion: process.env.npm_package_version,\n\t\t\tcapability: `mcp.${normalizeCapabilitySegment(mcpTool.server)}.${normalizeCapabilitySegment(toolName)}`,\n\t\t\toperation: toolName,\n\t\t\tidempotent: readOnly,\n\t\t\tmutatesResource: !readOnly,\n\t\t},\n\t\tconnector: {\n\t\t\tproviderId: mcpTool.server,\n\t\t\tresourceId: mcpTool.server,\n\t\t\tresourceKind: \"mcp_server\",\n\t\t},\n\t};\n}\n\nfunction cloneRecord(value: Record<string, unknown>): Record<string, unknown> {\n\treturn JSON.parse(JSON.stringify(value)) as Record<string, unknown>;\n}\n\nfunction scrubText(value: string): { text: string; redactions: string[] } {\n\tlet next = value;\n\tconst redactions = new Set<string>();\n\tfor (const pattern of [\n\t\t/\\b(gh[pousr]_[A-Za-z0-9_]{20,})\\b/gu,\n\t\t/\\b(Bearer\\s+[A-Za-z0-9._-]{16,})\\b/giu,\n\t\t/\\b([A-Za-z0-9_-]{32,})\\b/gu,\n\t]) {\n\t\tif (pattern.test(next)) {\n\t\t\tredactions.add(\"secret_like_token\");\n\t\t\tnext = next.replace(pattern, \"[REDACTED]\");\n\t\t}\n\t}\n\treturn { text: next, redactions: [...redactions] };\n}\n\nfunction summarizeToolResult(result: ToolResultMessage): {\n\tsummary: string;\n\tredactions: string[];\n} {\n\tconst text = result.content\n\t\t.filter(\n\t\t\t(part): part is { type: \"text\"; text: string } => part.type === \"text\",\n\t\t)\n\t\t.map((part) => part.text)\n\t\t.join(\"\\n\")\n\t\t.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\tsummary: result.isError\n\t\t\t\t? \"Tool failed without text output\"\n\t\t\t\t: \"Tool completed\",\n\t\t\tredactions: [],\n\t\t};\n\t}\n\tconst firstLine = text.split(/\\r?\\n/u)[0]?.trim() ?? text;\n\tconst shortened =\n\t\tfirstLine.length > OBSERVE_OUTPUT_SUMMARY_MAX_LENGTH\n\t\t\t? `${firstLine.slice(0, OBSERVE_OUTPUT_SUMMARY_MAX_LENGTH - 3).trimEnd()}...`\n\t\t\t: firstLine;\n\tconst scrubbed = scrubText(shortened);\n\treturn {\n\t\tsummary: scrubbed.text,\n\t\tredactions: scrubbed.redactions,\n\t};\n}\n\nfunction buildOutputPayload(\n\tresult: ToolResultMessage,\n\tdurationMs: number | undefined,\n): RecordPlatformToolExecutionOutputRequest[\"output\"] {\n\tconst summary = summarizeToolResult(result);\n\tconst safeOutput = {\n\t\tstatus: result.isError ? \"failed\" : \"succeeded\",\n\t\ttool_name: result.toolName,\n\t\ttool_call_id: result.toolCallId,\n\t\tsummary: summary.summary,\n\t};\n\treturn {\n\t\tsafeOutput,\n\t\tredactions: summary.redactions,\n\t\tcontentType: \"application/json\",\n\t\t...(durationMs !== undefined\n\t\t\t? { durationMs: Math.max(0, Math.round(durationMs)) }\n\t\t\t: {}),\n\t};\n}\n\nfunction buildLinkage(\n\tcfg: AgentRunConfig,\n\ttoolCall: ToolCall,\n\torganizationId: string | undefined,\n\tworkspaceId: string,\n\truntimeLinkage: ToolExecutionBridgeRuntimeLinkage | undefined,\n): ToolExecutionLinkage {\n\tconst sessionId =\n\t\ttrimString(cfg.session?.id) ??\n\t\ttrimString(runtimeLinkage?.sessionId) ??\n\t\tgetEnvValue([\"MAESTRO_SESSION_ID\"]);\n\tconst agentRunId =\n\t\ttrimString(runtimeLinkage?.agentRunId) ??\n\t\tgetEnvValue([\"MAESTRO_AGENT_RUN_ID\"]);\n\treturn {\n\t\tworkspaceId: trimString(runtimeLinkage?.workspaceId) ?? workspaceId,\n\t\t...(organizationId ? { organizationId } : {}),\n\t\tagentId:\n\t\t\ttrimString(runtimeLinkage?.agentId) ??\n\t\t\tgetEnvValue([\"MAESTRO_AGENT_ID\"]) ??\n\t\t\ttrimString(process.env.npm_package_name) ??\n\t\t\t\"maestro\",\n\t\t...(agentRunId ? { runId: agentRunId } : {}),\n\t\tobjectiveId: getEnvValue([\"MAESTRO_OBJECTIVE_ID\"]),\n\t\tstepId: toolCall.id,\n\t\tactorId: trimString(cfg.user?.id) ?? getEnvValue([\"MAESTRO_ACTOR_ID\"]),\n\t\tsurface: getEnvValue([\"MAESTRO_SURFACE\"]) ?? \"maestro\",\n\t\tchannelId: getEnvValue([\"MAESTRO_CHANNEL_ID\"]),\n\t\tcorrelationId: `${sessionId ?? \"session\"}:${toolCall.id}`,\n\t};\n}\n\nfunction buildRuntimeContextMetadata(\n\tlinkage: ToolExecutionLinkage,\n): Record<string, string> {\n\tconst cwd =\n\t\tgetMetadataEnvValue([\"MAESTRO_CWD\"]) ?? getCurrentWorkingDirectory();\n\tconst workspaceRoot = getMetadataEnvValue([\n\t\t\"MAESTRO_WORKSPACE_ROOT\",\n\t\t\"WORKSPACE_ROOT\",\n\t]);\n\tconst repositoryRoot =\n\t\tgetMetadataEnvValue([\n\t\t\t\"MAESTRO_REPOSITORY_ROOT\",\n\t\t\t\"MAESTRO_REPO_ROOT\",\n\t\t\t\"GITHUB_WORKSPACE\",\n\t\t]) ?? workspaceRoot;\n\tconst repository = getMetadataEnvValue([\n\t\t\"MAESTRO_GIT_REPOSITORY\",\n\t\t\"GITHUB_REPOSITORY\",\n\t\t\"CI_PROJECT_PATH\",\n\t]);\n\tconst gitBranch = getMetadataEnvValue([\n\t\t\"MAESTRO_GIT_BRANCH\",\n\t\t\"GITHUB_HEAD_REF\",\n\t\t\"GITHUB_REF_NAME\",\n\t\t\"CI_COMMIT_REF_NAME\",\n\t\t\"VERCEL_GIT_COMMIT_REF\",\n\t]);\n\tconst gitCommit = getMetadataEnvValue([\n\t\t\"MAESTRO_GIT_COMMIT\",\n\t\t\"GITHUB_SHA\",\n\t\t\"CI_COMMIT_SHA\",\n\t\t\"VERCEL_GIT_COMMIT_SHA\",\n\t]);\n\n\treturn {\n\t\t...(linkage.organizationId\n\t\t\t? { organization_id: linkage.organizationId }\n\t\t\t: {}),\n\t\t...(linkage.workspaceId ? { workspace_id: linkage.workspaceId } : {}),\n\t\t...(linkage.runId ? { maestro_agent_run_id: linkage.runId } : {}),\n\t\tmaestro_agent_run_step_id: linkage.stepId,\n\t\t...(linkage.actorId ? { maestro_actor_id: linkage.actorId } : {}),\n\t\t...(linkage.correlationId\n\t\t\t? { maestro_correlation_id: linkage.correlationId }\n\t\t\t: {}),\n\t\t...(cwd ? { maestro_cwd: cwd } : {}),\n\t\t...(workspaceRoot ? { maestro_workspace_root: workspaceRoot } : {}),\n\t\t...(repositoryRoot ? { maestro_repository_root: repositoryRoot } : {}),\n\t\t...(repository ? { maestro_repository: repository } : {}),\n\t\t...(gitBranch ? { maestro_git_branch: gitBranch } : {}),\n\t\t...(gitCommit ? { maestro_git_commit: gitCommit } : {}),\n\t};\n}\n\nfunction buildMetadata(\n\tinput: ToolExecutionBridgeInput,\n\tclassification: ToolExecutionClassification,\n\tlinkage: ToolExecutionLinkage,\n\truntimeLinkage: ToolExecutionBridgeRuntimeLinkage | undefined,\n): Record<string, string> {\n\tconst originalArgs = input.toolCall.arguments as Record<string, unknown>;\n\tconst redactedArguments =\n\t\tstableStringify(originalArgs) !== stableStringify(input.sanitizedArgs);\n\tconst sessionId =\n\t\ttrimString(input.cfg.session?.id) ??\n\t\ttrimString(runtimeLinkage?.sessionId) ??\n\t\tgetEnvValue([\"MAESTRO_SESSION_ID\"]);\n\tconst remoteRunnerSessionId =\n\t\ttrimString(runtimeLinkage?.remoteRunnerSessionId) ??\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_REMOTE_RUNNER_SESSION_ID\",\n\t\t\t\"MAESTRO_RUNNER_SESSION_ID\",\n\t\t]);\n\treturn {\n\t\tmaestro_bridge_mode: classification.mode,\n\t\tmaestro_tool_call_id: input.toolCall.id,\n\t\t...buildRuntimeContextMetadata(linkage),\n\t\t...(sessionId ? { maestro_session_id: sessionId } : {}),\n\t\t...(remoteRunnerSessionId\n\t\t\t? { maestro_remote_runner_session_id: remoteRunnerSessionId }\n\t\t\t: {}),\n\t\t...(input.displayName ? { maestro_display_name: input.displayName } : {}),\n\t\t...(input.summaryLabel\n\t\t\t? { maestro_summary_label: input.summaryLabel }\n\t\t\t: {}),\n\t\t...(input.actionDescription\n\t\t\t? { maestro_action_description: input.actionDescription }\n\t\t\t: {}),\n\t\tmaestro_redacted_arguments: String(redactedArguments),\n\t\tmaestro_tool_family: classification.family,\n\t\tmaestro_local_execution_authoritative: String(\n\t\t\tclassification.mode === \"governed\",\n\t\t),\n\t};\n}\n\nfunction buildExecuteRequest(\n\tinput: ToolExecutionBridgeInput,\n\tconfig: ToolExecutionServiceConfig,\n\tclassification: ToolExecutionClassification,\n\truntimeLinkage: ToolExecutionBridgeRuntimeLinkage | undefined,\n): ExecutePlatformToolRequest {\n\tconst linkage = buildLinkage(\n\t\tinput.cfg,\n\t\tinput.toolCall,\n\t\tconfig.organizationId,\n\t\tconfig.workspaceId ?? process.cwd(),\n\t\truntimeLinkage,\n\t);\n\treturn {\n\t\tlinkage,\n\t\ttool: classification.tool,\n\t\t...(classification.connector\n\t\t\t? { connector: classification.connector }\n\t\t\t: {}),\n\t\targuments: cloneRecord(input.sanitizedArgs),\n\t\triskLevel: classification.riskLevel,\n\t\tretryPolicy: {\n\t\t\tmaxAttempts: 1,\n\t\t\tinitialDelayMs: 0,\n\t\t\tmaxDelayMs: 0,\n\t\t\tallowNonIdempotentRetry: false,\n\t\t},\n\t\tidempotencyKey: `maestro:${input.toolCall.id}`,\n\t\tmetadata: buildMetadata(input, classification, linkage, runtimeLinkage),\n\t};\n}\n\nfunction planFromResponse(\n\tclassification: ToolExecutionClassification,\n\tconfig: ToolExecutionServiceConfig,\n\trequest: ExecutePlatformToolRequest,\n\tresponse: ExecutePlatformToolResponse,\n): GovernedToolExecutionPlan {\n\treturn {\n\t\tkind: \"governed\",\n\t\tmode: \"governed\",\n\t\tclassification,\n\t\tconfig,\n\t\trequest,\n\t\tmetadata: {\n\t\t\ttoolExecutionId: response.execution.id,\n\t\t\tapprovalRequestId: response.execution.approvalWait?.approvalRequestId,\n\t\t},\n\t\tresumeToken: response.execution.approvalWait?.resumeToken,\n\t};\n}\n\nfunction waitApprovalRequest(\n\tinput: ToolExecutionBridgeInput,\n\tplan: GovernedToolExecutionPlan,\n\texecution: PlatformToolExecutionRecord,\n): ActionApprovalRequest {\n\treturn {\n\t\tid:\n\t\t\texecution.approvalWait?.approvalRequestId ??\n\t\t\tplan.metadata.approvalRequestId ??\n\t\t\tinput.toolCall.id,\n\t\ttoolName: input.toolCall.name,\n\t\tdisplayName: input.displayName,\n\t\tsummaryLabel: input.summaryLabel,\n\t\tactionDescription: input.actionDescription,\n\t\targs: input.sanitizedArgs,\n\t\treason:\n\t\t\texecution.approvalWait?.reason ??\n\t\t\texecution.errorMessage ??\n\t\t\t\"Approval required by Platform ToolExecution\",\n\t\tplatform: {\n\t\t\tsource: \"tool_execution\",\n\t\t\ttoolExecutionId: execution.id ?? plan.metadata.toolExecutionId,\n\t\t\tapprovalRequestId:\n\t\t\t\texecution.approvalWait?.approvalRequestId ??\n\t\t\t\tplan.metadata.approvalRequestId,\n\t\t},\n\t};\n}\n\nfunction isBridgeGloballyDisabled(): boolean {\n\treturn isFeatureFlagEnabled(MAESTRO_PLATFORM_RUNTIME_BRIDGE_KILL_SWITCH);\n}\n\nexport interface PlatformToolExecutionBridge {\n\tprepare(\n\t\tinput: ToolExecutionBridgeInput,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolExecutionBridgePreparation>;\n\tresolveApproval(\n\t\tinput: ToolExecutionBridgeInput,\n\t\tplan: GovernedToolExecutionPlan,\n\t\tdecision: ActionApprovalDecision,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolExecutionBridgeApprovalResolution>;\n\trecordObservation(\n\t\tplan: ObserveToolExecutionPlan,\n\t\tresult: ToolResultMessage,\n\t\tsignal?: AbortSignal,\n\t): Promise<ObserveToolExecutionResult>;\n\trecordGovernedOutput(\n\t\tplan: GovernedToolExecutionPlan,\n\t\tresult: ToolResultMessage,\n\t\tdurationMs?: number,\n\t\tsignal?: AbortSignal,\n\t): Promise<ObserveToolExecutionResult>;\n}\n\nexport class DefaultPlatformToolExecutionBridge\n\timplements PlatformToolExecutionBridge\n{\n\tprivate readonly runtimeLinkage?: ToolExecutionBridgeRuntimeLinkageProvider;\n\n\tconstructor(options: DefaultPlatformToolExecutionBridgeOptions = {}) {\n\t\tthis.runtimeLinkage = options.runtimeLinkage;\n\t}\n\n\tasync prepare(\n\t\tinput: ToolExecutionBridgeInput,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolExecutionBridgePreparation> {\n\t\tif (isBridgeGloballyDisabled()) {\n\t\t\treturn { status: \"skip\" };\n\t\t}\n\n\t\tconst rollout = {\n\t\t\tobserveEnabled:\n\t\t\t\tisPlatformRuntimeObserveEnabled() ||\n\t\t\t\tisPlatformToolExecutionBridgeEnabled(),\n\t\t\tgovernedEnabled: isPlatformToolExecutionBridgeEnabled(),\n\t\t};\n\t\tconst classification = classifyToolExecution(\n\t\t\tinput.toolCall,\n\t\t\tinput.toolDef,\n\t\t\trollout,\n\t\t);\n\t\tif (!classification) {\n\t\t\treturn { status: \"skip\" };\n\t\t}\n\n\t\tconst config = await resolveToolExecutionServiceConfig();\n\t\tif (!config) {\n\t\t\treturn { status: \"skip\" };\n\t\t}\n\n\t\tconst request = buildExecuteRequest(\n\t\t\tinput,\n\t\t\tconfig,\n\t\t\tclassification,\n\t\t\tresolveRuntimeLinkage(this.runtimeLinkage),\n\t\t);\n\t\tif (classification.mode === \"observe\") {\n\t\t\treturn {\n\t\t\t\tstatus: \"observe\",\n\t\t\t\tplan: {\n\t\t\t\t\tkind: \"observe\",\n\t\t\t\t\tmode: \"observe\",\n\t\t\t\t\tclassification,\n\t\t\t\t\tconfig,\n\t\t\t\t\trequest,\n\t\t\t\t\tmetadata: {},\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\ttry {\n\t\t\tconst response = await executeToolWithPlatform(config, request, signal);\n\t\t\tconst plan = planFromResponse(classification, config, request, response);\n\t\t\tswitch (response.execution.state) {\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_DENIED\":\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\tresponse.execution.errorMessage ??\n\t\t\t\t\t\t\t\"Action denied by Platform ToolExecution\",\n\t\t\t\t\t};\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_WAITING_APPROVAL\":\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: \"wait_approval\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\trequest: waitApprovalRequest(input, plan, response.execution),\n\t\t\t\t\t};\n\t\t\t\tdefault:\n\t\t\t\t\treturn { status: \"allow\", plan };\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (isAbortError(error)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\treturn {\n\t\t\t\tstatus: \"deny\",\n\t\t\t\treason: `Platform ToolExecution unavailable: ${message}`,\n\t\t\t};\n\t\t}\n\t}\n\n\tasync resolveApproval(\n\t\tinput: ToolExecutionBridgeInput,\n\t\tplan: GovernedToolExecutionPlan,\n\t\tdecision: ActionApprovalDecision,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolExecutionBridgeApprovalResolution> {\n\t\tif (!plan.resumeToken || !plan.metadata.approvalRequestId) {\n\t\t\treturn decision.approved\n\t\t\t\t? { status: \"allow\", plan }\n\t\t\t\t: {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\treason: decision.reason ?? \"Approval denied\",\n\t\t\t\t\t};\n\t\t}\n\t\tconst request: ResumePlatformToolExecutionRequest = {\n\t\t\texecutionId: plan.metadata.toolExecutionId ?? \"\",\n\t\t\tapprovalRequestId: plan.metadata.approvalRequestId,\n\t\t\tresumeToken: plan.resumeToken,\n\t\t\tapproved: decision.approved,\n\t\t\tdecidedBy:\n\t\t\t\tdecision.resolvedBy === \"user\"\n\t\t\t\t\t? (trimString(input.cfg.user?.id) ?? \"user\")\n\t\t\t\t\t: \"policy\",\n\t\t\treason: decision.reason,\n\t\t};\n\t\ttry {\n\t\t\tconst response = await resumeToolExecutionWithPlatform(\n\t\t\t\tplan.config,\n\t\t\t\trequest,\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\tconst nextPlan: GovernedToolExecutionPlan = {\n\t\t\t\t...plan,\n\t\t\t\tmetadata: {\n\t\t\t\t\ttoolExecutionId:\n\t\t\t\t\t\tresponse.execution.id ?? plan.metadata.toolExecutionId,\n\t\t\t\t\tapprovalRequestId:\n\t\t\t\t\t\tresponse.execution.approvalWait?.approvalRequestId ??\n\t\t\t\t\t\tplan.metadata.approvalRequestId,\n\t\t\t\t},\n\t\t\t};\n\t\t\tswitch (response.execution.state) {\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_DENIED\":\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_FAILED\":\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_CANCELLED\":\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan: nextPlan,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\tresponse.execution.errorMessage ??\n\t\t\t\t\t\t\tdecision.reason ??\n\t\t\t\t\t\t\t\"Platform ToolExecution denied the action\",\n\t\t\t\t\t};\n\t\t\t\tdefault:\n\t\t\t\t\treturn { status: \"allow\", plan: nextPlan };\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (isAbortError(error)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\treturn decision.approved\n\t\t\t\t? {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\treason: `Platform ToolExecution decision sync failed: ${message}`,\n\t\t\t\t\t}\n\t\t\t\t: {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\treason: decision.reason ?? `Approval denied (${message})`,\n\t\t\t\t\t};\n\t\t}\n\t}\n\n\tasync recordObservation(\n\t\tplan: ObserveToolExecutionPlan,\n\t\tresult: ToolResultMessage,\n\t\tsignal?: AbortSignal,\n\t): Promise<ObserveToolExecutionResult> {\n\t\tconst summary = summarizeToolResult(result);\n\t\tconst request: ExecutePlatformToolRequest = {\n\t\t\t...plan.request,\n\t\t\tmetadata: {\n\t\t\t\t...plan.request.metadata,\n\t\t\t\tmaestro_bridge_mode: \"observe\",\n\t\t\t\tmaestro_local_outcome: result.isError ? \"failed\" : \"succeeded\",\n\t\t\t\tmaestro_local_output_summary: summary.summary,\n\t\t\t\tmaestro_local_output_redactions:\n\t\t\t\t\tsummary.redactions.length > 0 ? summary.redactions.join(\",\") : \"none\",\n\t\t\t},\n\t\t};\n\t\ttry {\n\t\t\tconst response = await executeToolWithPlatform(\n\t\t\t\tplan.config,\n\t\t\t\trequest,\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tmetadata: {\n\t\t\t\t\ttoolExecutionId: response.execution.id,\n\t\t\t\t\tapprovalRequestId: response.execution.approvalWait?.approvalRequestId,\n\t\t\t\t},\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tlogger.warn(\"Failed to record observe-only tool execution\", {\n\t\t\t\terror: sanitizeWithStaticMask(message),\n\t\t\t\ttoolName: plan.request.tool.name,\n\t\t\t\ttoolCallId: plan.request.metadata?.maestro_tool_call_id,\n\t\t\t});\n\t\t\treturn { metadata: plan.metadata };\n\t\t}\n\t}\n\n\tasync recordGovernedOutput(\n\t\tplan: GovernedToolExecutionPlan,\n\t\tresult: ToolResultMessage,\n\t\tdurationMs?: number,\n\t\tsignal?: AbortSignal,\n\t): Promise<ObserveToolExecutionResult> {\n\t\tconst executionId = plan.metadata.toolExecutionId;\n\t\tif (!executionId) {\n\t\t\treturn { metadata: plan.metadata };\n\t\t}\n\n\t\tconst request: RecordPlatformToolExecutionOutputRequest = {\n\t\t\texecutionId,\n\t\t\toutput: buildOutputPayload(result, durationMs),\n\t\t\tmetadata: {\n\t\t\t\t...plan.request.metadata,\n\t\t\t\tmaestro_bridge_mode: \"governed\",\n\t\t\t\tmaestro_local_outcome: result.isError ? \"failed\" : \"succeeded\",\n\t\t\t\tmaestro_tool_call_id: result.toolCallId,\n\t\t\t},\n\t\t};\n\t\ttry {\n\t\t\tconst response = await recordToolExecutionOutputWithPlatform(\n\t\t\t\tplan.config,\n\t\t\t\trequest,\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tmetadata: {\n\t\t\t\t\ttoolExecutionId: response.execution.id ?? executionId,\n\t\t\t\t\tapprovalRequestId:\n\t\t\t\t\t\tresponse.execution.approvalWait?.approvalRequestId ??\n\t\t\t\t\t\tplan.metadata.approvalRequestId,\n\t\t\t\t},\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tif (isAbortError(error)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tlogger.warn(\"Failed to record governed tool execution output\", {\n\t\t\t\terror: sanitizeWithStaticMask(message),\n\t\t\t\ttoolName: plan.request.tool.name,\n\t\t\t\ttoolCallId: result.toolCallId,\n\t\t\t\ttoolExecutionId: executionId,\n\t\t\t});\n\t\t\treturn { metadata: plan.metadata };\n\t\t}\n\t}\n}\n\nfunction resolveRuntimeLinkage(\n\tprovider: ToolExecutionBridgeRuntimeLinkageProvider | undefined,\n): ToolExecutionBridgeRuntimeLinkage | undefined {\n\treturn typeof provider === \"function\" ? provider() : provider;\n}\n\nlet defaultBridge: PlatformToolExecutionBridge | null = null;\n\nexport function getDefaultPlatformToolExecutionBridge(): PlatformToolExecutionBridge {\n\tif (!defaultBridge) {\n\t\tdefaultBridge = new DefaultPlatformToolExecutionBridge();\n\t}\n\treturn defaultBridge;\n}\n\nexport function buildObservedResultMetadata(\n\tplan: ToolExecutionBridgePlan | undefined,\n\tobservation: ObserveToolExecutionResult | undefined,\n): ToolExecutionBridgeMetadata {\n\tif (!plan) {\n\t\treturn observation?.metadata ?? {};\n\t}\n\treturn {\n\t\ttoolExecutionId:\n\t\t\tobservation?.metadata.toolExecutionId ?? plan.metadata.toolExecutionId,\n\t\tapprovalRequestId:\n\t\t\tobservation?.metadata.approvalRequestId ??\n\t\t\tplan.metadata.approvalRequestId,\n\t};\n}\n"]}
+{"version":3,"file":"tool-execution-bridge.js","sourceRoot":"","sources":["../../../src/agent/transport/tool-execution-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,2CAA2C,EAC3C,oBAAoB,EACpB,+BAA+B,EAC/B,oCAAoC,GACpC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAWN,uBAAuB,EACvB,qCAAqC,EACrC,iCAAiC,EACjC,+BAA+B,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAWxE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,MAAM,MAAM,GAAG,YAAY,CAAC,iCAAiC,CAAC,CAAC;AAE/D,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAC9C,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,uBAAuB,GAAG;IAC/B,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,UAAU;IACV,SAAS;IACT,eAAe;IACf,eAAe;IACf,UAAU;IACV,YAAY;IACZ,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,UAAU;IACV,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,MAAM;IACN,OAAO;CACP,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAEtC,MAAM,qBAAqB,GAAG;IAC7B,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,uIAAuI;IACvI,YAAY;IACZ,SAAS;IACT,uDAAuD;IACvD,yCAAyC;IACzC,iBAAiB;IACjB,SAAS;IACT,eAAe;IACf,UAAU;IACV,YAAY;IACZ,0CAA0C;IAC1C,wCAAwC;IACxC,0DAA0D;IAC1D,yCAAyC;IACzC,iBAAiB;CACR,CAAC;AAEX,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,OAAO;IACP,QAAQ;IACR,UAAU;IACV,eAAe;IACf,aAAa;IACb,aAAa;IACb,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,IAAI;CACJ,CAAC,CAAC;AAwGH,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC/C,mHAAmH;IACnH,MAAM,UAAU,GAAG,KAAK,EAAE,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,eAAe,GAAG,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YACnD,MAAM;QACP,CAAC;QACD,MAAM,IAAI,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACpD,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,0BAA0B;IAClC,IAAI,CAAC;QACJ,OAAO,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtE,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,uBAAuB,CAAC,IAAI,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACxE,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,UAAkB;IACrD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAChB,CAAC,GAAG,EAAE,EAAE,CACP,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAC3B,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAC1B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACzC,IACC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC;QAChC,mCAAmC,CAAC,IAAI,CAAC,UAAU,CAAC;QACpD,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC;QACrC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAC1C,CAAC;QACF,OAAO,qBAAqB,CAAC;IAC9B,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAC9E,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC9B,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO;QACN,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9D,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,QAAkB,EAClB,OAA8B,EAC9B,OAGC;IAED,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,OAAO,GACZ,OAAO,QAAQ,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;YAC7C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO;YAC5B,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,GACT,UAAU,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACjE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO;YACN,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC;YACtC,IAAI,EAAE;gBACL,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;gBACxC,UAAU,EAAE,mBAAmB;gBAC/B,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO;gBAChE,UAAU,EAAE,UAAU;gBACtB,eAAe,EAAE,CAAC,UAAU;aAC5B;SACD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAuB,OAAO,CAAC,eAAe;QACvD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC;IAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACrE,OAAO;QACN,MAAM,EAAE,KAAK;QACb,IAAI;QACJ,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB;QAC7D,IAAI,EAAE;YACL,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACxC,UAAU,EAAE,OAAO,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE;YACvG,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,QAAQ;YACpB,eAAe,EAAE,CAAC,QAAQ;SAC1B;QACD,SAAS,EAAE;YACV,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,YAAY,EAAE,YAAY;SAC1B;KACD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA4B,CAAC;AACrE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI;QACrB,qCAAqC;QACrC,uCAAuC;QACvC,4BAA4B;KAC5B,EAAE,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACpC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB;IAIrD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO;SACzB,MAAM,CACN,CAAC,IAAI,EAA0C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CACtE;SACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;gBACtB,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,gBAAgB;YACnB,UAAU,EAAE,EAAE;SACd,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC1D,MAAM,SAAS,GACd,SAAS,CAAC,MAAM,GAAG,iCAAiC;QACnD,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAiC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK;QAC7E,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO;QACN,OAAO,EAAE,QAAQ,CAAC,IAAI;QACtB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAC/B,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAAyB,EACzB,UAA8B;IAE9B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG;QAClB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;QAC/C,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,MAAM,CAAC,UAAU;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;KACxB,CAAC;IACF,OAAO;QACN,UAAU;QACV,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,kBAAkB;QAC/B,GAAG,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE;YACrD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACpB,GAAmB,EACnB,QAAkB,EAClB,cAAkC,EAClC,WAAmB,EACnB,cAA6D;IAE7D,MAAM,SAAS,GACd,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC;QACrC,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrC,MAAM,UAAU,GACf,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC;QACtC,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;IACvC,OAAO;QACN,WAAW,EAAE,UAAU,CAAC,cAAc,EAAE,WAAW,CAAC,IAAI,WAAW;QACnE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,EACN,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC;YACnC,WAAW,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACjC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACxC,SAAS;QACV,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,WAAW,EAAE,WAAW,CAAC;YACxB,sBAAsB;YACtB,8BAA8B;SAC9B,CAAC;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtE,OAAO,EAAE,WAAW,CAAC,CAAC,iBAAiB,CAAC,CAAC,IAAI,SAAS;QACtD,SAAS,EAAE,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAC9C,aAAa,EAAE,GAAG,SAAS,IAAI,SAAS,IAAI,QAAQ,CAAC,EAAE,EAAE;KACzD,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CACnC,OAA6B;IAE7B,MAAM,GAAG,GACR,mBAAmB,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,0BAA0B,EAAE,CAAC;IACtE,MAAM,aAAa,GAAG,mBAAmB,CAAC;QACzC,wBAAwB;QACxB,gBAAgB;KAChB,CAAC,CAAC;IACH,MAAM,cAAc,GACnB,mBAAmB,CAAC;QACnB,yBAAyB;QACzB,mBAAmB;QACnB,kBAAkB;KAClB,CAAC,IAAI,aAAa,CAAC;IACrB,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACtC,wBAAwB;QACxB,mBAAmB;QACnB,iBAAiB;KACjB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC;QACrC,oBAAoB;QACpB,iBAAiB;QACjB,iBAAiB;QACjB,oBAAoB;QACpB,uBAAuB;KACvB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC;QACrC,oBAAoB;QACpB,YAAY;QACZ,eAAe;QACf,uBAAuB;KACvB,CAAC,CAAC;IAEH,OAAO;QACN,GAAG,CAAC,OAAO,CAAC,cAAc;YACzB,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,cAAc,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,yBAAyB,EAAE,OAAO,CAAC,MAAM;QACzC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,aAAa;YACxB,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,aAAa,EAAE;YACnD,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,KAA+B,EAC/B,cAA2C,EAC3C,OAA6B,EAC7B,cAA6D;IAE7D,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAoC,CAAC;IACzE,MAAM,iBAAiB,GACtB,eAAe,CAAC,YAAY,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACxE,MAAM,SAAS,GACd,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACjC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC;QACrC,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACrC,MAAM,qBAAqB,GAC1B,UAAU,CAAC,cAAc,EAAE,qBAAqB,CAAC;QACjD,WAAW,CAAC;YACX,kCAAkC;YAClC,2BAA2B;SAC3B,CAAC,CAAC;IACJ,OAAO;QACN,mBAAmB,EAAE,cAAc,CAAC,IAAI;QACxC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QACvC,GAAG,2BAA2B,CAAC,OAAO,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,qBAAqB;YACxB,CAAC,CAAC,EAAE,gCAAgC,EAAE,qBAAqB,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,KAAK,CAAC,YAAY;YACrB,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,YAAY,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,KAAK,CAAC,iBAAiB;YAC1B,CAAC,CAAC,EAAE,0BAA0B,EAAE,KAAK,CAAC,iBAAiB,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACN,0BAA0B,EAAE,MAAM,CAAC,iBAAiB,CAAC;QACrD,mBAAmB,EAAE,cAAc,CAAC,MAAM;QAC1C,qCAAqC,EAAE,MAAM,CAC5C,cAAc,CAAC,IAAI,KAAK,UAAU,CAClC;KACD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,KAA+B,EAC/B,MAAkC,EAClC,cAA2C,EAC3C,cAA6D;IAE7D,MAAM,OAAO,GAAG,YAAY,CAC3B,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,QAAQ,EACd,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,EACnC,cAAc,CACd,CAAC;IACF,OAAO;QACN,OAAO;QACP,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,GAAG,CAAC,cAAc,CAAC,SAAS;YAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACN,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC;QAC3C,SAAS,EAAE,cAAc,CAAC,SAAS;QACnC,WAAW,EAAE;YACZ,WAAW,EAAE,CAAC;YACd,cAAc,EAAE,CAAC;YACjB,UAAU,EAAE,CAAC;YACb,uBAAuB,EAAE,KAAK;SAC9B;QACD,cAAc,EAAE,WAAW,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE;QAC9C,QAAQ,EAAE,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC;KACvE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACxB,cAA2C,EAC3C,MAAkC,EAClC,OAAmC,EACnC,QAAqC;IAErC,OAAO;QACN,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,UAAU;QAChB,cAAc;QACd,MAAM;QACN,OAAO;QACP,QAAQ,EAAE;YACT,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;YACtC,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB;SACrE;QACD,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW;KACzD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,KAA+B,EAC/B,IAA+B,EAC/B,SAAsC;IAEtC,OAAO;QACN,EAAE,EACD,SAAS,CAAC,YAAY,EAAE,iBAAiB;YACzC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YAC/B,KAAK,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,IAAI,EAAE,KAAK,CAAC,aAAa;QACzB,MAAM,EACL,SAAS,CAAC,YAAY,EAAE,MAAM;YAC9B,SAAS,CAAC,YAAY;YACtB,6CAA6C;QAC9C,QAAQ,EAAE;YACT,MAAM,EAAE,gBAAgB;YACxB,eAAe,EAAE,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC9D,iBAAiB,EAChB,SAAS,CAAC,YAAY,EAAE,iBAAiB;gBACzC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;SAChC;KACD,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB;IAChC,OAAO,oBAAoB,CAAC,2CAA2C,CAAC,CAAC;AAC1E,CAAC;AA0BD,MAAM,OAAO,kCAAkC;IAK9C,YAAY,UAAqD,EAAE;QAClE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,OAAO,CACZ,KAA+B,EAC/B,MAAoB;QAEpB,IAAI,wBAAwB,EAAE,EAAE,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,OAAO,GAAG;YACf,cAAc,EACb,+BAA+B,EAAE;gBACjC,oCAAoC,EAAE;YACvC,eAAe,EAAE,oCAAoC,EAAE;SACvD,CAAC;QACF,MAAM,cAAc,GAAG,qBAAqB,CAC3C,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,OAAO,EACb,OAAO,CACP,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,iCAAiC,EAAE,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,OAAO,GAAG,mBAAmB,CAClC,KAAK,EACL,MAAM,EACN,cAAc,EACd,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAC1C,CAAC;QACF,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO;gBACN,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,SAAS;oBACf,cAAc;oBACd,MAAM;oBACN,OAAO;oBACP,QAAQ,EAAE,EAAE;iBACZ;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzE,QAAQ,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAClC,KAAK,6BAA6B;oBACjC,OAAO;wBACN,MAAM,EAAE,MAAM;wBACd,IAAI;wBACJ,MAAM,EACL,QAAQ,CAAC,SAAS,CAAC,YAAY;4BAC/B,yCAAyC;qBAC1C,CAAC;gBACH,KAAK,uCAAuC;oBAC3C,OAAO;wBACN,MAAM,EAAE,eAAe;wBACvB,IAAI;wBACJ,OAAO,EAAE,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC;qBAC7D,CAAC;gBACH;oBACC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACnC,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,uCAAuC,OAAO,EAAE;aACxD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,KAA+B,EAC/B,IAA+B,EAC/B,QAAgC,EAChC,MAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC3D,OAAO,QAAQ,CAAC,QAAQ;gBACvB,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC3B,CAAC,CAAC;oBACA,MAAM,EAAE,MAAM;oBACd,IAAI;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,iBAAiB;iBAC5C,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAuC;YACnD,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE;YAChD,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YAClD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EACR,QAAQ,CAAC,UAAU,KAAK,MAAM;gBAC7B,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;gBAC5C,CAAC,CAAC,QAAQ;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,+BAA+B,CACrD,IAAI,CAAC,MAAM,EACX,OAAO,EACP,MAAM,CACN,CAAC;YACF,MAAM,QAAQ,GAA8B;gBAC3C,GAAG,IAAI;gBACP,QAAQ,EAAE;oBACT,eAAe,EACd,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;oBACvD,iBAAiB,EAChB,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB;wBAClD,IAAI,CAAC,QAAQ,CAAC,iBAAiB;iBAChC;aACD,CAAC;YACF,QAAQ,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAClC,KAAK,6BAA6B,CAAC;gBACnC,KAAK,6BAA6B,CAAC;gBACnC,KAAK,gCAAgC;oBACpC,OAAO;wBACN,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,QAAQ;wBACd,MAAM,EACL,QAAQ,CAAC,SAAS,CAAC,YAAY;4BAC/B,QAAQ,CAAC,MAAM;4BACf,0CAA0C;qBAC3C,CAAC;gBACH;oBACC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC7C,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC,QAAQ;gBACvB,CAAC,CAAC;oBACA,MAAM,EAAE,MAAM;oBACd,IAAI;oBACJ,MAAM,EAAE,gDAAgD,OAAO,EAAE;iBACjE;gBACF,CAAC,CAAC;oBACA,MAAM,EAAE,MAAM;oBACd,IAAI;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,oBAAoB,OAAO,GAAG;iBACzD,CAAC;QACL,CAAC;IACF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACtB,IAA8B,EAC9B,MAAyB,EACzB,MAAoB;QAEpB,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,OAAO,GAA+B;YAC3C,GAAG,IAAI,CAAC,OAAO;YACf,QAAQ,EAAE;gBACT,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;gBACxB,mBAAmB,EAAE,SAAS;gBAC9B,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;gBAC9D,4BAA4B,EAAE,OAAO,CAAC,OAAO;gBAC7C,+BAA+B,EAC9B,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM;aACtE;SACD,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC7C,IAAI,CAAC,MAAM,EACX,OAAO,EACP,MAAM,CACN,CAAC;YACF,OAAO;gBACN,QAAQ,EAAE;oBACT,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE;oBACtC,iBAAiB,EAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB;iBACrE;aACD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC3D,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC;gBACtC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;gBAChC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB;aACvD,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,oBAAoB,CACzB,IAA+B,EAC/B,MAAyB,EACzB,UAAmB,EACnB,MAAoB;QAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAA6C;YACzD,WAAW;YACX,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;YAC9C,QAAQ,EAAE;gBACT,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ;gBACxB,mBAAmB,EAAE,UAAU;gBAC/B,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;gBAC9D,oBAAoB,EAAE,MAAM,CAAC,UAAU;aACvC;SACD,CAAC;QACF,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,qCAAqC,CAC3D,IAAI,CAAC,MAAM,EACX,OAAO,EACP,MAAM,CACN,CAAC;YACF,OAAO;gBACN,QAAQ,EAAE;oBACT,eAAe,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,WAAW;oBACrD,iBAAiB,EAChB,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,iBAAiB;wBAClD,IAAI,CAAC,QAAQ,CAAC,iBAAiB;iBAChC;aACD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,CAAC;YACb,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,iDAAiD,EAAE;gBAC9D,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC;gBACtC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;gBAChC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,WAAW;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;IACF,CAAC;CACD;AAED,SAAS,qBAAqB,CAC7B,QAA+D;IAE/D,OAAO,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED,IAAI,aAAa,GAAuC,IAAI,CAAC;AAE7D,MAAM,UAAU,qCAAqC;IACpD,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,aAAa,GAAG,IAAI,kCAAkC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,IAAyC,EACzC,WAAmD;IAEnD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC;IACpC,CAAC;IACD,OAAO;QACN,eAAe,EACd,WAAW,EAAE,QAAQ,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;QACvE,iBAAiB,EAChB,WAAW,EAAE,QAAQ,CAAC,iBAAiB;YACvC,IAAI,CAAC,QAAQ,CAAC,iBAAiB;KAChC,CAAC;AACH,CAAC","sourcesContent":["import {\n\tMAESTRO_PLATFORM_RUNTIME_BRIDGE_KILL_SWITCH,\n\tisFeatureFlagEnabled,\n\tisPlatformRuntimeObserveEnabled,\n\tisPlatformToolExecutionBridgeEnabled,\n} from \"../../config/feature-flags.js\";\nimport {\n\ttype ExecutePlatformToolRequest,\n\ttype ExecutePlatformToolResponse,\n\ttype PlatformConnectorRef,\n\ttype PlatformToolExecutionRecord,\n\ttype PlatformToolRef,\n\ttype RecordPlatformToolExecutionOutputRequest,\n\ttype ResumePlatformToolExecutionRequest,\n\ttype ToolExecutionLinkage,\n\ttype ToolExecutionRiskLevel,\n\ttype ToolExecutionServiceConfig,\n\texecuteToolWithPlatform,\n\trecordToolExecutionOutputWithPlatform,\n\tresolveToolExecutionServiceConfig,\n\tresumeToolExecutionWithPlatform,\n} from \"../../platform/tool-execution-client.js\";\nimport { isReadOnlyTool } from \"../../tools/parallel-execution.js\";\nimport { isAbortError } from \"../../utils/abort-error.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nimport { sanitizeWithStaticMask } from \"../../utils/secret-redactor.js\";\nimport type {\n\tActionApprovalDecision,\n\tActionApprovalRequest,\n} from \"../action-approval.js\";\nimport type {\n\tAgentRunConfig,\n\tAgentTool,\n\tToolCall,\n\tToolResultMessage,\n} from \"../types.js\";\nimport { stableStringify } from \"./stable-stringify.js\";\n\nconst logger = createLogger(\"transport:tool-execution-bridge\");\n\nconst OBSERVE_OUTPUT_SUMMARY_MAX_LENGTH = 280;\nconst METADATA_VALUE_MAX_LENGTH = 512;\nconst READ_ONLY_BASH_PREFIXES = [\n\t\"cat\",\n\t\"cd\",\n\t\"df\",\n\t\"du\",\n\t\"echo\",\n\t\"env\",\n\t\"find\",\n\t\"git diff\",\n\t\"git log\",\n\t\"git remote -v\",\n\t\"git rev-parse\",\n\t\"git show\",\n\t\"git status\",\n\t\"grep\",\n\t\"head\",\n\t\"ls\",\n\t\"pwd\",\n\t\"printenv\",\n\t\"ps\",\n\t\"rg\",\n\t\"sed -n\",\n\t\"tail\",\n\t\"which\",\n].map((value) => value.toLowerCase());\n\nconst BASH_MUTATION_MARKERS = [\n\t/\\bchmod\\b/u,\n\t/\\bchown\\b/u,\n\t/\\bcp\\b/u,\n\t/\\bgit\\s+(add|am|apply|branch|checkout|cherry-pick|clean|commit|merge|mv|pull|push|rebase|reset|restore|revert|rm|stash|switch|tag)\\b/u,\n\t/\\bmkdir\\b/u,\n\t/\\bmv\\b/u,\n\t/\\bnpm\\s+(install|publish|uninstall|update|version)\\b/u,\n\t/\\bpnpm\\s+(add|install|remove|update)\\b/u,\n\t/\\bpython\\b.*-c/u,\n\t/\\brm\\b/u,\n\t/\\bsed\\s+-i\\b/u,\n\t/\\btee\\b/u,\n\t/\\btouch\\b/u,\n\t/\\byarn\\s+(add|install|remove|upgrade)\\b/u,\n\t/\\bbun\\s+(add|install|remove|update)\\b/u,\n\t/\\bkubectl\\s+(apply|create|delete|patch|replace|scale)\\b/u,\n\t/\\bterraform\\s+(apply|destroy|import)\\b/u,\n\t/(^|[^<])>{1,2}/u,\n] as const;\n\nconst READ_ONLY_GIT_BRANCH_ARGS = new Set([\n\t\"--all\",\n\t\"--list\",\n\t\"--merged\",\n\t\"--no-contains\",\n\t\"--no-merged\",\n\t\"--points-at\",\n\t\"--remotes\",\n\t\"-a\",\n\t\"-l\",\n\t\"-r\",\n]);\n\nexport type PlatformBridgeMode = \"observe\" | \"governed\";\n\nexport interface ToolExecutionBridgeMetadata {\n\ttoolExecutionId?: string;\n\tapprovalRequestId?: string;\n}\n\nexport interface ObserveToolExecutionPlan {\n\tkind: \"observe\";\n\tmode: \"observe\";\n\tclassification: ToolExecutionClassification;\n\tconfig: ToolExecutionServiceConfig;\n\trequest: ExecutePlatformToolRequest;\n\tmetadata: ToolExecutionBridgeMetadata;\n}\n\nexport interface GovernedToolExecutionPlan {\n\tkind: \"governed\";\n\tmode: \"governed\";\n\tclassification: ToolExecutionClassification;\n\tconfig: ToolExecutionServiceConfig;\n\trequest: ExecutePlatformToolRequest;\n\tmetadata: ToolExecutionBridgeMetadata;\n\tresumeToken?: string;\n}\n\nexport type ToolExecutionBridgePlan =\n\t| ObserveToolExecutionPlan\n\t| GovernedToolExecutionPlan;\n\nexport type ToolExecutionBridgePreparation =\n\t| {\n\t\t\tstatus: \"skip\";\n\t  }\n\t| {\n\t\t\tstatus: \"observe\";\n\t\t\tplan: ObserveToolExecutionPlan;\n\t  }\n\t| {\n\t\t\tstatus: \"allow\";\n\t\t\tplan: GovernedToolExecutionPlan;\n\t  }\n\t| {\n\t\t\tstatus: \"wait_approval\";\n\t\t\tplan: GovernedToolExecutionPlan;\n\t\t\trequest: ActionApprovalRequest;\n\t  }\n\t| {\n\t\t\tstatus: \"deny\";\n\t\t\tplan?: GovernedToolExecutionPlan;\n\t\t\treason: string;\n\t  };\n\nexport type ToolExecutionBridgeApprovalResolution =\n\t| {\n\t\t\tstatus: \"allow\";\n\t\t\tplan: GovernedToolExecutionPlan;\n\t  }\n\t| {\n\t\t\tstatus: \"deny\";\n\t\t\tplan: GovernedToolExecutionPlan;\n\t\t\treason: string;\n\t  };\n\nexport interface ObserveToolExecutionResult {\n\tmetadata: ToolExecutionBridgeMetadata;\n}\n\nexport interface ToolExecutionBridgeInput {\n\tcfg: AgentRunConfig;\n\ttoolCall: ToolCall;\n\ttoolDef?: AgentTool;\n\tsanitizedArgs: Record<string, unknown>;\n\tdisplayName?: string;\n\tsummaryLabel?: string;\n\tactionDescription?: string;\n}\n\nexport interface ToolExecutionBridgeRuntimeLinkage {\n\tagentRunId?: string;\n\tagentId?: string;\n\tworkspaceId?: string;\n\tsessionId?: string;\n\tremoteRunnerSessionId?: string;\n}\n\nexport type ToolExecutionBridgeRuntimeLinkageProvider =\n\t| ToolExecutionBridgeRuntimeLinkage\n\t| (() => ToolExecutionBridgeRuntimeLinkage | undefined);\n\nexport interface DefaultPlatformToolExecutionBridgeOptions {\n\truntimeLinkage?: ToolExecutionBridgeRuntimeLinkageProvider;\n}\n\ninterface ToolExecutionClassification {\n\tfamily: \"bash\" | \"mcp\";\n\tmode: PlatformBridgeMode;\n\triskLevel: ToolExecutionRiskLevel;\n\ttool: PlatformToolRef;\n\tconnector?: PlatformConnectorRef;\n}\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction getEnvValue(names: readonly string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = trimString(process.env[name]);\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction metadataValue(value: string | undefined): string | undefined {\n\t// biome-ignore lint/suspicious/noControlCharactersInRegex: metadata must neutralize C0 control characters and DEL.\n\tconst normalized = value?.replace(/[\\x00-\\x1f\\x7f]/gu, \" \");\n\tconst trimmed = trimString(normalized);\n\tif (!trimmed) {\n\t\treturn undefined;\n\t}\n\tif (trimmed.length <= METADATA_VALUE_MAX_LENGTH) {\n\t\treturn trimmed;\n\t}\n\tconst suffix = \"...\";\n\tconst maxPrefixLength = METADATA_VALUE_MAX_LENGTH - suffix.length;\n\tlet prefix = \"\";\n\tfor (const char of trimmed) {\n\t\tif (prefix.length + char.length > maxPrefixLength) {\n\t\t\tbreak;\n\t\t}\n\t\tprefix += char;\n\t}\n\treturn `${prefix.trimEnd()}${suffix}`;\n}\n\nfunction getMetadataEnvValue(names: readonly string[]): string | undefined {\n\treturn metadataValue(getEnvValue(names));\n}\n\nfunction getCurrentWorkingDirectory(): string | undefined {\n\ttry {\n\t\treturn metadataValue(process.cwd());\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nfunction buildShellCommandSummary(command: string): string {\n\tconst normalized = command.replace(/\\s+/gu, \" \").trim();\n\tif (normalized.length <= 96) {\n\t\treturn normalized;\n\t}\n\treturn `${normalized.slice(0, 93).trimEnd()}...`;\n}\n\nfunction isReadOnlyBashCommand(command: string): boolean {\n\tconst normalized = command.replace(/\\s+/gu, \" \").trim().toLowerCase();\n\tif (!normalized) {\n\t\treturn false;\n\t}\n\tif (isReadOnlyGitBranchCommand(normalized)) {\n\t\treturn true;\n\t}\n\tif (BASH_MUTATION_MARKERS.some((pattern) => pattern.test(normalized))) {\n\t\treturn false;\n\t}\n\treturn READ_ONLY_BASH_PREFIXES.some(\n\t\t(prefix) => normalized === prefix || normalized.startsWith(`${prefix} `),\n\t);\n}\n\nfunction isReadOnlyGitBranchCommand(normalized: string): boolean {\n\tconst parts = normalized.split(\" \");\n\tif (parts[0] !== \"git\" || parts[1] !== \"branch\") {\n\t\treturn false;\n\t}\n\tconst args = parts.slice(2);\n\tif (args.length === 0) {\n\t\treturn true;\n\t}\n\treturn args.every(\n\t\t(arg) =>\n\t\t\tREAD_ONLY_GIT_BRANCH_ARGS.has(arg) ||\n\t\t\targ.startsWith(\"--format=\") ||\n\t\t\targ.startsWith(\"--sort=\"),\n\t);\n}\n\nfunction inferBashRiskLevel(command: string): ToolExecutionRiskLevel {\n\tconst normalized = command.toLowerCase();\n\tif (\n\t\t/\\brm\\s+-rf\\b/u.test(normalized) ||\n\t\t/\\bgit\\s+push(\\s+--force|\\s+-f)\\b/u.test(normalized) ||\n\t\t/\\bnpm\\s+publish\\b/u.test(normalized) ||\n\t\t/\\bkubectl\\s+delete\\b/u.test(normalized) ||\n\t\t/\\bterraform\\s+destroy\\b/u.test(normalized)\n\t) {\n\t\treturn \"RISK_LEVEL_CRITICAL\";\n\t}\n\treturn isReadOnlyBashCommand(command) ? \"RISK_LEVEL_LOW\" : \"RISK_LEVEL_HIGH\";\n}\n\nfunction normalizeCapabilitySegment(value: string): string {\n\treturn value.replace(/[^a-zA-Z0-9_.-]/gu, \"_\");\n}\n\nfunction parseBridgeMcpToolName(\n\tname: string,\n): { server: string; tool?: string } | null {\n\tconst parts = name.split(\"__\");\n\tif (parts[0] !== \"mcp\" || parts.length < 2) {\n\t\treturn null;\n\t}\n\tconst server = parts[1];\n\tif (!server) {\n\t\treturn null;\n\t}\n\treturn {\n\t\tserver,\n\t\ttool: parts.length > 2 ? parts.slice(2).join(\"__\") : undefined,\n\t};\n}\n\nfunction classifyToolExecution(\n\ttoolCall: ToolCall,\n\ttoolDef: AgentTool | undefined,\n\trollout: {\n\t\tobserveEnabled: boolean;\n\t\tgovernedEnabled: boolean;\n\t},\n): ToolExecutionClassification | null {\n\tif (!rollout.observeEnabled && !rollout.governedEnabled) {\n\t\treturn null;\n\t}\n\n\tif (toolCall.name === \"bash\") {\n\t\tconst command =\n\t\t\ttypeof toolCall.arguments.command === \"string\"\n\t\t\t\t? toolCall.arguments.command\n\t\t\t\t: \"\";\n\t\tconst isReadOnly = isReadOnlyBashCommand(command);\n\t\tconst mode: PlatformBridgeMode =\n\t\t\tisReadOnly || !rollout.governedEnabled ? \"observe\" : \"governed\";\n\t\tif (mode === \"observe\" && !rollout.observeEnabled) {\n\t\t\treturn null;\n\t\t}\n\t\treturn {\n\t\t\tfamily: \"bash\",\n\t\t\tmode,\n\t\t\triskLevel: inferBashRiskLevel(command),\n\t\t\ttool: {\n\t\t\t\tnamespace: \"maestro\",\n\t\t\t\tname: \"bash\",\n\t\t\t\tversion: process.env.npm_package_version,\n\t\t\t\tcapability: \"maestro.tool.bash\",\n\t\t\t\toperation: command ? buildShellCommandSummary(command) : \"shell\",\n\t\t\t\tidempotent: isReadOnly,\n\t\t\t\tmutatesResource: !isReadOnly,\n\t\t\t},\n\t\t};\n\t}\n\n\tconst mcpTool = parseBridgeMcpToolName(toolCall.name);\n\tif (!mcpTool) {\n\t\treturn null;\n\t}\n\tconst mode: PlatformBridgeMode = rollout.governedEnabled\n\t\t? \"governed\"\n\t\t: \"observe\";\n\tconst toolName = mcpTool.tool ?? toolCall.name;\n\tconst readOnly = isReadOnlyTool(toolCall.name, toolDef?.annotations);\n\treturn {\n\t\tfamily: \"mcp\",\n\t\tmode,\n\t\triskLevel: readOnly ? \"RISK_LEVEL_MEDIUM\" : \"RISK_LEVEL_HIGH\",\n\t\ttool: {\n\t\t\tnamespace: \"mcp\",\n\t\t\tname: toolName,\n\t\t\tversion: process.env.npm_package_version,\n\t\t\tcapability: `mcp.${normalizeCapabilitySegment(mcpTool.server)}.${normalizeCapabilitySegment(toolName)}`,\n\t\t\toperation: toolName,\n\t\t\tidempotent: readOnly,\n\t\t\tmutatesResource: !readOnly,\n\t\t},\n\t\tconnector: {\n\t\t\tproviderId: mcpTool.server,\n\t\t\tresourceId: mcpTool.server,\n\t\t\tresourceKind: \"mcp_server\",\n\t\t},\n\t};\n}\n\nfunction cloneRecord(value: Record<string, unknown>): Record<string, unknown> {\n\treturn JSON.parse(JSON.stringify(value)) as Record<string, unknown>;\n}\n\nfunction scrubText(value: string): { text: string; redactions: string[] } {\n\tlet next = value;\n\tconst redactions = new Set<string>();\n\tfor (const pattern of [\n\t\t/\\b(gh[pousr]_[A-Za-z0-9_]{20,})\\b/gu,\n\t\t/\\b(Bearer\\s+[A-Za-z0-9._-]{16,})\\b/giu,\n\t\t/\\b([A-Za-z0-9_-]{32,})\\b/gu,\n\t]) {\n\t\tif (pattern.test(next)) {\n\t\t\tredactions.add(\"secret_like_token\");\n\t\t\tnext = next.replace(pattern, \"[REDACTED]\");\n\t\t}\n\t}\n\treturn { text: next, redactions: [...redactions] };\n}\n\nfunction summarizeToolResult(result: ToolResultMessage): {\n\tsummary: string;\n\tredactions: string[];\n} {\n\tconst text = result.content\n\t\t.filter(\n\t\t\t(part): part is { type: \"text\"; text: string } => part.type === \"text\",\n\t\t)\n\t\t.map((part) => part.text)\n\t\t.join(\"\\n\")\n\t\t.trim();\n\tif (!text) {\n\t\treturn {\n\t\t\tsummary: result.isError\n\t\t\t\t? \"Tool failed without text output\"\n\t\t\t\t: \"Tool completed\",\n\t\t\tredactions: [],\n\t\t};\n\t}\n\tconst firstLine = text.split(/\\r?\\n/u)[0]?.trim() ?? text;\n\tconst shortened =\n\t\tfirstLine.length > OBSERVE_OUTPUT_SUMMARY_MAX_LENGTH\n\t\t\t? `${firstLine.slice(0, OBSERVE_OUTPUT_SUMMARY_MAX_LENGTH - 3).trimEnd()}...`\n\t\t\t: firstLine;\n\tconst scrubbed = scrubText(shortened);\n\treturn {\n\t\tsummary: scrubbed.text,\n\t\tredactions: scrubbed.redactions,\n\t};\n}\n\nfunction buildOutputPayload(\n\tresult: ToolResultMessage,\n\tdurationMs: number | undefined,\n): RecordPlatformToolExecutionOutputRequest[\"output\"] {\n\tconst summary = summarizeToolResult(result);\n\tconst safeOutput = {\n\t\tstatus: result.isError ? \"failed\" : \"succeeded\",\n\t\ttool_name: result.toolName,\n\t\ttool_call_id: result.toolCallId,\n\t\tsummary: summary.summary,\n\t};\n\treturn {\n\t\tsafeOutput,\n\t\tredactions: summary.redactions,\n\t\tcontentType: \"application/json\",\n\t\t...(durationMs !== undefined\n\t\t\t? { durationMs: Math.max(0, Math.round(durationMs)) }\n\t\t\t: {}),\n\t};\n}\n\nfunction buildLinkage(\n\tcfg: AgentRunConfig,\n\ttoolCall: ToolCall,\n\torganizationId: string | undefined,\n\tworkspaceId: string,\n\truntimeLinkage: ToolExecutionBridgeRuntimeLinkage | undefined,\n): ToolExecutionLinkage {\n\tconst sessionId =\n\t\ttrimString(cfg.session?.id) ??\n\t\ttrimString(runtimeLinkage?.sessionId) ??\n\t\tgetEnvValue([\"MAESTRO_SESSION_ID\"]);\n\tconst agentRunId =\n\t\ttrimString(runtimeLinkage?.agentRunId) ??\n\t\tgetEnvValue([\"MAESTRO_AGENT_RUN_ID\"]);\n\treturn {\n\t\tworkspaceId: trimString(runtimeLinkage?.workspaceId) ?? workspaceId,\n\t\t...(organizationId ? { organizationId } : {}),\n\t\tagentId:\n\t\t\ttrimString(runtimeLinkage?.agentId) ??\n\t\t\tgetEnvValue([\"MAESTRO_AGENT_ID\"]) ??\n\t\t\ttrimString(process.env.npm_package_name) ??\n\t\t\t\"maestro\",\n\t\t...(agentRunId ? { runId: agentRunId } : {}),\n\t\tobjectiveId: getEnvValue([\n\t\t\t\"MAESTRO_OBJECTIVE_ID\",\n\t\t\t\"MAESTRO_EVALOPS_OBJECTIVE_ID\",\n\t\t]),\n\t\tstepId: toolCall.id,\n\t\tactorId: trimString(cfg.user?.id) ?? getEnvValue([\"MAESTRO_ACTOR_ID\"]),\n\t\tsurface: getEnvValue([\"MAESTRO_SURFACE\"]) ?? \"maestro\",\n\t\tchannelId: getEnvValue([\"MAESTRO_CHANNEL_ID\"]),\n\t\tcorrelationId: `${sessionId ?? \"session\"}:${toolCall.id}`,\n\t};\n}\n\nfunction buildRuntimeContextMetadata(\n\tlinkage: ToolExecutionLinkage,\n): Record<string, string> {\n\tconst cwd =\n\t\tgetMetadataEnvValue([\"MAESTRO_CWD\"]) ?? getCurrentWorkingDirectory();\n\tconst workspaceRoot = getMetadataEnvValue([\n\t\t\"MAESTRO_WORKSPACE_ROOT\",\n\t\t\"WORKSPACE_ROOT\",\n\t]);\n\tconst repositoryRoot =\n\t\tgetMetadataEnvValue([\n\t\t\t\"MAESTRO_REPOSITORY_ROOT\",\n\t\t\t\"MAESTRO_REPO_ROOT\",\n\t\t\t\"GITHUB_WORKSPACE\",\n\t\t]) ?? workspaceRoot;\n\tconst repository = getMetadataEnvValue([\n\t\t\"MAESTRO_GIT_REPOSITORY\",\n\t\t\"GITHUB_REPOSITORY\",\n\t\t\"CI_PROJECT_PATH\",\n\t]);\n\tconst gitBranch = getMetadataEnvValue([\n\t\t\"MAESTRO_GIT_BRANCH\",\n\t\t\"GITHUB_HEAD_REF\",\n\t\t\"GITHUB_REF_NAME\",\n\t\t\"CI_COMMIT_REF_NAME\",\n\t\t\"VERCEL_GIT_COMMIT_REF\",\n\t]);\n\tconst gitCommit = getMetadataEnvValue([\n\t\t\"MAESTRO_GIT_COMMIT\",\n\t\t\"GITHUB_SHA\",\n\t\t\"CI_COMMIT_SHA\",\n\t\t\"VERCEL_GIT_COMMIT_SHA\",\n\t]);\n\n\treturn {\n\t\t...(linkage.organizationId\n\t\t\t? { organization_id: linkage.organizationId }\n\t\t\t: {}),\n\t\t...(linkage.workspaceId ? { workspace_id: linkage.workspaceId } : {}),\n\t\t...(linkage.runId ? { maestro_agent_run_id: linkage.runId } : {}),\n\t\tmaestro_agent_run_step_id: linkage.stepId,\n\t\t...(linkage.actorId ? { maestro_actor_id: linkage.actorId } : {}),\n\t\t...(linkage.correlationId\n\t\t\t? { maestro_correlation_id: linkage.correlationId }\n\t\t\t: {}),\n\t\t...(cwd ? { maestro_cwd: cwd } : {}),\n\t\t...(workspaceRoot ? { maestro_workspace_root: workspaceRoot } : {}),\n\t\t...(repositoryRoot ? { maestro_repository_root: repositoryRoot } : {}),\n\t\t...(repository ? { maestro_repository: repository } : {}),\n\t\t...(gitBranch ? { maestro_git_branch: gitBranch } : {}),\n\t\t...(gitCommit ? { maestro_git_commit: gitCommit } : {}),\n\t};\n}\n\nfunction buildMetadata(\n\tinput: ToolExecutionBridgeInput,\n\tclassification: ToolExecutionClassification,\n\tlinkage: ToolExecutionLinkage,\n\truntimeLinkage: ToolExecutionBridgeRuntimeLinkage | undefined,\n): Record<string, string> {\n\tconst originalArgs = input.toolCall.arguments as Record<string, unknown>;\n\tconst redactedArguments =\n\t\tstableStringify(originalArgs) !== stableStringify(input.sanitizedArgs);\n\tconst sessionId =\n\t\ttrimString(input.cfg.session?.id) ??\n\t\ttrimString(runtimeLinkage?.sessionId) ??\n\t\tgetEnvValue([\"MAESTRO_SESSION_ID\"]);\n\tconst remoteRunnerSessionId =\n\t\ttrimString(runtimeLinkage?.remoteRunnerSessionId) ??\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_REMOTE_RUNNER_SESSION_ID\",\n\t\t\t\"MAESTRO_RUNNER_SESSION_ID\",\n\t\t]);\n\treturn {\n\t\tmaestro_bridge_mode: classification.mode,\n\t\tmaestro_tool_call_id: input.toolCall.id,\n\t\t...buildRuntimeContextMetadata(linkage),\n\t\t...(sessionId ? { maestro_session_id: sessionId } : {}),\n\t\t...(remoteRunnerSessionId\n\t\t\t? { maestro_remote_runner_session_id: remoteRunnerSessionId }\n\t\t\t: {}),\n\t\t...(input.displayName ? { maestro_display_name: input.displayName } : {}),\n\t\t...(input.summaryLabel\n\t\t\t? { maestro_summary_label: input.summaryLabel }\n\t\t\t: {}),\n\t\t...(input.actionDescription\n\t\t\t? { maestro_action_description: input.actionDescription }\n\t\t\t: {}),\n\t\tmaestro_redacted_arguments: String(redactedArguments),\n\t\tmaestro_tool_family: classification.family,\n\t\tmaestro_local_execution_authoritative: String(\n\t\t\tclassification.mode === \"governed\",\n\t\t),\n\t};\n}\n\nfunction buildExecuteRequest(\n\tinput: ToolExecutionBridgeInput,\n\tconfig: ToolExecutionServiceConfig,\n\tclassification: ToolExecutionClassification,\n\truntimeLinkage: ToolExecutionBridgeRuntimeLinkage | undefined,\n): ExecutePlatformToolRequest {\n\tconst linkage = buildLinkage(\n\t\tinput.cfg,\n\t\tinput.toolCall,\n\t\tconfig.organizationId,\n\t\tconfig.workspaceId ?? process.cwd(),\n\t\truntimeLinkage,\n\t);\n\treturn {\n\t\tlinkage,\n\t\ttool: classification.tool,\n\t\t...(classification.connector\n\t\t\t? { connector: classification.connector }\n\t\t\t: {}),\n\t\targuments: cloneRecord(input.sanitizedArgs),\n\t\triskLevel: classification.riskLevel,\n\t\tretryPolicy: {\n\t\t\tmaxAttempts: 1,\n\t\t\tinitialDelayMs: 0,\n\t\t\tmaxDelayMs: 0,\n\t\t\tallowNonIdempotentRetry: false,\n\t\t},\n\t\tidempotencyKey: `maestro:${input.toolCall.id}`,\n\t\tmetadata: buildMetadata(input, classification, linkage, runtimeLinkage),\n\t};\n}\n\nfunction planFromResponse(\n\tclassification: ToolExecutionClassification,\n\tconfig: ToolExecutionServiceConfig,\n\trequest: ExecutePlatformToolRequest,\n\tresponse: ExecutePlatformToolResponse,\n): GovernedToolExecutionPlan {\n\treturn {\n\t\tkind: \"governed\",\n\t\tmode: \"governed\",\n\t\tclassification,\n\t\tconfig,\n\t\trequest,\n\t\tmetadata: {\n\t\t\ttoolExecutionId: response.execution.id,\n\t\t\tapprovalRequestId: response.execution.approvalWait?.approvalRequestId,\n\t\t},\n\t\tresumeToken: response.execution.approvalWait?.resumeToken,\n\t};\n}\n\nfunction waitApprovalRequest(\n\tinput: ToolExecutionBridgeInput,\n\tplan: GovernedToolExecutionPlan,\n\texecution: PlatformToolExecutionRecord,\n): ActionApprovalRequest {\n\treturn {\n\t\tid:\n\t\t\texecution.approvalWait?.approvalRequestId ??\n\t\t\tplan.metadata.approvalRequestId ??\n\t\t\tinput.toolCall.id,\n\t\ttoolName: input.toolCall.name,\n\t\tdisplayName: input.displayName,\n\t\tsummaryLabel: input.summaryLabel,\n\t\tactionDescription: input.actionDescription,\n\t\targs: input.sanitizedArgs,\n\t\treason:\n\t\t\texecution.approvalWait?.reason ??\n\t\t\texecution.errorMessage ??\n\t\t\t\"Approval required by Platform ToolExecution\",\n\t\tplatform: {\n\t\t\tsource: \"tool_execution\",\n\t\t\ttoolExecutionId: execution.id ?? plan.metadata.toolExecutionId,\n\t\t\tapprovalRequestId:\n\t\t\t\texecution.approvalWait?.approvalRequestId ??\n\t\t\t\tplan.metadata.approvalRequestId,\n\t\t},\n\t};\n}\n\nfunction isBridgeGloballyDisabled(): boolean {\n\treturn isFeatureFlagEnabled(MAESTRO_PLATFORM_RUNTIME_BRIDGE_KILL_SWITCH);\n}\n\nexport interface PlatformToolExecutionBridge {\n\tprepare(\n\t\tinput: ToolExecutionBridgeInput,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolExecutionBridgePreparation>;\n\tresolveApproval(\n\t\tinput: ToolExecutionBridgeInput,\n\t\tplan: GovernedToolExecutionPlan,\n\t\tdecision: ActionApprovalDecision,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolExecutionBridgeApprovalResolution>;\n\trecordObservation(\n\t\tplan: ObserveToolExecutionPlan,\n\t\tresult: ToolResultMessage,\n\t\tsignal?: AbortSignal,\n\t): Promise<ObserveToolExecutionResult>;\n\trecordGovernedOutput(\n\t\tplan: GovernedToolExecutionPlan,\n\t\tresult: ToolResultMessage,\n\t\tdurationMs?: number,\n\t\tsignal?: AbortSignal,\n\t): Promise<ObserveToolExecutionResult>;\n}\n\nexport class DefaultPlatformToolExecutionBridge\n\timplements PlatformToolExecutionBridge\n{\n\tprivate readonly runtimeLinkage?: ToolExecutionBridgeRuntimeLinkageProvider;\n\n\tconstructor(options: DefaultPlatformToolExecutionBridgeOptions = {}) {\n\t\tthis.runtimeLinkage = options.runtimeLinkage;\n\t}\n\n\tasync prepare(\n\t\tinput: ToolExecutionBridgeInput,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolExecutionBridgePreparation> {\n\t\tif (isBridgeGloballyDisabled()) {\n\t\t\treturn { status: \"skip\" };\n\t\t}\n\n\t\tconst rollout = {\n\t\t\tobserveEnabled:\n\t\t\t\tisPlatformRuntimeObserveEnabled() ||\n\t\t\t\tisPlatformToolExecutionBridgeEnabled(),\n\t\t\tgovernedEnabled: isPlatformToolExecutionBridgeEnabled(),\n\t\t};\n\t\tconst classification = classifyToolExecution(\n\t\t\tinput.toolCall,\n\t\t\tinput.toolDef,\n\t\t\trollout,\n\t\t);\n\t\tif (!classification) {\n\t\t\treturn { status: \"skip\" };\n\t\t}\n\n\t\tconst config = await resolveToolExecutionServiceConfig();\n\t\tif (!config) {\n\t\t\treturn { status: \"skip\" };\n\t\t}\n\n\t\tconst request = buildExecuteRequest(\n\t\t\tinput,\n\t\t\tconfig,\n\t\t\tclassification,\n\t\t\tresolveRuntimeLinkage(this.runtimeLinkage),\n\t\t);\n\t\tif (classification.mode === \"observe\") {\n\t\t\treturn {\n\t\t\t\tstatus: \"observe\",\n\t\t\t\tplan: {\n\t\t\t\t\tkind: \"observe\",\n\t\t\t\t\tmode: \"observe\",\n\t\t\t\t\tclassification,\n\t\t\t\t\tconfig,\n\t\t\t\t\trequest,\n\t\t\t\t\tmetadata: {},\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\ttry {\n\t\t\tconst response = await executeToolWithPlatform(config, request, signal);\n\t\t\tconst plan = planFromResponse(classification, config, request, response);\n\t\t\tswitch (response.execution.state) {\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_DENIED\":\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\tresponse.execution.errorMessage ??\n\t\t\t\t\t\t\t\"Action denied by Platform ToolExecution\",\n\t\t\t\t\t};\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_WAITING_APPROVAL\":\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: \"wait_approval\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\trequest: waitApprovalRequest(input, plan, response.execution),\n\t\t\t\t\t};\n\t\t\t\tdefault:\n\t\t\t\t\treturn { status: \"allow\", plan };\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (isAbortError(error)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\treturn {\n\t\t\t\tstatus: \"deny\",\n\t\t\t\treason: `Platform ToolExecution unavailable: ${message}`,\n\t\t\t};\n\t\t}\n\t}\n\n\tasync resolveApproval(\n\t\tinput: ToolExecutionBridgeInput,\n\t\tplan: GovernedToolExecutionPlan,\n\t\tdecision: ActionApprovalDecision,\n\t\tsignal?: AbortSignal,\n\t): Promise<ToolExecutionBridgeApprovalResolution> {\n\t\tif (!plan.resumeToken || !plan.metadata.approvalRequestId) {\n\t\t\treturn decision.approved\n\t\t\t\t? { status: \"allow\", plan }\n\t\t\t\t: {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\treason: decision.reason ?? \"Approval denied\",\n\t\t\t\t\t};\n\t\t}\n\t\tconst request: ResumePlatformToolExecutionRequest = {\n\t\t\texecutionId: plan.metadata.toolExecutionId ?? \"\",\n\t\t\tapprovalRequestId: plan.metadata.approvalRequestId,\n\t\t\tresumeToken: plan.resumeToken,\n\t\t\tapproved: decision.approved,\n\t\t\tdecidedBy:\n\t\t\t\tdecision.resolvedBy === \"user\"\n\t\t\t\t\t? (trimString(input.cfg.user?.id) ?? \"user\")\n\t\t\t\t\t: \"policy\",\n\t\t\treason: decision.reason,\n\t\t};\n\t\ttry {\n\t\t\tconst response = await resumeToolExecutionWithPlatform(\n\t\t\t\tplan.config,\n\t\t\t\trequest,\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\tconst nextPlan: GovernedToolExecutionPlan = {\n\t\t\t\t...plan,\n\t\t\t\tmetadata: {\n\t\t\t\t\ttoolExecutionId:\n\t\t\t\t\t\tresponse.execution.id ?? plan.metadata.toolExecutionId,\n\t\t\t\t\tapprovalRequestId:\n\t\t\t\t\t\tresponse.execution.approvalWait?.approvalRequestId ??\n\t\t\t\t\t\tplan.metadata.approvalRequestId,\n\t\t\t\t},\n\t\t\t};\n\t\t\tswitch (response.execution.state) {\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_DENIED\":\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_FAILED\":\n\t\t\t\tcase \"TOOL_EXECUTION_STATE_CANCELLED\":\n\t\t\t\t\treturn {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan: nextPlan,\n\t\t\t\t\t\treason:\n\t\t\t\t\t\t\tresponse.execution.errorMessage ??\n\t\t\t\t\t\t\tdecision.reason ??\n\t\t\t\t\t\t\t\"Platform ToolExecution denied the action\",\n\t\t\t\t\t};\n\t\t\t\tdefault:\n\t\t\t\t\treturn { status: \"allow\", plan: nextPlan };\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tif (isAbortError(error)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\treturn decision.approved\n\t\t\t\t? {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\treason: `Platform ToolExecution decision sync failed: ${message}`,\n\t\t\t\t\t}\n\t\t\t\t: {\n\t\t\t\t\t\tstatus: \"deny\",\n\t\t\t\t\t\tplan,\n\t\t\t\t\t\treason: decision.reason ?? `Approval denied (${message})`,\n\t\t\t\t\t};\n\t\t}\n\t}\n\n\tasync recordObservation(\n\t\tplan: ObserveToolExecutionPlan,\n\t\tresult: ToolResultMessage,\n\t\tsignal?: AbortSignal,\n\t): Promise<ObserveToolExecutionResult> {\n\t\tconst summary = summarizeToolResult(result);\n\t\tconst request: ExecutePlatformToolRequest = {\n\t\t\t...plan.request,\n\t\t\tmetadata: {\n\t\t\t\t...plan.request.metadata,\n\t\t\t\tmaestro_bridge_mode: \"observe\",\n\t\t\t\tmaestro_local_outcome: result.isError ? \"failed\" : \"succeeded\",\n\t\t\t\tmaestro_local_output_summary: summary.summary,\n\t\t\t\tmaestro_local_output_redactions:\n\t\t\t\t\tsummary.redactions.length > 0 ? summary.redactions.join(\",\") : \"none\",\n\t\t\t},\n\t\t};\n\t\ttry {\n\t\t\tconst response = await executeToolWithPlatform(\n\t\t\t\tplan.config,\n\t\t\t\trequest,\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tmetadata: {\n\t\t\t\t\ttoolExecutionId: response.execution.id,\n\t\t\t\t\tapprovalRequestId: response.execution.approvalWait?.approvalRequestId,\n\t\t\t\t},\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tlogger.warn(\"Failed to record observe-only tool execution\", {\n\t\t\t\terror: sanitizeWithStaticMask(message),\n\t\t\t\ttoolName: plan.request.tool.name,\n\t\t\t\ttoolCallId: plan.request.metadata?.maestro_tool_call_id,\n\t\t\t});\n\t\t\treturn { metadata: plan.metadata };\n\t\t}\n\t}\n\n\tasync recordGovernedOutput(\n\t\tplan: GovernedToolExecutionPlan,\n\t\tresult: ToolResultMessage,\n\t\tdurationMs?: number,\n\t\tsignal?: AbortSignal,\n\t): Promise<ObserveToolExecutionResult> {\n\t\tconst executionId = plan.metadata.toolExecutionId;\n\t\tif (!executionId) {\n\t\t\treturn { metadata: plan.metadata };\n\t\t}\n\n\t\tconst request: RecordPlatformToolExecutionOutputRequest = {\n\t\t\texecutionId,\n\t\t\toutput: buildOutputPayload(result, durationMs),\n\t\t\tmetadata: {\n\t\t\t\t...plan.request.metadata,\n\t\t\t\tmaestro_bridge_mode: \"governed\",\n\t\t\t\tmaestro_local_outcome: result.isError ? \"failed\" : \"succeeded\",\n\t\t\t\tmaestro_tool_call_id: result.toolCallId,\n\t\t\t},\n\t\t};\n\t\ttry {\n\t\t\tconst response = await recordToolExecutionOutputWithPlatform(\n\t\t\t\tplan.config,\n\t\t\t\trequest,\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\treturn {\n\t\t\t\tmetadata: {\n\t\t\t\t\ttoolExecutionId: response.execution.id ?? executionId,\n\t\t\t\t\tapprovalRequestId:\n\t\t\t\t\t\tresponse.execution.approvalWait?.approvalRequestId ??\n\t\t\t\t\t\tplan.metadata.approvalRequestId,\n\t\t\t\t},\n\t\t\t};\n\t\t} catch (error) {\n\t\t\tif (isAbortError(error)) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tlogger.warn(\"Failed to record governed tool execution output\", {\n\t\t\t\terror: sanitizeWithStaticMask(message),\n\t\t\t\ttoolName: plan.request.tool.name,\n\t\t\t\ttoolCallId: result.toolCallId,\n\t\t\t\ttoolExecutionId: executionId,\n\t\t\t});\n\t\t\treturn { metadata: plan.metadata };\n\t\t}\n\t}\n}\n\nfunction resolveRuntimeLinkage(\n\tprovider: ToolExecutionBridgeRuntimeLinkageProvider | undefined,\n): ToolExecutionBridgeRuntimeLinkage | undefined {\n\treturn typeof provider === \"function\" ? provider() : provider;\n}\n\nlet defaultBridge: PlatformToolExecutionBridge | null = null;\n\nexport function getDefaultPlatformToolExecutionBridge(): PlatformToolExecutionBridge {\n\tif (!defaultBridge) {\n\t\tdefaultBridge = new DefaultPlatformToolExecutionBridge();\n\t}\n\treturn defaultBridge;\n}\n\nexport function buildObservedResultMetadata(\n\tplan: ToolExecutionBridgePlan | undefined,\n\tobservation: ObserveToolExecutionResult | undefined,\n): ToolExecutionBridgeMetadata {\n\tif (!plan) {\n\t\treturn observation?.metadata ?? {};\n\t}\n\treturn {\n\t\ttoolExecutionId:\n\t\t\tobservation?.metadata.toolExecutionId ?? plan.metadata.toolExecutionId,\n\t\tapprovalRequestId:\n\t\t\tobservation?.metadata.approvalRequestId ??\n\t\t\tplan.metadata.approvalRequestId,\n\t};\n}\n"]}

package/dist/api/enterprise-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-routes.d.ts","sourceRoot":"","sources":["../../src/api/enterprise-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AA0TjD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAelE;AAMD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,EAAE,CA+I5E"}
+{"version":3,"file":"enterprise-routes.d.ts","sourceRoot":"","sources":["../../src/api/enterprise-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAyZjD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAelE;AAMD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,EAAE,CA2J5E"}

package/dist/api/enterprise-routes.js

@@ -2,21 +2,24 @@
  * Enterprise API Routes
  * Handles authentication, RBAC, organizations, and admin features
  */
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { AUDIT_ACTIONS, AuditLogger } from "../audit/logger.js";
 import { TokenTracker } from "../billing/token-tracker.js";
 import { getDb } from "../db/client.js";
-import { alerts, organizations, roles, } from "../db/schema.js";
-import { decryptOrgSettings, encryptOrgSettings, } from "../db/settings-encryption.js";
+import { alerts, organizations, roles, users, } from "../db/schema.js";
+import { decryptOrgSettings, decryptUserSettings, encryptOrgSettings, encryptUserSettings, } from "../db/settings-encryption.js";
 import { ACTIONS, PermissionChecker, RESOURCES, seedPermissions, } from "../rbac/permissions.js";
 import { readJsonBody, sendJson } from "../server/server-utils.js";
 import { resolveInternalTelemetryDisabledSetting } from "../telemetry/disablement.js";
+import { isPlainObject } from "../utils/json.js";
 import { createLogger } from "../utils/logger.js";
 import { handleLogin, handleMe, handleRegister, } from "./enterprise/auth-handlers.js";
 import { handleCreateDirectoryRule, handleDeleteDirectoryRule, handleGetDirectoryRules, } from "./enterprise/directory-rule-handlers.js";
 import { handleGetOrgMembers, handleInviteUser, handleRemoveMember, handleUpdateMemberQuota, handleUpdateMemberRole, } from "./enterprise/member-handlers.js";
 import { authenticateJWT } from "./enterprise/middleware.js";
 import { handleApproveModel, handleDenyModel, handleGetModelApprovals, } from "./enterprise/model-approval-handlers.js";
+import { mergeOrganizationSettings } from "./org-settings-merge.js";
+import { mergeUserSettings } from "./user-settings-merge.js";
 const logger = createLogger("enterprise-api");
 // ============================================================================
 // USAGE & QUOTA ENDPOINTS
@@ -158,13 +161,7 @@ async function handleUpdateOrgSettings(req, res, cors) {
         return;
     }
     const previousSettings = decryptOrgSettings(org.settings) || {};
-    const mergedSettings = {
-        ...previousSettings,
-        ...body,
-        internal: body.internal || previousSettings.internal
-            ? { ...previousSettings.internal, ...body.internal }
-            : undefined,
-    };
+    const mergedSettings = mergeOrganizationSettings(previousSettings, body);
     const previousTelemetryDisabled = resolveInternalTelemetryDisabledSetting(previousSettings);
     const nextTelemetryDisabled = resolveInternalTelemetryDisabledSetting(mergedSettings);
     // Encrypt sensitive fields (webhookSigningSecret) before storing
@@ -188,6 +185,75 @@ async function handleUpdateOrgSettings(req, res, cors) {
     }
     sendJson(res, 200, { success: true }, cors, req);
 }
+async function handleGetUserSettings(req, res, cors) {
+    const auth = await authenticateJWT(req);
+    if (!auth) {
+        sendJson(res, 401, { error: "Unauthorized" }, cors, req);
+        return;
+    }
+    const db = getDb();
+    const user = await db.query.users.findFirst({
+        where: eq(users.id, auth.userId),
+    });
+    if (!user) {
+        sendJson(res, 404, { error: "User not found" }, cors, req);
+        return;
+    }
+    // Decrypt sensitive fields (twoFactor secret) before returning.
+    const decryptedSettings = decryptUserSettings(user.settings) || {};
+    sendJson(res, 200, decryptedSettings, cors, req);
+}
+async function handleUpdateUserSettings(req, res, cors) {
+    const auth = await authenticateJWT(req);
+    if (!auth) {
+        sendJson(res, 401, { error: "Unauthorized" }, cors, req);
+        return;
+    }
+    const body = await readJsonBody(req);
+    if (!isPlainObject(body)) {
+        sendJson(res, 400, { error: "Settings body must be an object" }, cors, req);
+        return;
+    }
+    const requestedSettings = body;
+    const db = getDb();
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const user = await db.query.users.findFirst({
+            where: eq(users.id, auth.userId),
+        });
+        if (!user) {
+            sendJson(res, 404, { error: "User not found" }, cors, req);
+            return;
+        }
+        // Self-scoped: the caller can only touch their own user settings. 2FA
+        // state is preserved from the latest committed row by retrying on
+        // concurrent settings writes, and the maestro runtime-knob namespace is
+        // validated against the MaestroSettings catalog.
+        const previousSettings = decryptUserSettings(user.settings) || {};
+        const mergedSettings = mergeUserSettings(previousSettings, requestedSettings);
+        const encryptedSettings = encryptUserSettings(mergedSettings);
+        const storedSettingsMatch = user.settings == null
+            ? sql `${users.settings} IS NULL`
+            : sql `${users.settings} IS NOT DISTINCT FROM ${JSON.stringify(user.settings)}::jsonb`;
+        const updatedRows = await db
+            .update(users)
+            .set({ settings: encryptedSettings })
+            .where(and(eq(users.id, auth.userId), storedSettingsMatch))
+            .returning({ id: users.id });
+        if (updatedRows.length > 0) {
+            await AuditLogger.log({
+                orgId: auth.orgId,
+                userId: auth.userId,
+                action: AUDIT_ACTIONS.CONFIG_WRITE,
+                resourceType: "user_settings",
+                status: "success",
+                metadata: {},
+            });
+            sendJson(res, 200, { success: true }, cors, req);
+            return;
+        }
+    }
+    sendJson(res, 409, { error: "Settings changed concurrently; please retry" }, cors, req);
+}
 // ============================================================================
 // ROLES
 // ============================================================================
@@ -309,6 +375,17 @@ export function createEnterpriseRoutes(cors) {
             path: "/api/org/settings",
             handler: (req, res) => handleUpdateOrgSettings(req, res, cors),
         },
+        // User Settings (self-scoped to the authenticated user)
+        {
+            method: "GET",
+            path: "/api/user/settings",
+            handler: (req, res) => handleGetUserSettings(req, res, cors),
+        },
+        {
+            method: "PUT",
+            path: "/api/user/settings",
+            handler: (req, res) => handleUpdateUserSettings(req, res, cors),
+        },
         // Roles
         {
             method: "GET",

package/dist/api/enterprise-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-routes.js","sourceRoot":"","sources":["../../src/api/enterprise-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAEN,MAAM,EACN,aAAa,EACb,KAAK,GACL,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACN,OAAO,EACP,iBAAiB,EACjB,SAAS,EACT,eAAe,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,cAAc,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACN,kBAAkB,EAClB,eAAe,EACf,uBAAuB,GACvB,MAAM,yCAAyC,CAAC;AAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE9C,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAC5C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,IAAI,CACZ,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,KAAK,UAAU,eAAe,CAC7B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAC5C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,IAAI,CACZ,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG;KACV,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,KAAK,UAAU,YAAY,CAC1B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjD,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,KAAK,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,KAAK,UAAU,mBAAmB,CACjC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE;SACN,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE;SACN,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,KAAK,UAAU,oBAAoB,CAClC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAClD,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAC1C,SAAS,CAAC,IAAI,EACd,OAAO,CAAC,KAAK,CACb,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAuB,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,cAAc,GAAyB;QAC5C,GAAG,gBAAgB;QACnB,GAAG,IAAI;QACP,QAAQ,EACP,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,QAAQ;YACzC,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE;YACpD,CAAC,CAAC,SAAS;KACb,CAAC;IACF,MAAM,yBAAyB,GAC9B,uCAAuC,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,qBAAqB,GAC1B,uCAAuC,CAAC,cAAc,CAAC,CAAC;IAEzD,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAE7D,MAAM,EAAE;SACN,MAAM,CAAC,aAAa,CAAC;SACrB,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;SACpC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1C,IAAI,yBAAyB,KAAK,qBAAqB,EAAE,CAAC;QACzD,MAAM,WAAW,CAAC,GAAG,CAAC;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,aAAa,CAAC,YAAY;YAClC,YAAY,EAAE,uBAAuB;YACrC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACT,aAAa,EAAE,MAAM,CAAC,yBAAyB,CAAC;gBAChD,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC;aACvC;SACD,CAAC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,KAAK,UAAU,cAAc,CAC5B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC/B,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,4BAA4B;IACjD,IAAI,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAEnD,qCAAqC;QACrC,MAAM,eAAe,EAAE,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,0CAA0C,EAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC1C,CAAC;QACF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,UAAU,sBAAsB,CAAC,IAA4B;IAClE,OAAO;QACN,iBAAiB;QACjB;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAClD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC/C;QAED,iBAAiB;QACjB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACvD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QAED,aAAa;QACb;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACtD;QAED,SAAS;QACT;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACnD;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC1D;QAED,uBAAuB;QACvB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC1D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACvD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAC7D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SACzD;QAED,wBAAwB;QACxB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC3D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QAED,QAAQ;QACR;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QAED,kBAAkB;QAClB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,wCAAwC;YAC9C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC1D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,qCAAqC;YAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SACvD;QAED,yBAAyB;QACzB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAChE;QACD;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAChE;KACD,CAAC;AACH,CAAC","sourcesContent":["/**\n * Enterprise API Routes\n * Handles authentication, RBAC, organizations, and admin features\n */\n\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { and, eq } from \"drizzle-orm\";\nimport { AUDIT_ACTIONS, AuditLogger } from \"../audit/logger.js\";\nimport { TokenTracker } from \"../billing/token-tracker.js\";\nimport { getDb } from \"../db/client.js\";\nimport {\n\ttype OrganizationSettings,\n\talerts,\n\torganizations,\n\troles,\n} from \"../db/schema.js\";\nimport {\n\tdecryptOrgSettings,\n\tencryptOrgSettings,\n} from \"../db/settings-encryption.js\";\nimport {\n\tACTIONS,\n\tPermissionChecker,\n\tRESOURCES,\n\tseedPermissions,\n} from \"../rbac/permissions.js\";\nimport type { Route } from \"../server/router.js\";\nimport { readJsonBody, sendJson } from \"../server/server-utils.js\";\nimport { resolveInternalTelemetryDisabledSetting } from \"../telemetry/disablement.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\thandleLogin,\n\thandleMe,\n\thandleRegister,\n} from \"./enterprise/auth-handlers.js\";\nimport {\n\thandleCreateDirectoryRule,\n\thandleDeleteDirectoryRule,\n\thandleGetDirectoryRules,\n} from \"./enterprise/directory-rule-handlers.js\";\nimport {\n\thandleGetOrgMembers,\n\thandleInviteUser,\n\thandleRemoveMember,\n\thandleUpdateMemberQuota,\n\thandleUpdateMemberRole,\n} from \"./enterprise/member-handlers.js\";\nimport { authenticateJWT } from \"./enterprise/middleware.js\";\nimport {\n\thandleApproveModel,\n\thandleDenyModel,\n\thandleGetModelApprovals,\n} from \"./enterprise/model-approval-handlers.js\";\n\nconst logger = createLogger(\"enterprise-api\");\n\n// ============================================================================\n// USAGE & QUOTA ENDPOINTS\n// ============================================================================\n\nasync function handleUsageQuota(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst quota = await TokenTracker.getQuota(auth.userId, auth.orgId);\n\tsendJson(res, 200, quota, cors, req);\n}\n\nasync function handleOrgUsage(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Check permission\n\tconst allowed = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId, roleId: auth.roleId },\n\t\tRESOURCES.AUDIT,\n\t\tACTIONS.READ,\n\t);\n\n\tif (!allowed) {\n\t\tsendJson(res, 403, { error: \"Forbidden\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst summary = await TokenTracker.getOrgUsageSummary(auth.orgId);\n\tsendJson(res, 200, summary, cors, req);\n}\n\n// ============================================================================\n// AUDIT LOG ENDPOINTS\n// ============================================================================\n\nasync function handleAuditLogs(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Check permission\n\tconst allowed = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId, roleId: auth.roleId },\n\t\tRESOURCES.AUDIT,\n\t\tACTIONS.READ,\n\t);\n\n\tif (!allowed) {\n\t\tsendJson(res, 403, { error: \"Forbidden\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst logs = await AuditLogger.query({\n\t\torgId: auth.orgId,\n\t\tlimit: 100,\n\t});\n\n\tsendJson(res, 200, { logs }, cors, req);\n}\n\n// ============================================================================\n// ALERT ENDPOINTS\n// ============================================================================\n\nasync function handleAlerts(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst userAlerts = await db.query.alerts.findMany({\n\t\twhere: and(eq(alerts.orgId, auth.orgId), eq(alerts.userId, auth.userId)),\n\t\torderBy: (alerts, { desc }) => [desc(alerts.createdAt)],\n\t\tlimit: 50,\n\t});\n\n\tsendJson(res, 200, { alerts: userAlerts }, cors, req);\n}\n\n// ============================================================================\n// ALERT ACTIONS\n// ============================================================================\n\nasync function handleMarkAlertRead(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\talertId: string,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tawait db\n\t\t.update(alerts)\n\t\t.set({ isRead: true })\n\t\t.where(and(eq(alerts.id, alertId), eq(alerts.orgId, auth.orgId)));\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\nasync function handleResolveAlert(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\talertId: string,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tawait db\n\t\t.update(alerts)\n\t\t.set({ resolvedAt: new Date() })\n\t\t.where(and(eq(alerts.id, alertId), eq(alerts.orgId, auth.orgId)));\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\n// ============================================================================\n// ORGANIZATION SETTINGS\n// ============================================================================\n\nasync function handleGetOrgSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst org = await db.query.organizations.findFirst({\n\t\twhere: eq(organizations.id, auth.orgId),\n\t});\n\n\tif (!org) {\n\t\tsendJson(res, 404, { error: \"Organization not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Decrypt sensitive fields (webhookSigningSecret) before returning\n\tconst decryptedSettings = decryptOrgSettings(org.settings) || {};\n\tsendJson(res, 200, decryptedSettings, cors, req);\n}\n\nasync function handleUpdateOrgSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst hasPermission = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId },\n\t\tRESOURCES.ORGS,\n\t\tACTIONS.WRITE,\n\t);\n\tif (!hasPermission) {\n\t\tsendJson(res, 403, { error: \"Permission denied\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst body = await readJsonBody<OrganizationSettings>(req);\n\tif (!body) {\n\t\tsendJson(res, 400, { error: \"Settings body required\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst org = await db.query.organizations.findFirst({\n\t\twhere: eq(organizations.id, auth.orgId),\n\t});\n\tif (!org) {\n\t\tsendJson(res, 404, { error: \"Organization not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst previousSettings = decryptOrgSettings(org.settings) || {};\n\tconst mergedSettings: OrganizationSettings = {\n\t\t...previousSettings,\n\t\t...body,\n\t\tinternal:\n\t\t\tbody.internal || previousSettings.internal\n\t\t\t\t? { ...previousSettings.internal, ...body.internal }\n\t\t\t\t: undefined,\n\t};\n\tconst previousTelemetryDisabled =\n\t\tresolveInternalTelemetryDisabledSetting(previousSettings);\n\tconst nextTelemetryDisabled =\n\t\tresolveInternalTelemetryDisabledSetting(mergedSettings);\n\n\t// Encrypt sensitive fields (webhookSigningSecret) before storing\n\tconst encryptedSettings = encryptOrgSettings(mergedSettings);\n\n\tawait db\n\t\t.update(organizations)\n\t\t.set({ settings: encryptedSettings })\n\t\t.where(eq(organizations.id, auth.orgId));\n\n\tif (previousTelemetryDisabled !== nextTelemetryDisabled) {\n\t\tawait AuditLogger.log({\n\t\t\torgId: auth.orgId,\n\t\t\tuserId: auth.userId,\n\t\t\taction: AUDIT_ACTIONS.CONFIG_WRITE,\n\t\t\tresourceType: \"organization_settings\",\n\t\t\tstatus: \"success\",\n\t\t\tmetadata: {\n\t\t\t\toriginalValue: String(previousTelemetryDisabled),\n\t\t\t\tnewValue: String(nextTelemetryDisabled),\n\t\t\t},\n\t\t});\n\t}\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\n// ============================================================================\n// ROLES\n// ============================================================================\n\nasync function handleGetRoles(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst orgRoles = await db.query.roles.findMany({\n\t\twhere: eq(roles.isSystem, true),\n\t});\n\n\tsendJson(res, 200, { roles: orgRoles }, cors, req);\n}\n\n// ============================================================================\n// INITIALIZE ENTERPRISE FEATURES\n// ============================================================================\n\nexport async function initializeEnterpriseFeatures(): Promise<void> {\n\ttry {\n\t\tlogger.info(\"Initializing enterprise features...\");\n\n\t\t// Seed default permissions and roles\n\t\tawait seedPermissions();\n\n\t\tlogger.info(\"Enterprise features initialized successfully\");\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Failed to initialize enterprise features\",\n\t\t\terror instanceof Error ? error : undefined,\n\t\t);\n\t\tthrow error;\n\t}\n}\n\n// ============================================================================\n// ROUTE EXPORTS\n// ============================================================================\n\nexport function createEnterpriseRoutes(cors: Record<string, string>): Route[] {\n\treturn [\n\t\t// Authentication\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/auth/register\",\n\t\t\thandler: (req, res) => handleRegister(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/auth/login\",\n\t\t\thandler: (req, res) => handleLogin(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/auth/me\",\n\t\t\thandler: (req, res) => handleMe(req, res, cors),\n\t\t},\n\n\t\t// Usage & Quotas\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/usage/quota\",\n\t\t\thandler: (req, res) => handleUsageQuota(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/usage/org\",\n\t\t\thandler: (req, res) => handleOrgUsage(req, res, cors),\n\t\t},\n\n\t\t// Audit Logs\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/audit/logs\",\n\t\t\thandler: (req, res) => handleAuditLogs(req, res, cors),\n\t\t},\n\n\t\t// Alerts\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/alerts\",\n\t\t\thandler: (req, res) => handleAlerts(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/alerts/:alertId/read\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleMarkAlertRead(req, res, cors, params?.alertId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/alerts/:alertId/resolve\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleResolveAlert(req, res, cors, params?.alertId || \"\"),\n\t\t},\n\n\t\t// Organization Members\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/org/members\",\n\t\t\thandler: (req, res) => handleGetOrgMembers(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/org/members/invite\",\n\t\t\thandler: (req, res) => handleInviteUser(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/members/:userId/role\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleUpdateMemberRole(req, res, cors, params?.userId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/members/:userId/quota\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleUpdateMemberQuota(req, res, cors, params?.userId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\tpath: \"/api/org/members/:userId\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleRemoveMember(req, res, cors, params?.userId || \"\"),\n\t\t},\n\n\t\t// Organization Settings\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/org/settings\",\n\t\t\thandler: (req, res) => handleGetOrgSettings(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/settings\",\n\t\t\thandler: (req, res) => handleUpdateOrgSettings(req, res, cors),\n\t\t},\n\n\t\t// Roles\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/roles\",\n\t\t\thandler: (req, res) => handleGetRoles(req, res, cors),\n\t\t},\n\n\t\t// Model Approvals\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/models/approvals\",\n\t\t\thandler: (req, res) => handleGetModelApprovals(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/models/approvals/:modelId/approve\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleApproveModel(req, res, cors, params?.modelId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/models/approvals/:modelId/deny\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleDenyModel(req, res, cors, params?.modelId || \"\"),\n\t\t},\n\n\t\t// Directory Access Rules\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/directory-rules\",\n\t\t\thandler: (req, res) => handleGetDirectoryRules(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/directory-rules\",\n\t\t\thandler: (req, res) => handleCreateDirectoryRule(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\tpath: \"/api/directory-rules/:ruleId\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleDeleteDirectoryRule(req, res, cors, params?.ruleId || \"\"),\n\t\t},\n\t];\n}\n"]}
+{"version":3,"file":"enterprise-routes.js","sourceRoot":"","sources":["../../src/api/enterprise-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAGN,MAAM,EACN,aAAa,EACb,KAAK,EACL,KAAK,GACL,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACN,OAAO,EACP,iBAAiB,EACjB,SAAS,EACT,eAAe,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,cAAc,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACN,kBAAkB,EAClB,eAAe,EACf,uBAAuB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE9C,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAC5C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,IAAI,CACZ,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,KAAK,UAAU,eAAe,CAC7B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAC5C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,IAAI,CACZ,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG;KACV,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,KAAK,UAAU,YAAY,CAC1B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjD,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,KAAK,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,KAAK,UAAU,mBAAmB,CACjC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE;SACN,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE;SACN,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,KAAK,UAAU,oBAAoB,CAClC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAClD,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAC1C,SAAS,CAAC,IAAI,EACd,OAAO,CAAC,KAAK,CACb,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAuB,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,cAAc,GAAG,yBAAyB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACzE,MAAM,yBAAyB,GAC9B,uCAAuC,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,qBAAqB,GAC1B,uCAAuC,CAAC,cAAc,CAAC,CAAC;IAEzD,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAE7D,MAAM,EAAE;SACN,MAAM,CAAC,aAAa,CAAC;SACrB,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;SACpC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1C,IAAI,yBAAyB,KAAK,qBAAqB,EAAE,CAAC;QACzD,MAAM,WAAW,CAAC,GAAG,CAAC;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,aAAa,CAAC,YAAY;YAClC,YAAY,EAAE,uBAAuB;YACrC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACT,aAAa,EAAE,MAAM,CAAC,yBAAyB,CAAC;gBAChD,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC;aACvC;SACD,CAAC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,qBAAqB,CACnC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC3C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO;IACR,CAAC;IAED,gEAAgE;IAChE,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAU,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO;IACR,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAoB,CAAC;IAE/C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC3C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3D,OAAO;QACR,CAAC;QAED,sEAAsE;QACtE,kEAAkE;QAClE,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,cAAc,GAAG,iBAAiB,CACvC,gBAAgB,EAChB,iBAAiB,CACjB,CAAC;QACF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,mBAAmB,GACxB,IAAI,CAAC,QAAQ,IAAI,IAAI;YACpB,CAAC,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,UAAU;YAChC,CAAC,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAExF,MAAM,WAAW,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;aACpC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC;aAC1D,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAE9B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,WAAW,CAAC,GAAG,CAAC;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,aAAa,CAAC,YAAY;gBAClC,YAAY,EAAE,eAAe;gBAC7B,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE;aACZ,CAAC,CAAC;YAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjD,OAAO;QACR,CAAC;IACF,CAAC;IAED,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,6CAA6C,EAAE,EACxD,IAAI,EACJ,GAAG,CACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,KAAK,UAAU,cAAc,CAC5B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC/B,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,4BAA4B;IACjD,IAAI,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAEnD,qCAAqC;QACrC,MAAM,eAAe,EAAE,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,0CAA0C,EAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC1C,CAAC;QACF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,UAAU,sBAAsB,CAAC,IAA4B;IAClE,OAAO;QACN,iBAAiB;QACjB;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAClD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC/C;QAED,iBAAiB;QACjB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACvD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QAED,aAAa;QACb;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACtD;QAED,SAAS;QACT;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACnD;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC1D;QAED,uBAAuB;QACvB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC1D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACvD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAC7D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SACzD;QAED,wBAAwB;QACxB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC3D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QAED,wDAAwD;QACxD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC5D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC/D;QAED,QAAQ;QACR;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QAED,kBAAkB;QAClB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,wCAAwC;YAC9C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC1D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,qCAAqC;YAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SACvD;QAED,yBAAyB;QACzB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAChE;QACD;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAChE;KACD,CAAC;AACH,CAAC","sourcesContent":["/**\n * Enterprise API Routes\n * Handles authentication, RBAC, organizations, and admin features\n */\n\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { and, eq, sql } from \"drizzle-orm\";\nimport { AUDIT_ACTIONS, AuditLogger } from \"../audit/logger.js\";\nimport { TokenTracker } from \"../billing/token-tracker.js\";\nimport { getDb } from \"../db/client.js\";\nimport {\n\ttype OrganizationSettings,\n\ttype UserSettings,\n\talerts,\n\torganizations,\n\troles,\n\tusers,\n} from \"../db/schema.js\";\nimport {\n\tdecryptOrgSettings,\n\tdecryptUserSettings,\n\tencryptOrgSettings,\n\tencryptUserSettings,\n} from \"../db/settings-encryption.js\";\nimport {\n\tACTIONS,\n\tPermissionChecker,\n\tRESOURCES,\n\tseedPermissions,\n} from \"../rbac/permissions.js\";\nimport type { Route } from \"../server/router.js\";\nimport { readJsonBody, sendJson } from \"../server/server-utils.js\";\nimport { resolveInternalTelemetryDisabledSetting } from \"../telemetry/disablement.js\";\nimport { isPlainObject } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\thandleLogin,\n\thandleMe,\n\thandleRegister,\n} from \"./enterprise/auth-handlers.js\";\nimport {\n\thandleCreateDirectoryRule,\n\thandleDeleteDirectoryRule,\n\thandleGetDirectoryRules,\n} from \"./enterprise/directory-rule-handlers.js\";\nimport {\n\thandleGetOrgMembers,\n\thandleInviteUser,\n\thandleRemoveMember,\n\thandleUpdateMemberQuota,\n\thandleUpdateMemberRole,\n} from \"./enterprise/member-handlers.js\";\nimport { authenticateJWT } from \"./enterprise/middleware.js\";\nimport {\n\thandleApproveModel,\n\thandleDenyModel,\n\thandleGetModelApprovals,\n} from \"./enterprise/model-approval-handlers.js\";\nimport { mergeOrganizationSettings } from \"./org-settings-merge.js\";\nimport { mergeUserSettings } from \"./user-settings-merge.js\";\n\nconst logger = createLogger(\"enterprise-api\");\n\n// ============================================================================\n// USAGE & QUOTA ENDPOINTS\n// ============================================================================\n\nasync function handleUsageQuota(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst quota = await TokenTracker.getQuota(auth.userId, auth.orgId);\n\tsendJson(res, 200, quota, cors, req);\n}\n\nasync function handleOrgUsage(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Check permission\n\tconst allowed = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId, roleId: auth.roleId },\n\t\tRESOURCES.AUDIT,\n\t\tACTIONS.READ,\n\t);\n\n\tif (!allowed) {\n\t\tsendJson(res, 403, { error: \"Forbidden\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst summary = await TokenTracker.getOrgUsageSummary(auth.orgId);\n\tsendJson(res, 200, summary, cors, req);\n}\n\n// ============================================================================\n// AUDIT LOG ENDPOINTS\n// ============================================================================\n\nasync function handleAuditLogs(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Check permission\n\tconst allowed = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId, roleId: auth.roleId },\n\t\tRESOURCES.AUDIT,\n\t\tACTIONS.READ,\n\t);\n\n\tif (!allowed) {\n\t\tsendJson(res, 403, { error: \"Forbidden\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst logs = await AuditLogger.query({\n\t\torgId: auth.orgId,\n\t\tlimit: 100,\n\t});\n\n\tsendJson(res, 200, { logs }, cors, req);\n}\n\n// ============================================================================\n// ALERT ENDPOINTS\n// ============================================================================\n\nasync function handleAlerts(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst userAlerts = await db.query.alerts.findMany({\n\t\twhere: and(eq(alerts.orgId, auth.orgId), eq(alerts.userId, auth.userId)),\n\t\torderBy: (alerts, { desc }) => [desc(alerts.createdAt)],\n\t\tlimit: 50,\n\t});\n\n\tsendJson(res, 200, { alerts: userAlerts }, cors, req);\n}\n\n// ============================================================================\n// ALERT ACTIONS\n// ============================================================================\n\nasync function handleMarkAlertRead(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\talertId: string,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tawait db\n\t\t.update(alerts)\n\t\t.set({ isRead: true })\n\t\t.where(and(eq(alerts.id, alertId), eq(alerts.orgId, auth.orgId)));\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\nasync function handleResolveAlert(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\talertId: string,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tawait db\n\t\t.update(alerts)\n\t\t.set({ resolvedAt: new Date() })\n\t\t.where(and(eq(alerts.id, alertId), eq(alerts.orgId, auth.orgId)));\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\n// ============================================================================\n// ORGANIZATION SETTINGS\n// ============================================================================\n\nasync function handleGetOrgSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst org = await db.query.organizations.findFirst({\n\t\twhere: eq(organizations.id, auth.orgId),\n\t});\n\n\tif (!org) {\n\t\tsendJson(res, 404, { error: \"Organization not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Decrypt sensitive fields (webhookSigningSecret) before returning\n\tconst decryptedSettings = decryptOrgSettings(org.settings) || {};\n\tsendJson(res, 200, decryptedSettings, cors, req);\n}\n\nasync function handleUpdateOrgSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst hasPermission = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId },\n\t\tRESOURCES.ORGS,\n\t\tACTIONS.WRITE,\n\t);\n\tif (!hasPermission) {\n\t\tsendJson(res, 403, { error: \"Permission denied\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst body = await readJsonBody<OrganizationSettings>(req);\n\tif (!body) {\n\t\tsendJson(res, 400, { error: \"Settings body required\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst org = await db.query.organizations.findFirst({\n\t\twhere: eq(organizations.id, auth.orgId),\n\t});\n\tif (!org) {\n\t\tsendJson(res, 404, { error: \"Organization not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst previousSettings = decryptOrgSettings(org.settings) || {};\n\tconst mergedSettings = mergeOrganizationSettings(previousSettings, body);\n\tconst previousTelemetryDisabled =\n\t\tresolveInternalTelemetryDisabledSetting(previousSettings);\n\tconst nextTelemetryDisabled =\n\t\tresolveInternalTelemetryDisabledSetting(mergedSettings);\n\n\t// Encrypt sensitive fields (webhookSigningSecret) before storing\n\tconst encryptedSettings = encryptOrgSettings(mergedSettings);\n\n\tawait db\n\t\t.update(organizations)\n\t\t.set({ settings: encryptedSettings })\n\t\t.where(eq(organizations.id, auth.orgId));\n\n\tif (previousTelemetryDisabled !== nextTelemetryDisabled) {\n\t\tawait AuditLogger.log({\n\t\t\torgId: auth.orgId,\n\t\t\tuserId: auth.userId,\n\t\t\taction: AUDIT_ACTIONS.CONFIG_WRITE,\n\t\t\tresourceType: \"organization_settings\",\n\t\t\tstatus: \"success\",\n\t\t\tmetadata: {\n\t\t\t\toriginalValue: String(previousTelemetryDisabled),\n\t\t\t\tnewValue: String(nextTelemetryDisabled),\n\t\t\t},\n\t\t});\n\t}\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\nasync function handleGetUserSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst user = await db.query.users.findFirst({\n\t\twhere: eq(users.id, auth.userId),\n\t});\n\n\tif (!user) {\n\t\tsendJson(res, 404, { error: \"User not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Decrypt sensitive fields (twoFactor secret) before returning.\n\tconst decryptedSettings = decryptUserSettings(user.settings) || {};\n\tsendJson(res, 200, decryptedSettings, cors, req);\n}\n\nasync function handleUpdateUserSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst body = await readJsonBody<unknown>(req);\n\tif (!isPlainObject(body)) {\n\t\tsendJson(res, 400, { error: \"Settings body must be an object\" }, cors, req);\n\t\treturn;\n\t}\n\tconst requestedSettings = body as UserSettings;\n\n\tconst db = getDb();\n\tfor (let attempt = 0; attempt < 3; attempt++) {\n\t\tconst user = await db.query.users.findFirst({\n\t\t\twhere: eq(users.id, auth.userId),\n\t\t});\n\t\tif (!user) {\n\t\t\tsendJson(res, 404, { error: \"User not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\t// Self-scoped: the caller can only touch their own user settings. 2FA\n\t\t// state is preserved from the latest committed row by retrying on\n\t\t// concurrent settings writes, and the maestro runtime-knob namespace is\n\t\t// validated against the MaestroSettings catalog.\n\t\tconst previousSettings = decryptUserSettings(user.settings) || {};\n\t\tconst mergedSettings = mergeUserSettings(\n\t\t\tpreviousSettings,\n\t\t\trequestedSettings,\n\t\t);\n\t\tconst encryptedSettings = encryptUserSettings(mergedSettings);\n\t\tconst storedSettingsMatch =\n\t\t\tuser.settings == null\n\t\t\t\t? sql`${users.settings} IS NULL`\n\t\t\t\t: sql`${users.settings} IS NOT DISTINCT FROM ${JSON.stringify(user.settings)}::jsonb`;\n\n\t\tconst updatedRows = await db\n\t\t\t.update(users)\n\t\t\t.set({ settings: encryptedSettings })\n\t\t\t.where(and(eq(users.id, auth.userId), storedSettingsMatch))\n\t\t\t.returning({ id: users.id });\n\n\t\tif (updatedRows.length > 0) {\n\t\t\tawait AuditLogger.log({\n\t\t\t\torgId: auth.orgId,\n\t\t\t\tuserId: auth.userId,\n\t\t\t\taction: AUDIT_ACTIONS.CONFIG_WRITE,\n\t\t\t\tresourceType: \"user_settings\",\n\t\t\t\tstatus: \"success\",\n\t\t\t\tmetadata: {},\n\t\t\t});\n\n\t\t\tsendJson(res, 200, { success: true }, cors, req);\n\t\t\treturn;\n\t\t}\n\t}\n\n\tsendJson(\n\t\tres,\n\t\t409,\n\t\t{ error: \"Settings changed concurrently; please retry\" },\n\t\tcors,\n\t\treq,\n\t);\n}\n\n// ============================================================================\n// ROLES\n// ============================================================================\n\nasync function handleGetRoles(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst orgRoles = await db.query.roles.findMany({\n\t\twhere: eq(roles.isSystem, true),\n\t});\n\n\tsendJson(res, 200, { roles: orgRoles }, cors, req);\n}\n\n// ============================================================================\n// INITIALIZE ENTERPRISE FEATURES\n// ============================================================================\n\nexport async function initializeEnterpriseFeatures(): Promise<void> {\n\ttry {\n\t\tlogger.info(\"Initializing enterprise features...\");\n\n\t\t// Seed default permissions and roles\n\t\tawait seedPermissions();\n\n\t\tlogger.info(\"Enterprise features initialized successfully\");\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Failed to initialize enterprise features\",\n\t\t\terror instanceof Error ? error : undefined,\n\t\t);\n\t\tthrow error;\n\t}\n}\n\n// ============================================================================\n// ROUTE EXPORTS\n// ============================================================================\n\nexport function createEnterpriseRoutes(cors: Record<string, string>): Route[] {\n\treturn [\n\t\t// Authentication\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/auth/register\",\n\t\t\thandler: (req, res) => handleRegister(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/auth/login\",\n\t\t\thandler: (req, res) => handleLogin(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/auth/me\",\n\t\t\thandler: (req, res) => handleMe(req, res, cors),\n\t\t},\n\n\t\t// Usage & Quotas\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/usage/quota\",\n\t\t\thandler: (req, res) => handleUsageQuota(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/usage/org\",\n\t\t\thandler: (req, res) => handleOrgUsage(req, res, cors),\n\t\t},\n\n\t\t// Audit Logs\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/audit/logs\",\n\t\t\thandler: (req, res) => handleAuditLogs(req, res, cors),\n\t\t},\n\n\t\t// Alerts\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/alerts\",\n\t\t\thandler: (req, res) => handleAlerts(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/alerts/:alertId/read\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleMarkAlertRead(req, res, cors, params?.alertId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/alerts/:alertId/resolve\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleResolveAlert(req, res, cors, params?.alertId || \"\"),\n\t\t},\n\n\t\t// Organization Members\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/org/members\",\n\t\t\thandler: (req, res) => handleGetOrgMembers(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/org/members/invite\",\n\t\t\thandler: (req, res) => handleInviteUser(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/members/:userId/role\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleUpdateMemberRole(req, res, cors, params?.userId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/members/:userId/quota\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleUpdateMemberQuota(req, res, cors, params?.userId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\tpath: \"/api/org/members/:userId\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleRemoveMember(req, res, cors, params?.userId || \"\"),\n\t\t},\n\n\t\t// Organization Settings\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/org/settings\",\n\t\t\thandler: (req, res) => handleGetOrgSettings(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/settings\",\n\t\t\thandler: (req, res) => handleUpdateOrgSettings(req, res, cors),\n\t\t},\n\n\t\t// User Settings (self-scoped to the authenticated user)\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/user/settings\",\n\t\t\thandler: (req, res) => handleGetUserSettings(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/user/settings\",\n\t\t\thandler: (req, res) => handleUpdateUserSettings(req, res, cors),\n\t\t},\n\n\t\t// Roles\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/roles\",\n\t\t\thandler: (req, res) => handleGetRoles(req, res, cors),\n\t\t},\n\n\t\t// Model Approvals\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/models/approvals\",\n\t\t\thandler: (req, res) => handleGetModelApprovals(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/models/approvals/:modelId/approve\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleApproveModel(req, res, cors, params?.modelId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/models/approvals/:modelId/deny\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleDenyModel(req, res, cors, params?.modelId || \"\"),\n\t\t},\n\n\t\t// Directory Access Rules\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/directory-rules\",\n\t\t\thandler: (req, res) => handleGetDirectoryRules(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/directory-rules\",\n\t\t\thandler: (req, res) => handleCreateDirectoryRule(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\tpath: \"/api/directory-rules/:ruleId\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleDeleteDirectoryRule(req, res, cors, params?.ruleId || \"\"),\n\t\t},\n\t];\n}\n"]}

package/dist/api/org-settings-merge.d.ts

@@ -0,0 +1,12 @@
+import type { OrganizationSettings } from "../db/schema.js";
+/**
+ * Merge an incoming organization-settings patch onto the previously stored
+ * settings. Nested namespaces (`internal`, `maestro`) deep-merge with the
+ * incoming layer winning at each leaf; scalar/array fields are replaced.
+ *
+ * The `maestro` namespace is normalized against the MaestroSettings catalog
+ * (`mergeMaestroSettings`), so only typed, valid values are ever stored on the
+ * jsonb column — the catalog is enforced at the write boundary.
+ */
+export declare function mergeOrganizationSettings(previous: OrganizationSettings | null | undefined, incoming: OrganizationSettings): OrganizationSettings;
+//# sourceMappingURL=org-settings-merge.d.ts.map

package/dist/api/org-settings-merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-settings-merge.d.ts","sourceRoot":"","sources":["../../src/api/org-settings-merge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACjD,QAAQ,EAAE,oBAAoB,GAC5B,oBAAoB,CAgCtB"}

package/dist/api/org-settings-merge.js

@@ -0,0 +1,38 @@
+import { mergeMaestroSettings } from "@evalops/contracts";
+/**
+ * Merge an incoming organization-settings patch onto the previously stored
+ * settings. Nested namespaces (`internal`, `maestro`) deep-merge with the
+ * incoming layer winning at each leaf; scalar/array fields are replaced.
+ *
+ * The `maestro` namespace is normalized against the MaestroSettings catalog
+ * (`mergeMaestroSettings`), so only typed, valid values are ever stored on the
+ * jsonb column — the catalog is enforced at the write boundary.
+ */
+export function mergeOrganizationSettings(previous, incoming) {
+    const previousSettings = previous ?? {};
+    const internal = incoming.internal || previousSettings.internal
+        ? { ...previousSettings.internal, ...incoming.internal }
+        : undefined;
+    const mergedMaestro = mergeMaestroSettings(previousSettings.maestro, incoming.maestro);
+    const maestro = Object.keys(mergedMaestro).length > 0 ? mergedMaestro : undefined;
+    const result = {
+        ...previousSettings,
+        ...incoming,
+    };
+    // Nested namespaces are deep-merged above; replace whatever the shallow
+    // spread produced so they are never clobbered by an explicit undefined.
+    if (internal !== undefined) {
+        result.internal = internal;
+    }
+    else {
+        delete result.internal;
+    }
+    if (maestro !== undefined) {
+        result.maestro = maestro;
+    }
+    else {
+        delete result.maestro;
+    }
+    return result;
+}
+//# sourceMappingURL=org-settings-merge.js.map

package/dist/api/org-settings-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-settings-merge.js","sourceRoot":"","sources":["../../src/api/org-settings-merge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG1D;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACxC,QAAiD,EACjD,QAA8B;IAE9B,MAAM,gBAAgB,GAAyB,QAAQ,IAAI,EAAE,CAAC;IAE9D,MAAM,QAAQ,GACb,QAAQ,CAAC,QAAQ,IAAI,gBAAgB,CAAC,QAAQ;QAC7C,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE;QACxD,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,aAAa,GAAG,oBAAoB,CACzC,gBAAgB,CAAC,OAAO,EACxB,QAAQ,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,OAAO,GACZ,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,MAAM,MAAM,GAAyB;QACpC,GAAG,gBAAgB;QACnB,GAAG,QAAQ;KACX,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC5B,CAAC;SAAM,CAAC;QACP,OAAO,MAAM,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAC1B,CAAC;SAAM,CAAC;QACP,OAAO,MAAM,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC","sourcesContent":["import { mergeMaestroSettings } from \"@evalops/contracts\";\nimport type { OrganizationSettings } from \"../db/schema.js\";\n\n/**\n * Merge an incoming organization-settings patch onto the previously stored\n * settings. Nested namespaces (`internal`, `maestro`) deep-merge with the\n * incoming layer winning at each leaf; scalar/array fields are replaced.\n *\n * The `maestro` namespace is normalized against the MaestroSettings catalog\n * (`mergeMaestroSettings`), so only typed, valid values are ever stored on the\n * jsonb column — the catalog is enforced at the write boundary.\n */\nexport function mergeOrganizationSettings(\n\tprevious: OrganizationSettings | null | undefined,\n\tincoming: OrganizationSettings,\n): OrganizationSettings {\n\tconst previousSettings: OrganizationSettings = previous ?? {};\n\n\tconst internal =\n\t\tincoming.internal || previousSettings.internal\n\t\t\t? { ...previousSettings.internal, ...incoming.internal }\n\t\t\t: undefined;\n\n\tconst mergedMaestro = mergeMaestroSettings(\n\t\tpreviousSettings.maestro,\n\t\tincoming.maestro,\n\t);\n\tconst maestro =\n\t\tObject.keys(mergedMaestro).length > 0 ? mergedMaestro : undefined;\n\n\tconst result: OrganizationSettings = {\n\t\t...previousSettings,\n\t\t...incoming,\n\t};\n\t// Nested namespaces are deep-merged above; replace whatever the shallow\n\t// spread produced so they are never clobbered by an explicit undefined.\n\tif (internal !== undefined) {\n\t\tresult.internal = internal;\n\t} else {\n\t\tdelete result.internal;\n\t}\n\tif (maestro !== undefined) {\n\t\tresult.maestro = maestro;\n\t} else {\n\t\tdelete result.maestro;\n\t}\n\treturn result;\n}\n"]}