@executor-js/plugin-mcp 0.1.0 → 0.2.1

package/dist/chunk-C2GNZGFJ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sdk/types.ts","../src/sdk/binding-store.ts","../src/sdk/plugin.ts","../src/api/group.ts","../src/sdk/errors.ts","../src/sdk/stored-source.ts","../src/api/handlers.ts","../src/sdk/connection.ts","../src/sdk/discover.ts","../src/sdk/manifest.ts","../src/sdk/invoke.ts","../src/sdk/probe-shape.ts"],"sourcesContent":["import { Effect, Schema } from \"effect\";\nimport { SecretBackedMap, SecretBackedValue } from \"@executor-js/sdk/core\";\n\nexport { SecretBackedMap, SecretBackedValue };\n\n// ---------------------------------------------------------------------------\n// Remote transport type\n// ---------------------------------------------------------------------------\n\nexport const McpRemoteTransport = Schema.Literals([\"streamable-http\", \"sse\", \"auto\"]);\nexport type McpRemoteTransport = typeof McpRemoteTransport.Type;\n\n/** All transport types (used in the connector layer) */\nexport const McpTransport = Schema.Literals([\"streamable-http\", \"sse\", \"stdio\", \"auto\"]);\nexport type McpTransport = typeof McpTransport.Type;\n\n// ---------------------------------------------------------------------------\n// Connection auth (only applies to remote sources)\n//\n// `oauth2` is a thin pointer to an SDK Connection (`ctx.connections`) —\n// the access/refresh secrets, expiry, DCR client info, and authorization-\n// server discovery URLs all live on the connection row. Scope shadowing\n// means the same `connectionId` resolves per-user via the executor's\n// innermost-wins lookup.\n// ---------------------------------------------------------------------------\n\n/** JSON object loosely typed — used for opaque OAuth state we just round-trip. */\nconst JsonObject = Schema.Record(Schema.String, Schema.Unknown);\nexport { JsonObject as McpJsonObject };\n\nexport const McpConnectionAuth = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"none\") }),\n  Schema.Struct({\n    kind: Schema.Literal(\"header\"),\n    headerName: Schema.String,\n    secretId: Schema.String,\n    prefix: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    kind: Schema.Literal(\"oauth2\"),\n    connectionId: Schema.String,\n    clientIdSecretId: Schema.optional(Schema.String),\n    clientSecretSecretId: Schema.optional(Schema.NullOr(Schema.String)),\n  }),\n]);\nexport type McpConnectionAuth = typeof McpConnectionAuth.Type;\n\n// ---------------------------------------------------------------------------\n// Stored source data — discriminated union on transport\n// ---------------------------------------------------------------------------\n\n/** Common fields for remote string map schemas */\nconst StringMap = Schema.Record(Schema.String, Schema.String);\n\nexport const McpRemoteSourceData = Schema.Struct({\n  transport: Schema.Literal(\"remote\"),\n  /** The MCP server endpoint URL */\n  endpoint: Schema.String,\n  /** Transport preference for this remote source */\n  remoteTransport: McpRemoteTransport.pipe(\n    Schema.optionalKey,\n    Schema.withConstructorDefault(Effect.succeed(\"auto\" as const)),\n  ),\n  /** Extra query params appended to the endpoint URL */\n  queryParams: Schema.optional(SecretBackedMap),\n  /** Extra headers sent on every request */\n  headers: Schema.optional(SecretBackedMap),\n  /** Auth configuration */\n  auth: McpConnectionAuth,\n});\nexport type McpRemoteSourceData = typeof McpRemoteSourceData.Type;\n\nexport const McpStdioSourceData = Schema.Struct({\n  transport: Schema.Literal(\"stdio\"),\n  /** The command to run */\n  command: Schema.String,\n  /** Arguments to the command */\n  args: Schema.optional(Schema.Array(Schema.String)),\n  /** Environment variables */\n  env: Schema.optional(StringMap),\n  /** Working directory */\n  cwd: Schema.optional(Schema.String),\n});\nexport type McpStdioSourceData = typeof McpStdioSourceData.Type;\n\nexport const McpStoredSourceData = Schema.Union([McpRemoteSourceData, McpStdioSourceData]);\nexport type McpStoredSourceData = typeof McpStoredSourceData.Type;\n\n// ---------------------------------------------------------------------------\n// Tool binding — maps a registered ToolId back to the MCP tool name\n// ---------------------------------------------------------------------------\n\nexport const McpToolAnnotations = Schema.Struct({\n  title: Schema.optional(Schema.String),\n  readOnlyHint: Schema.optional(Schema.Boolean),\n  destructiveHint: Schema.optional(Schema.Boolean),\n  idempotentHint: Schema.optional(Schema.Boolean),\n  openWorldHint: Schema.optional(Schema.Boolean),\n});\nexport type McpToolAnnotations = typeof McpToolAnnotations.Type;\n\nexport class McpToolBinding extends Schema.Class<McpToolBinding>(\"McpToolBinding\")({\n  toolId: Schema.String,\n  toolName: Schema.String,\n  description: Schema.NullOr(Schema.String),\n  inputSchema: Schema.optional(Schema.Unknown),\n  outputSchema: Schema.optional(Schema.Unknown),\n  annotations: Schema.optional(McpToolAnnotations),\n}) {}\n","// ---------------------------------------------------------------------------\n// MCP plugin storage — two tables (mcp_source, mcp_binding). OAuth\n// session storage lives at the core level in `oauth2_session` and is\n// owned by `ctx.oauth`.\n// ---------------------------------------------------------------------------\n\nimport { Effect, Schema } from \"effect\";\n\nimport {\n  defineSchema,\n  type StorageDeps,\n  type StorageFailure,\n} from \"@executor-js/sdk/core\";\n\nimport { McpToolBinding, McpStoredSourceData } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Schema\n// ---------------------------------------------------------------------------\n\nexport const mcpSchema = defineSchema({\n  mcp_source: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      name: { type: \"string\", required: true },\n      config: { type: \"json\", required: true },\n      created_at: { type: \"date\", required: true },\n    },\n  },\n  mcp_binding: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      source_id: { type: \"string\", required: true, index: true },\n      binding: { type: \"json\", required: true },\n      created_at: { type: \"date\", required: true },\n    },\n  },\n});\n\nexport type McpSchema = typeof mcpSchema;\n\n// ---------------------------------------------------------------------------\n// Serialization helpers — JSON columns round-trip through the adapter as\n// either plain objects or serialized strings depending on the backend.\n// ---------------------------------------------------------------------------\n\nconst decodeSourceData = Schema.decodeUnknownSync(McpStoredSourceData);\nconst encodeSourceData = Schema.encodeSync(McpStoredSourceData);\n\nconst decodeBinding = Schema.decodeUnknownSync(McpToolBinding);\nconst encodeBinding = Schema.encodeSync(McpToolBinding);\n\nconst coerceJson = (value: unknown): unknown => {\n  if (typeof value !== \"string\") return value;\n  try {\n    return JSON.parse(value);\n  } catch {\n    return value;\n  }\n};\n\n// ---------------------------------------------------------------------------\n// Stored source (decoded) — what callers see\n// ---------------------------------------------------------------------------\n\nexport interface McpStoredSource {\n  readonly namespace: string;\n  /** Executor scope id this source row lives in. Writes stamp this on\n   *  `scope_id`; reads return whichever scope's row the adapter's\n   *  fall-through walk surfaced first. */\n  readonly scope: string;\n  readonly name: string;\n  readonly config: McpStoredSourceData;\n}\n\n// ---------------------------------------------------------------------------\n// Store interface\n// ---------------------------------------------------------------------------\n\n// Every method routes through the typed adapter (`ctx.storage.adapter`)\n// so the typed error channel is `StorageFailure`. Schema-decode failures\n// inside `Effect.gen` land as defects, not typed errors, and are caught\n// by the HTTP edge's observability middleware.\n//\n// Every read/write that targets a single row pins BOTH the natural id\n// (namespace, toolId, sessionId) AND the owning `scope_id`. The store\n// runs behind the scoped adapter (which auto-injects `scope_id IN\n// (stack)`), so a bare `{id}` filter resolves to any matching row in\n// the stack in adapter-iteration order. For shadowed rows (same id at\n// multiple scopes — e.g. an org-level MCP source with a per-user\n// override), that's a scope-isolation bug: updates and deletes can\n// land on the wrong scope's row. Callers thread the resolved scope in\n// (typically `path.scopeId` for HTTP, `toolRow.scope_id` /\n// `input.scope` for invokeTool/lifecycle) so every keyed mutation\n// targets exactly one row.\nexport interface McpBindingStore {\n  readonly listBindingsBySource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<\n    ReadonlyArray<{ readonly toolId: string; readonly binding: McpToolBinding }>,\n    StorageFailure\n  >;\n\n  readonly getBinding: (\n    toolId: string,\n    scope: string,\n  ) => Effect.Effect<\n    { readonly binding: McpToolBinding; readonly namespace: string } | null,\n    StorageFailure\n  >;\n\n  readonly putBindings: (\n    namespace: string,\n    scope: string,\n    entries: ReadonlyArray<{ readonly toolId: string; readonly binding: McpToolBinding }>,\n  ) => Effect.Effect<void, StorageFailure>;\n\n  readonly removeBindingsByNamespace: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<void, StorageFailure>;\n\n  readonly getSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSource | null, StorageFailure>;\n  readonly getSourceConfig: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSourceData | null, StorageFailure>;\n  readonly putSource: (source: McpStoredSource) => Effect.Effect<void, StorageFailure>;\n  readonly removeSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<void, StorageFailure>;\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\nexport const makeMcpStore = ({\n  adapter: db,\n}: StorageDeps<McpSchema>): McpBindingStore => {\n  return {\n    listBindingsBySource: (namespace, scope) =>\n      Effect.gen(function* () {\n        const rows = yield* db.findMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        return rows.map((row) => ({\n          toolId: row.id,\n          binding: decodeBinding(coerceJson(row.binding)),\n        }));\n      }),\n\n    getBinding: (toolId, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"id\", value: toolId },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        const binding = decodeBinding(coerceJson(row.binding));\n        return { binding, namespace: row.source_id };\n      }),\n\n    putBindings: (namespace, scope, entries) =>\n      Effect.gen(function* () {\n        if (entries.length === 0) return;\n        const now = new Date();\n        yield* db.createMany({\n          model: \"mcp_binding\",\n          data: entries.map((e) => ({\n            id: e.toolId,\n            scope_id: scope,\n            source_id: namespace,\n            binding: encodeBinding(e.binding),\n            created_at: now,\n          })),\n          forceAllowId: true,\n        });\n      }),\n\n    removeBindingsByNamespace: (namespace, scope) =>\n      db\n        .deleteMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        })\n        .pipe(Effect.asVoid),\n\n    getSource: (namespace, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        return {\n          namespace: row.id,\n          scope: row.scope_id,\n          name: row.name,\n          config: decodeSourceData(coerceJson(row.config)),\n        };\n      }),\n\n    getSourceConfig: (namespace, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        return decodeSourceData(coerceJson(row.config));\n      }),\n\n    putSource: (source) =>\n      Effect.gen(function* () {\n        const now = new Date();\n        yield* db.delete({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: source.namespace },\n            { field: \"scope_id\", value: source.scope },\n          ],\n        });\n        yield* db.create({\n          model: \"mcp_source\",\n          data: {\n            id: source.namespace,\n            scope_id: source.scope,\n            name: source.name,\n            config: encodeSourceData(source.config),\n            created_at: now,\n          },\n          forceAllowId: true,\n        });\n      }),\n\n    removeSource: (namespace, scope) =>\n      Effect.gen(function* () {\n        yield* db.deleteMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        yield* db.delete({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n      }),\n  };\n};\n","import { Duration, Effect, Exit, Result, Scope, ScopedCache } from \"effect\";\n\nimport type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\n\nimport { McpGroup } from \"../api/group\";\nimport { McpExtensionService, McpHandlers } from \"../api/handlers\";\n\nimport {\n  SourceDetectionResult,\n  definePlugin,\n  resolveSecretBackedMap as resolveSharedSecretBackedMap,\n  type PluginCtx,\n  type StorageFailure,\n  type ToolAnnotations,\n} from \"@executor-js/sdk/core\";\n\nimport {\n  makeMcpStore,\n  mcpSchema,\n  type McpBindingStore,\n  type McpStoredSource,\n} from \"./binding-store\";\nimport { createMcpConnector, type ConnectorInput, type McpConnection } from \"./connection\";\nimport { discoverTools } from \"./discover\";\nimport { McpConnectionError, McpToolDiscoveryError } from \"./errors\";\nimport { invokeMcpTool } from \"./invoke\";\nimport { deriveMcpNamespace, type McpToolManifest, type McpToolManifestEntry } from \"./manifest\";\nimport { probeMcpEndpointShape } from \"./probe-shape\";\nimport {\n  McpToolBinding,\n  type McpConnectionAuth,\n  type SecretBackedValue,\n  type McpStoredSourceData,\n} from \"./types\";\n\nimport {\n  SECRET_REF_PREFIX,\n  type ConfigFileSink,\n  type McpAuthConfig,\n  type McpRemoteSourceConfig as McpRemoteConfigEntry,\n  type McpStdioSourceConfig as McpStdioConfigEntry,\n  type SourceConfig,\n} from \"@executor-js/config\";\n\n// ---------------------------------------------------------------------------\n// Plugin config — discriminated union on transport\n// ---------------------------------------------------------------------------\n\n/**\n * Executor scope id that owns a newly-added MCP source row. Must be one\n * of the executor's configured scopes. Admins adding a shared server at\n * org scope pin here; per-user stdio sources can pin at the inner\n * scope.\n */\ntype McpSourceScopeField = { readonly scope: string };\n\nexport interface McpRemoteSourceConfig extends McpSourceScopeField {\n  readonly transport: \"remote\";\n  readonly name: string;\n  readonly endpoint: string;\n  readonly remoteTransport?: \"streamable-http\" | \"sse\" | \"auto\";\n  readonly queryParams?: Record<string, SecretBackedValue>;\n  readonly headers?: Record<string, SecretBackedValue>;\n  readonly namespace?: string;\n  readonly auth?: McpConnectionAuth;\n}\n\nexport interface McpStdioSourceConfig extends McpSourceScopeField {\n  readonly transport: \"stdio\";\n  readonly name: string;\n  readonly command: string;\n  readonly args?: string[];\n  readonly env?: Record<string, string>;\n  readonly cwd?: string;\n  readonly namespace?: string;\n}\n\nexport type McpSourceConfig = McpRemoteSourceConfig | McpStdioSourceConfig;\n\n// ---------------------------------------------------------------------------\n// Extension types\n// ---------------------------------------------------------------------------\n\n// OAuth start/complete/callback moved to the shared\n// `/scopes/:scopeId/oauth/*` surface in `@executor-js/api` — no\n// plugin-specific types needed here.\n\nexport interface McpProbeResult {\n  readonly connected: boolean;\n  readonly requiresOAuth: boolean;\n  readonly name: string;\n  readonly namespace: string;\n  readonly toolCount: number | null;\n  readonly serverName: string | null;\n}\n\nexport interface McpUpdateSourceInput {\n  readonly name?: string;\n  readonly endpoint?: string;\n  readonly headers?: Record<string, SecretBackedValue>;\n  readonly queryParams?: Record<string, SecretBackedValue>;\n  readonly auth?: McpConnectionAuth;\n}\n\nexport interface McpProbeEndpointInput {\n  readonly endpoint: string;\n  readonly headers?: Record<string, SecretBackedValue>;\n  readonly queryParams?: Record<string, SecretBackedValue>;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst toStoredSourceData = (config: McpSourceConfig): McpStoredSourceData => {\n  if (config.transport === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: config.command,\n      args: config.args,\n      env: config.env,\n      cwd: config.cwd,\n    };\n  }\n  return {\n    transport: \"remote\",\n    endpoint: config.endpoint,\n    remoteTransport: config.remoteTransport ?? \"auto\",\n    queryParams: config.queryParams,\n    headers: config.headers,\n    auth: config.auth ?? { kind: \"none\" },\n  };\n};\n\nconst normalizeNamespace = (config: McpSourceConfig): string =>\n  config.namespace ??\n  deriveMcpNamespace({\n    name: config.name,\n    endpoint: config.transport === \"remote\" ? config.endpoint : undefined,\n    command: config.transport === \"stdio\" ? config.command : undefined,\n  });\n\nconst toBinding = (entry: McpToolManifestEntry): McpToolBinding =>\n  new McpToolBinding({\n    toolId: entry.toolId,\n    toolName: entry.toolName,\n    description: entry.description,\n    inputSchema: entry.inputSchema,\n    outputSchema: entry.outputSchema,\n    annotations: entry.annotations,\n  });\n\n// ---------------------------------------------------------------------------\n// MCP-SDK OAuth provider adapter — builds the `OAuthClientProvider` the\n// MCP SDK's StreamableHTTP/SSE transports want, wrapping a pre-resolved\n// access token.\n//\n// Refresh is NOT driven through this provider — `ctx.connections.access\n// Token` owns that lifecycle at the core level via the canonical\n// \"oauth2\" ConnectionProvider. This adapter only injects the current\n// token into the transport's Authorization header and fails loudly if\n// the SDK ever tries to initiate a new OAuth flow (which would bypass\n// our refresh machinery).\n// ---------------------------------------------------------------------------\nconst makeOAuthProvider = (accessToken: string): OAuthClientProvider => ({\n  get redirectUrl() {\n    return \"http://localhost/oauth/callback\";\n  },\n  get clientMetadata() {\n    return {\n      redirect_uris: [\"http://localhost/oauth/callback\"],\n      grant_types: [\"authorization_code\", \"refresh_token\"] as string[],\n      response_types: [\"code\"] as string[],\n      token_endpoint_auth_method: \"none\" as const,\n      client_name: \"Executor\",\n    };\n  },\n  clientInformation: () => undefined,\n  saveClientInformation: () => undefined,\n  tokens: () => ({ access_token: accessToken, token_type: \"Bearer\" }),\n  saveTokens: () => undefined,\n  redirectToAuthorization: async () => {\n    throw new Error(\"MCP OAuth re-authorization required\");\n  },\n  saveCodeVerifier: () => undefined,\n  codeVerifier: () => {\n    throw new Error(\"No active PKCE verifier\");\n  },\n  saveDiscoveryState: () => undefined,\n  discoveryState: () => undefined,\n});\n\nconst remoteConnectionError = (message: string) =>\n  new McpConnectionError({ transport: \"remote\", message });\n\nconst mcpDiscoveryError = (message: string) =>\n  new McpToolDiscoveryError({ stage: \"list_tools\", message });\n\nconst resolveSecretBackedMap = (\n  values: Record<string, SecretBackedValue> | undefined,\n  ctx: PluginCtx<McpBindingStore>,\n): Effect.Effect<Record<string, string> | undefined, McpConnectionError | StorageFailure> =>\n  resolveSharedSecretBackedMap({\n    values,\n    getSecret: ctx.secrets.get,\n    onMissing: (_name, value) =>\n      remoteConnectionError(`Failed to resolve secret \"${value.secretId}\"`),\n    onError: (err, _name, value) =>\n      \"_tag\" in err && err._tag === \"SecretOwnedByConnectionError\"\n        ? remoteConnectionError(`Failed to resolve secret \"${value.secretId}\"`)\n        : err,\n  }).pipe(\n    Effect.mapError((err) =>\n      \"_tag\" in err && err._tag === \"SecretOwnedByConnectionError\"\n        ? remoteConnectionError(\"Failed to resolve secret\")\n        : err,\n    ),\n  );\n\nconst plainStringMap = (\n  values: Record<string, SecretBackedValue> | undefined,\n): Record<string, string> | undefined => {\n  if (!values) return undefined;\n  const entries = Object.entries(values).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\n// ---------------------------------------------------------------------------\n// Shared connector resolution — reads secrets, builds stdio/remote input\n// ---------------------------------------------------------------------------\n\nconst resolveConnectorInput = (\n  sd: McpStoredSourceData,\n  ctx: PluginCtx<McpBindingStore>,\n  allowStdio: boolean,\n): Effect.Effect<ConnectorInput, McpConnectionError | StorageFailure> => {\n  if (sd.transport === \"stdio\") {\n    if (!allowStdio) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message:\n            \"MCP stdio transport is disabled. Enable it by passing `dangerouslyAllowStdioMCP: true` to mcpPlugin() — only safe for trusted local contexts.\",\n        }),\n      );\n    }\n    return Effect.succeed({\n      transport: \"stdio\" as const,\n      command: sd.command,\n      args: sd.args,\n      env: sd.env,\n      cwd: sd.cwd,\n    });\n  }\n\n  return Effect.gen(function* () {\n    const resolvedHeaders = yield* resolveSecretBackedMap(sd.headers, ctx);\n    const resolvedQueryParams = yield* resolveSecretBackedMap(sd.queryParams, ctx);\n    const headers: Record<string, string> = { ...(resolvedHeaders ?? {}) };\n    let authProvider: OAuthClientProvider | undefined;\n\n    const auth = sd.auth;\n    if (auth.kind === \"header\") {\n      const val = yield* ctx.secrets\n        .get(auth.secretId)\n        .pipe(\n          Effect.mapError((err) =>\n            \"_tag\" in err && err._tag === \"SecretOwnedByConnectionError\"\n              ? remoteConnectionError(`Failed to resolve secret \"${auth.secretId}\"`)\n              : err,\n          ),\n        );\n      if (val === null) {\n        return yield* Effect.fail(\n          remoteConnectionError(`Failed to resolve secret \"${auth.secretId}\"`),\n        );\n      }\n      headers[auth.headerName] = auth.prefix ? `${auth.prefix}${val}` : val;\n    } else if (auth.kind === \"oauth2\") {\n      // `accessToken(id)` handles refresh internally — by the time we\n      // hand the value to the MCP transport it's guaranteed fresh.\n      // The canonical `\"oauth2\"` ConnectionProvider registered by\n      // core owns the refresh lifecycle; we just wrap the current\n      // token for the SDK's transport.\n      const accessToken = yield* ctx.connections\n        .accessToken(auth.connectionId)\n        .pipe(\n          Effect.mapError((err) =>\n            remoteConnectionError(\n              `Failed to resolve OAuth connection \"${auth.connectionId}\": ${\n                \"message\" in err ? (err as { message: string }).message : String(err)\n              }`,\n            ),\n          ),\n        );\n      authProvider = makeOAuthProvider(accessToken);\n    }\n\n    return {\n      transport: \"remote\" as const,\n      endpoint: sd.endpoint,\n      remoteTransport: sd.remoteTransport,\n      queryParams: resolvedQueryParams,\n      headers: Object.keys(headers).length > 0 ? headers : undefined,\n      authProvider,\n    };\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Connection cache — kept as plugin-module state so both invokeTool and\n// the close hook see the same ScopedCache instance. The ScopedCache's\n// lookup key is the stringified stored source data identity.\n// ---------------------------------------------------------------------------\n\ninterface McpRuntime {\n  readonly connectionCache: ScopedCache.ScopedCache<string, McpConnection, McpConnectionError>;\n  readonly pendingConnectors: Map<string, Effect.Effect<McpConnection, McpConnectionError>>;\n  readonly cacheScope: Scope.Closeable;\n}\n\nconst makeRuntime = (): Effect.Effect<McpRuntime, never> =>\n  Effect.gen(function* () {\n    const cacheScope = yield* Scope.make();\n    const pendingConnectors = new Map<string, Effect.Effect<McpConnection, McpConnectionError>>();\n    const connectionCache = yield* ScopedCache.make({\n      lookup: (key: string) =>\n        Effect.acquireRelease(\n          Effect.suspend(() => {\n            const connector = pendingConnectors.get(key);\n            if (!connector) {\n              return Effect.fail(\n                new McpConnectionError({\n                  transport: \"auto\",\n                  message: `No pending connector for key: ${key}`,\n                }),\n              );\n            }\n            return connector;\n          }),\n          (connection) => Effect.promise(() => connection.close().catch(() => {})),\n        ),\n      capacity: 64,\n      timeToLive: Duration.minutes(5),\n    }).pipe(Scope.provide(cacheScope));\n\n    return { connectionCache, pendingConnectors, cacheScope };\n  });\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\nexport interface McpPluginOptions {\n  /**\n   * Allow configuring stdio-transport MCP sources. Off by default.\n   *\n   * Stdio sources spawn a local subprocess that inherits the parent\n   * `process.env`. Only enable for trusted single-user contexts.\n   */\n  readonly dangerouslyAllowStdioMCP?: boolean;\n  /** If provided, source add/remove is mirrored to executor.jsonc\n   *  (best-effort — file errors are logged, not raised). */\n  readonly configFile?: ConfigFileSink;\n}\n\nconst secretRef = (id: string): string => `${SECRET_REF_PREFIX}${id}`;\n\nconst authToConfig = (auth: McpConnectionAuth | undefined): McpAuthConfig | undefined => {\n  if (!auth) return undefined;\n  if (auth.kind === \"none\") return { kind: \"none\" };\n  if (auth.kind === \"header\") {\n    return {\n      kind: \"header\",\n      headerName: auth.headerName,\n      secret: secretRef(auth.secretId),\n      prefix: auth.prefix,\n    };\n  }\n  return {\n    kind: \"oauth2\",\n    connectionId: auth.connectionId,\n  };\n};\n\nconst toMcpConfigEntry = (\n  namespace: string,\n  sourceName: string,\n  config: McpSourceConfig,\n): SourceConfig => {\n  if (config.transport === \"stdio\") {\n    const entry: McpStdioConfigEntry = {\n      kind: \"mcp\",\n      transport: \"stdio\",\n      name: sourceName,\n      command: config.command,\n      args: config.args,\n      env: config.env,\n      cwd: config.cwd,\n      namespace,\n    };\n    return entry;\n  }\n  const entry: McpRemoteConfigEntry = {\n    kind: \"mcp\",\n    transport: \"remote\",\n    name: sourceName,\n    endpoint: config.endpoint,\n    remoteTransport: config.remoteTransport,\n    queryParams: plainStringMap(config.queryParams),\n    headers: plainStringMap(config.headers),\n    namespace,\n    auth: authToConfig(config.auth),\n  };\n  return entry;\n};\n\nexport const mcpPlugin = definePlugin((options?: McpPluginOptions) => {\n  const allowStdio = options?.dangerouslyAllowStdioMCP ?? false;\n  // Per-plugin-instance runtime holder. Captured by closures in\n  // `extension`, `invokeTool`, and `close`, so all three see the same\n  // connection cache across a single createExecutor lifecycle.\n  const runtimeRef: { current: McpRuntime | null } = { current: null };\n\n  const ensureRuntime = (): Effect.Effect<McpRuntime, never> =>\n    runtimeRef.current\n      ? Effect.succeed(runtimeRef.current)\n      : makeRuntime().pipe(\n          Effect.tap((rt) =>\n            Effect.sync(() => {\n              runtimeRef.current = rt;\n            }),\n          ),\n        );\n\n  return {\n    id: \"mcp\" as const,\n    packageName: \"@executor-js/plugin-mcp\",\n    schema: mcpSchema,\n    storage: (deps): McpBindingStore => makeMcpStore(deps),\n\n    extension: (ctx) => {\n      const probeEndpoint = (input: string | McpProbeEndpointInput) =>\n        Effect.gen(function* () {\n          const endpoint = typeof input === \"string\" ? input : input.endpoint;\n          const trimmed = endpoint.trim();\n          if (!trimmed) {\n            return yield* Effect.fail(remoteConnectionError(\"Endpoint URL is required\"));\n          }\n\n          const name = yield* Effect.try({\n            try: () => new URL(trimmed).hostname,\n            catch: () => \"mcp\",\n          }).pipe(\n            Effect.orElseSucceed(() => \"mcp\"),\n          );\n          const namespace = deriveMcpNamespace({ endpoint: trimmed });\n\n          const probeHeaders =\n            typeof input === \"string\"\n              ? undefined\n              : yield* resolveSecretBackedMap(input.headers, ctx);\n          const probeQueryParams =\n            typeof input === \"string\"\n              ? undefined\n              : yield* resolveSecretBackedMap(input.queryParams, ctx);\n\n          const connector = createMcpConnector({\n            transport: \"remote\",\n            endpoint: trimmed,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n\n          const result = yield* discoverTools(connector).pipe(\n            Effect.map((m) => ({ ok: true as const, manifest: m })),\n            Effect.catch(() => Effect.succeed({ ok: false as const, manifest: null })),\n            Effect.withSpan(\"mcp.plugin.discover_tools\"),\n          );\n\n          if (result.ok && result.manifest) {\n            return {\n              connected: true,\n              requiresOAuth: false,\n              name: result.manifest.server?.name ?? name,\n              namespace,\n              toolCount: result.manifest.tools.length,\n              serverName: result.manifest.server?.name ?? null,\n            } satisfies McpProbeResult;\n          }\n\n          // Before asking the core OAuth service to look for metadata,\n          // confirm the endpoint actually speaks MCP. An OAuth-protected\n          // non-MCP service (e.g. a GraphQL API whose host publishes\n          // RFC 9728 + 8414 metadata) would otherwise pass the OAuth\n          // probe and be misclassified as MCP. The shape probe rejects\n          // anything whose initialize response isn't 2xx or 401+Bearer.\n          const shape = yield* probeMcpEndpointShape(trimmed, {\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n          if (shape.kind !== \"mcp\") {\n            return yield* Effect.fail(\n              remoteConnectionError(\n                shape.kind === \"not-mcp\"\n                  ? `Endpoint does not look like an MCP server: ${shape.reason}`\n                  : `Could not reach endpoint: ${shape.reason}`,\n              ),\n            );\n          }\n\n          const probeResult = yield* ctx.oauth\n            .probe({\n              endpoint: trimmed,\n              headers: probeHeaders,\n              queryParams: probeQueryParams,\n            })\n            .pipe(\n              Effect.map(() => true),\n              Effect.catch(() => Effect.succeed(false)),\n              Effect.withSpan(\"mcp.plugin.probe_oauth\"),\n            );\n\n          if (probeResult) {\n            return {\n              connected: false,\n              requiresOAuth: true,\n              name,\n              namespace,\n              toolCount: null,\n              serverName: null,\n            } satisfies McpProbeResult;\n          }\n\n          return yield* Effect.fail(\n            remoteConnectionError(\"MCP server requires authentication but OAuth discovery failed\"),\n          );\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.probe_endpoint\", {\n            attributes: { \"mcp.endpoint\": typeof input === \"string\" ? input : input.endpoint },\n          }),\n        );\n\n      const configFile = options?.configFile;\n\n      const addSource = (config: McpSourceConfig) =>\n        Effect.gen(function* () {\n          const namespace = normalizeNamespace(config);\n          const sd = toStoredSourceData(config);\n\n          // Stdio sources are gated — a resolver failure there is a\n          // config error the admin must fix before the source makes\n          // sense to persist at all. For remote sources we defer the\n          // resolver failure: auth might not be ready yet (oauth2\n          // connection awaiting per-user sign-in, header secret\n          // awaiting upload) but the source row should still land so\n          // it shows up in the list and exposes a Sign-in affordance.\n          const resolved = yield* resolveConnectorInput(sd, ctx, allowStdio).pipe(\n            Effect.result,\n            Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n              attributes: {\n                \"mcp.source.namespace\": namespace,\n                \"mcp.source.transport\": sd.transport,\n              },\n            }),\n          );\n\n          if (Result.isFailure(resolved) && sd.transport === \"stdio\") {\n            return yield* Effect.fail(resolved.failure);\n          }\n\n          // Try discovery only if we have a live connector input.\n          // Otherwise fall straight through to the persist step with\n          // an empty manifest and surface the resolver failure to\n          // the caller at the end.\n          const discovery: Result.Result<\n            McpToolManifest,\n            McpToolDiscoveryError | McpConnectionError | StorageFailure\n          > =\n            Result.isSuccess(resolved)\n              ? yield* discoverTools(createMcpConnector(resolved.success)).pipe(\n                  Effect.mapError((err) =>\n                    mcpDiscoveryError(`MCP discovery failed: ${err.message}`),\n                  ),\n                  Effect.result,\n                  Effect.withSpan(\"mcp.plugin.discover_tools\", {\n                    attributes: { \"mcp.source.namespace\": namespace },\n                  }),\n                )\n              : Result.fail(resolved.failure);\n          const manifest =\n            Result.isSuccess(discovery)\n              ? discovery.success\n              : { server: undefined, tools: [] as const };\n\n          const sourceName = config.name ?? manifest.server?.name ?? namespace;\n\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                // Remove stale rows at the target scope (plugin-owned).\n                // Pinning scope keeps a shadowed outer-scope row intact\n                // when a per-user addSource re-uses the same namespace.\n                yield* ctx.storage.removeBindingsByNamespace(namespace, config.scope);\n                yield* ctx.storage.removeSource(namespace, config.scope);\n\n                yield* ctx.storage.putSource({\n                  namespace,\n                  scope: config.scope,\n                  name: sourceName,\n                  config: sd,\n                });\n\n                yield* ctx.storage.putBindings(\n                  namespace,\n                  config.scope,\n                  manifest.tools.map((e) => ({\n                    toolId: `${namespace}.${e.toolId}`,\n                    binding: toBinding(e),\n                  })),\n                );\n\n                yield* ctx.core.sources.register({\n                  id: namespace,\n                  scope: config.scope,\n                  kind: \"mcp\",\n                  name: sourceName,\n                  url: sd.transport === \"remote\" ? sd.endpoint : undefined,\n                  canRemove: true,\n                  canRefresh: true,\n                  canEdit: sd.transport === \"remote\",\n                  tools: manifest.tools.map((e) => ({\n                    name: e.toolId,\n                    description: e.description ?? `MCP tool: ${e.toolName}`,\n                    inputSchema: e.inputSchema,\n                    outputSchema: e.outputSchema,\n                  })),\n                });\n              }),\n            )\n            .pipe(\n              Effect.withSpan(\"mcp.plugin.persist_source\", {\n                attributes: {\n                  \"mcp.source.namespace\": namespace,\n                  \"mcp.source.tool_count\": manifest.tools.length,\n                },\n              }),\n            );\n\n          if (configFile) {\n            yield* configFile\n              .upsertSource(toMcpConfigEntry(namespace, sourceName, config))\n              .pipe(Effect.withSpan(\"mcp.plugin.config_file.upsert\"));\n          }\n\n          if (Result.isFailure(discovery)) {\n            return yield* Effect.fail(discovery.failure);\n          }\n          return { toolCount: manifest.tools.length, namespace };\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.add_source\", {\n            attributes: {\n              \"mcp.source.transport\": config.transport,\n              \"mcp.source.name\": config.name,\n            },\n          }),\n        );\n\n      const removeSource = (namespace: string, scope: string) =>\n        Effect.gen(function* () {\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                yield* ctx.storage.removeBindingsByNamespace(namespace, scope);\n                yield* ctx.storage.removeSource(namespace, scope);\n                yield* ctx.core.sources.unregister(namespace);\n              }),\n            )\n            .pipe(Effect.withSpan(\"mcp.plugin.persist_remove\"));\n          if (configFile) {\n            yield* configFile\n              .removeSource(namespace)\n              .pipe(Effect.withSpan(\"mcp.plugin.config_file.remove\"));\n          }\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.remove_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const refreshSource = (namespace: string, scope: string) =>\n        Effect.gen(function* () {\n          const sd = yield* ctx.storage.getSourceConfig(namespace, scope).pipe(\n            Effect.withSpan(\"mcp.plugin.load_source_config\", {\n              attributes: { \"mcp.source.namespace\": namespace },\n            }),\n          );\n          if (!sd) {\n            return yield* Effect.fail(\n              remoteConnectionError(`No stored config for MCP source \"${namespace}\"`),\n            );\n          }\n\n          const ci = yield* resolveConnectorInput(sd, ctx, allowStdio).pipe(\n            Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n              attributes: {\n                \"mcp.source.namespace\": namespace,\n                \"mcp.source.transport\": sd.transport,\n              },\n            }),\n          );\n          const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(\n            Effect.mapError((err) => mcpDiscoveryError(`MCP refresh failed: ${err.message}`)),\n            Effect.withSpan(\"mcp.plugin.discover_tools\", {\n              attributes: { \"mcp.source.namespace\": namespace },\n            }),\n          );\n\n          const existing = yield* ctx.storage.getSource(namespace, scope);\n          const sourceName = manifest.server?.name ?? existing?.name ?? namespace;\n\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                yield* ctx.storage.removeBindingsByNamespace(namespace, scope);\n                yield* ctx.core.sources.unregister(namespace);\n\n                yield* ctx.storage.putBindings(\n                  namespace,\n                  scope,\n                  manifest.tools.map((e) => ({\n                    toolId: `${namespace}.${e.toolId}`,\n                    binding: toBinding(e),\n                  })),\n                );\n                yield* ctx.core.sources.register({\n                  id: namespace,\n                  scope,\n                  kind: \"mcp\",\n                  name: sourceName,\n                  url: sd.transport === \"remote\" ? sd.endpoint : undefined,\n                  canRemove: true,\n                  canRefresh: true,\n                  canEdit: sd.transport === \"remote\",\n                  tools: manifest.tools.map((e) => ({\n                    name: e.toolId,\n                    description: e.description ?? `MCP tool: ${e.toolName}`,\n                    inputSchema: e.inputSchema,\n                    outputSchema: e.outputSchema,\n                  })),\n                });\n              }),\n            )\n            .pipe(\n              Effect.withSpan(\"mcp.plugin.persist_source\", {\n                attributes: {\n                  \"mcp.source.namespace\": namespace,\n                  \"mcp.source.tool_count\": manifest.tools.length,\n                },\n              }),\n            );\n\n          return { toolCount: manifest.tools.length };\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.refresh_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const updateSource = (namespace: string, scope: string, input: McpUpdateSourceInput) =>\n        Effect.gen(function* () {\n          const existing = yield* ctx.storage.getSource(namespace, scope);\n          if (!existing || existing.config.transport !== \"remote\") return;\n\n          const remote = existing.config;\n          const updatedConfig: McpStoredSourceData = {\n            ...remote,\n            ...(input.endpoint !== undefined ? { endpoint: input.endpoint } : {}),\n            ...(input.headers !== undefined ? { headers: input.headers } : {}),\n            ...(input.auth !== undefined ? { auth: input.auth } : {}),\n            ...(input.queryParams !== undefined ? { queryParams: input.queryParams } : {}),\n          };\n\n          yield* ctx.storage.putSource({\n            namespace,\n            scope,\n            name: input.name?.trim() || existing.name,\n            config: updatedConfig,\n          });\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.update_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const getSource = (namespace: string, scope: string) =>\n        ctx.storage.getSource(namespace, scope).pipe(\n          Effect.withSpan(\"mcp.plugin.get_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      return {\n        probeEndpoint,\n        addSource,\n        removeSource,\n        refreshSource,\n        getSource,\n        updateSource,\n      } satisfies McpPluginExtension;\n    },\n\n    invokeTool: ({ ctx, toolRow, args, elicit }) =>\n      Effect.gen(function* () {\n        const runtime = yield* ensureRuntime();\n\n        // toolRow.scope_id is the resolved owning scope of the tool\n        // (innermost-wins from the executor's stack). The matching\n        // mcp_binding + mcp_source rows live at the same scope, so\n        // pin every store lookup to it instead of relying on the\n        // scoped adapter's stack-wide fall-through.\n        const toolScope = toolRow.scope_id as string;\n        const entry = yield* ctx.storage.getBinding(toolRow.id, toolScope).pipe(\n          Effect.withSpan(\"mcp.plugin.load_binding\", {\n            attributes: { \"mcp.tool.name\": toolRow.id },\n          }),\n        );\n        if (!entry) {\n          return yield* Effect.fail(new Error(`No MCP binding found for tool \"${toolRow.id}\"`));\n        }\n\n        const sd = yield* ctx.storage.getSourceConfig(entry.namespace, toolScope).pipe(\n          Effect.withSpan(\"mcp.plugin.load_source_config\", {\n            attributes: { \"mcp.source.namespace\": entry.namespace },\n          }),\n        );\n        if (!sd) {\n          return yield* Effect.fail(\n            new Error(`No MCP source config for namespace \"${entry.namespace}\"`),\n          );\n        }\n\n        return yield* invokeMcpTool({\n          toolId: toolRow.id,\n          toolName: entry.binding.toolName,\n          args,\n          sourceData: sd,\n          invokerScope: ctx.scopes[0]!.id as string,\n          resolveConnector: () =>\n            resolveConnectorInput(sd, ctx, allowStdio).pipe(\n              Effect.flatMap((ci) => createMcpConnector(ci)),\n              Effect.mapError((err) =>\n                err instanceof McpConnectionError\n                  ? err\n                  : new McpConnectionError({\n                      transport: \"auto\",\n                      message: err instanceof Error ? err.message : String(err),\n                    }),\n              ),\n              Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n                attributes: {\n                  \"mcp.source.namespace\": entry.namespace,\n                  \"mcp.source.transport\": sd.transport,\n                },\n              }),\n            ),\n          connectionCache: runtime.connectionCache,\n          pendingConnectors: runtime.pendingConnectors,\n          elicit,\n        });\n      }).pipe(\n        Effect.withSpan(\"mcp.plugin.invoke_tool\", {\n          attributes: {\n            \"mcp.tool.name\": toolRow.id,\n            \"mcp.tool.source_id\": toolRow.source_id,\n          },\n        }),\n      ),\n\n    detect: ({ ctx, url }) =>\n      Effect.gen(function* () {\n        const trimmed = url.trim();\n        if (!trimmed) return null;\n\n        const parsed = yield* Effect.try({\n          try: () => new URL(trimmed),\n          catch: (cause) => cause,\n        }).pipe(Effect.option);\n        if (parsed._tag === \"None\") return null;\n\n        const name = parsed.value.hostname || \"mcp\";\n        const namespace = deriveMcpNamespace({ endpoint: trimmed });\n\n        const connector = createMcpConnector({\n          transport: \"remote\",\n          endpoint: trimmed,\n        });\n\n        const connected = yield* discoverTools(connector).pipe(\n          Effect.map(() => true),\n          Effect.catch(() => Effect.succeed(false)),\n          Effect.withSpan(\"mcp.plugin.discover_tools\"),\n        );\n\n        if (connected) {\n          return new SourceDetectionResult({\n            kind: \"mcp\",\n            confidence: \"high\",\n            endpoint: trimmed,\n            name,\n            namespace,\n          });\n        }\n\n        // host publishes RFC 9728 + 8414 metadata) would be classified\n        // as MCP whenever the cross-plugin detector fans out to us.\n        const shape = yield* probeMcpEndpointShape(trimmed);\n        if (shape.kind !== \"mcp\") return null;\n\n        // Confirm OAuth metadata is actually reachable. The shape\n        // probe already found a Bearer challenge; the core OAuth\n        // service's probe verifies the AS metadata resolves so we\n        // don't classify endpoints that challenge but have no\n        // discovery.\n        const probeOk = yield* ctx.oauth.probe({ endpoint: trimmed }).pipe(\n          Effect.map(() => true),\n          Effect.catch(() => Effect.succeed(false)),\n          Effect.withSpan(\"mcp.plugin.probe_oauth\"),\n        );\n        if (!probeOk) return null;\n\n        return new SourceDetectionResult({\n          kind: \"mcp\",\n          confidence: \"high\",\n          endpoint: trimmed,\n          name,\n          namespace,\n        });\n      }).pipe(\n        Effect.catch(() => Effect.succeed(null)),\n        Effect.withSpan(\"mcp.plugin.detect\", {\n          attributes: { \"mcp.endpoint\": url },\n        }),\n      ),\n\n    // Honor upstream destructiveHint from MCP ToolAnnotations.\n    // Bindings are fetched per scope so shadowed sources (e.g. an org-level\n    // source overridden per-user) each resolve against their own scope's\n    // row rather than collapsing onto whichever row the scoped adapter\n    // sees first.\n    resolveAnnotations: ({ ctx, sourceId, toolRows }) =>\n      Effect.gen(function* () {\n        const scopes = new Set(toolRows.map((row) => row.scope_id));\n        const entries = yield* Effect.forEach(\n          [...scopes],\n          (scope) =>\n            Effect.gen(function* () {\n              const list = yield* ctx.storage.listBindingsBySource(sourceId, scope);\n              const byId = new Map(list.map((e) => [e.toolId, e.binding]));\n              return [scope, byId] as const;\n            }),\n          { concurrency: \"unbounded\" },\n        );\n        const byScope = new Map(entries);\n\n        const out: Record<string, ToolAnnotations> = {};\n        for (const row of toolRows) {\n          const binding = byScope.get(row.scope_id)?.get(row.id);\n          const ann = binding?.annotations;\n          if (ann?.destructiveHint === true) {\n            out[row.id] = {\n              requiresApproval: true,\n              approvalDescription: ann.title ?? binding?.toolName ?? row.id,\n            };\n          } else {\n            out[row.id] = { requiresApproval: false };\n          }\n        }\n        return out;\n      }),\n\n    removeSource: ({ ctx, sourceId, scope }) =>\n      Effect.gen(function* () {\n        yield* ctx.storage.removeBindingsByNamespace(sourceId, scope);\n        yield* ctx.storage.removeSource(sourceId, scope);\n      }),\n\n    refreshSource: () => Effect.void,\n\n    // Connection refresh for oauth2-minted sources is owned by the\n    // canonical `\"oauth2\"` ConnectionProvider that core registers via\n    // `makeOAuth2Service`. No MCP-specific provider needed.\n\n    close: () =>\n      Effect.gen(function* () {\n        const runtime = runtimeRef.current;\n        if (runtime) {\n          runtime.pendingConnectors.clear();\n          yield* ScopedCache.invalidateAll(runtime.connectionCache);\n          yield* Scope.close(runtime.cacheScope, Exit.void);\n          runtimeRef.current = null;\n        }\n      }).pipe(Effect.withSpan(\"mcp.plugin.close\")),\n\n    // HTTP transport. `McpHandlers` requires `McpExtensionService`; the\n    // host satisfies it via the `extensionService` Tag — at boot for\n    // local, per request for cloud.\n    routes: () => McpGroup,\n    handlers: () => McpHandlers,\n    extensionService: McpExtensionService,\n  };\n});\n\n// ---------------------------------------------------------------------------\n// McpPluginExtension — shape of `executor.mcp` for consumers that want\n// to type against it directly (api/, react/). Mirrors what `extension`\n// returns above.\n// ---------------------------------------------------------------------------\n\n/**\n * Errors any MCP extension method may surface. The first four are\n * plugin-domain tagged errors that flow directly to clients (4xx, each\n * carrying its own `HttpApiSchema` status). `StorageFailure` covers\n * raw backend failures (`StorageError`) plus `UniqueViolationError`;\n * the HTTP edge (`@executor-js/api`'s `withCapture`) translates\n * `StorageError` to the opaque `InternalError({ traceId })` at Layer\n * composition. `UniqueViolationError` passes through — plugins can\n * `Effect.catchTag` it if they want a friendlier user-facing error.\n */\nexport type McpExtensionFailure = McpConnectionError | McpToolDiscoveryError | StorageFailure;\n\nexport interface McpPluginExtension {\n  readonly probeEndpoint: (\n    input: string | McpProbeEndpointInput,\n  ) => Effect.Effect<McpProbeResult, McpExtensionFailure>;\n  readonly addSource: (\n    config: McpSourceConfig,\n  ) => Effect.Effect<\n    { readonly toolCount: number; readonly namespace: string },\n    McpExtensionFailure\n  >;\n  readonly removeSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<void, McpExtensionFailure>;\n  readonly refreshSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<{ readonly toolCount: number }, McpExtensionFailure>;\n  readonly getSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSource | null, McpExtensionFailure>;\n  readonly updateSource: (\n    namespace: string,\n    scope: string,\n    input: McpUpdateSourceInput,\n  ) => Effect.Effect<void, McpExtensionFailure>;\n}\n","import { HttpApiEndpoint, HttpApiGroup } from \"effect/unstable/httpapi\";\nimport { Schema } from \"effect\";\nimport { ScopeId, SecretBackedMap } from \"@executor-js/sdk/core\";\nimport { InternalError } from \"@executor-js/api\";\n\nimport { McpConnectionError, McpToolDiscoveryError } from \"../sdk/errors\";\nimport { McpStoredSourceSchema } from \"../sdk/stored-source\";\n\n// ---------------------------------------------------------------------------\n// Params\n// ---------------------------------------------------------------------------\n\nconst ScopeParams = { scopeId: ScopeId };\nconst SourceParams = { scopeId: ScopeId, namespace: Schema.String };\n\n// ---------------------------------------------------------------------------\n// Auth payload (only for remote)\n// ---------------------------------------------------------------------------\n\nconst AuthPayload = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"none\") }),\n  Schema.Struct({\n    kind: Schema.Literal(\"header\"),\n    headerName: Schema.String,\n    secretId: Schema.String,\n    prefix: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    kind: Schema.Literal(\"oauth2\"),\n    /** Stable id of the SDK Connection minted by `completeOAuth`. The\n     *  backing access/refresh secrets live on the connection row; the\n     *  source only needs this pointer. */\n    connectionId: Schema.String,\n    clientIdSecretId: Schema.optional(Schema.String),\n    clientSecretSecretId: Schema.optional(Schema.NullOr(Schema.String)),\n  }),\n]);\n\nconst StringMap = Schema.Record(Schema.String, Schema.String);\n// ---------------------------------------------------------------------------\n// Add source — discriminated union on transport\n// ---------------------------------------------------------------------------\n\nconst AddRemoteSourcePayload = Schema.Struct({\n  transport: Schema.Literal(\"remote\"),\n  name: Schema.String,\n  endpoint: Schema.String,\n  remoteTransport: Schema.optional(Schema.Literals([\"streamable-http\", \"sse\", \"auto\"])),\n  namespace: Schema.optional(Schema.String),\n  queryParams: Schema.optional(SecretBackedMap),\n  headers: Schema.optional(SecretBackedMap),\n  auth: Schema.optional(AuthPayload),\n});\n\nconst AddStdioSourcePayload = Schema.Struct({\n  transport: Schema.Literal(\"stdio\"),\n  name: Schema.String,\n  command: Schema.String,\n  args: Schema.optional(Schema.Array(Schema.String)),\n  env: Schema.optional(StringMap),\n  cwd: Schema.optional(Schema.String),\n  namespace: Schema.optional(Schema.String),\n});\n\nconst AddSourcePayload = Schema.Union([AddRemoteSourcePayload, AddStdioSourcePayload]);\n\n// ---------------------------------------------------------------------------\n// Other payloads\n// ---------------------------------------------------------------------------\n\nconst UpdateSourcePayload = Schema.Struct({\n  name: Schema.optional(Schema.String),\n  endpoint: Schema.optional(Schema.String),\n  headers: Schema.optional(SecretBackedMap),\n  queryParams: Schema.optional(SecretBackedMap),\n  auth: Schema.optional(AuthPayload),\n});\n\nconst UpdateSourceResponse = Schema.Struct({\n  updated: Schema.Boolean,\n});\n\nconst ProbeEndpointPayload = Schema.Struct({\n  endpoint: Schema.String,\n  headers: Schema.optional(SecretBackedMap),\n  queryParams: Schema.optional(SecretBackedMap),\n});\n\nconst ProbeEndpointResponse = Schema.Struct({\n  connected: Schema.Boolean,\n  requiresOAuth: Schema.Boolean,\n  name: Schema.String,\n  namespace: Schema.String,\n  toolCount: Schema.NullOr(Schema.Number),\n  serverName: Schema.NullOr(Schema.String),\n});\n\nconst NamespacePayload = Schema.Struct({\n  namespace: Schema.String,\n});\n\n// ---------------------------------------------------------------------------\n// Responses\n// ---------------------------------------------------------------------------\n\nconst AddSourceResponse = Schema.Struct({\n  toolCount: Schema.Number,\n  namespace: Schema.String,\n});\n\nconst RefreshSourceResponse = Schema.Struct({\n  toolCount: Schema.Number,\n});\n\nconst RemoveSourceResponse = Schema.Struct({\n  removed: Schema.Boolean,\n});\n\n// ---------------------------------------------------------------------------\n// Group\n//\n// Plugin SDK errors (McpOAuthError etc.) are declared once at the group\n// level via `.addError(...)` — every endpoint inherits them. The errors\n// themselves carry their HTTP status via `HttpApiSchema.annotations`\n// in errors.ts, so handlers just `return yield* ext.foo(...)` and the\n// schema encodes whatever it gets.\n//\n// 5xx is handled at the API level: `CoreExecutorApi.addError(InternalError)`\n// adds a single shared opaque-by-schema 500 surface to every endpoint in\n// the entire API. Defects are captured + downgraded to it by an\n// HttpApiBuilder middleware (see apps/cloud/src/observability.ts).\n// No per-handler wrapping, no per-plugin InternalError.\n// ---------------------------------------------------------------------------\n\nexport const McpGroup = HttpApiGroup.make(\"mcp\")\n  .add(\n    HttpApiEndpoint.post(\"probeEndpoint\", \"/scopes/:scopeId/mcp/probe\", {\n      params: ScopeParams,\n      payload: ProbeEndpointPayload,\n      success: ProbeEndpointResponse,\n      error: [InternalError, McpConnectionError, McpToolDiscoveryError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"addSource\", \"/scopes/:scopeId/mcp/sources\", {\n      params: ScopeParams,\n      payload: AddSourcePayload,\n      success: AddSourceResponse,\n      error: [InternalError, McpConnectionError, McpToolDiscoveryError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"removeSource\", \"/scopes/:scopeId/mcp/sources/remove\", {\n      params: ScopeParams,\n      payload: NamespacePayload,\n      success: RemoveSourceResponse,\n      error: [InternalError, McpConnectionError, McpToolDiscoveryError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.post(\"refreshSource\", \"/scopes/:scopeId/mcp/sources/refresh\", {\n      params: ScopeParams,\n      payload: NamespacePayload,\n      success: RefreshSourceResponse,\n      error: [InternalError, McpConnectionError, McpToolDiscoveryError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.get(\"getSource\", \"/scopes/:scopeId/mcp/sources/:namespace\", {\n      params: SourceParams,\n      success: Schema.NullOr(McpStoredSourceSchema),\n      error: [InternalError, McpConnectionError, McpToolDiscoveryError],\n    }),\n  )\n  .add(\n    HttpApiEndpoint.patch(\"updateSource\", \"/scopes/:scopeId/mcp/sources/:namespace\", {\n      params: SourceParams,\n      payload: UpdateSourcePayload,\n      success: UpdateSourceResponse,\n      error: [InternalError, McpConnectionError, McpToolDiscoveryError],\n    }),\n  )\n  // Errors declared once at the group level — every endpoint inherits.\n  // Plugin domain errors carry their own HttpApiSchema status (4xx);\n  // `InternalError` is the shared opaque 500 translated at the HTTP\n  // edge by `withCapture`. We only list errors an MCP *group*\n  // endpoint can surface: `McpInvocationError` is thrown inside\n  // `invokeTool` which is reached via the core `tools.invoke`\n  // endpoint, not any MCP-group endpoint, so it doesn't belong here.\n  // OAuth errors live on the shared `/oauth/*` group in `@executor-js/api`\n  // now — the MCP group only declares its own plugin-domain errors.\n;\n","// MCP plugin tagged errors. Each carries an `HttpApiSchema` annotation so\n// it can be `.addError(...)` directly on the API group — handlers return\n// these and HttpApi encodes them as 4xx responses with a typed body. No\n// per-handler sanitisation step.\n\nimport { Schema } from \"effect\";\n\nexport class McpConnectionError extends Schema.TaggedErrorClass<McpConnectionError>()(\n  \"McpConnectionError\",\n  {\n    transport: Schema.String,\n    message: Schema.String,\n  },\n  { httpApiStatus: 400 },\n) {}\n\nexport class McpToolDiscoveryError extends Schema.TaggedErrorClass<McpToolDiscoveryError>()(\n  \"McpToolDiscoveryError\",\n  {\n    stage: Schema.Literals([\"connect\", \"list_tools\"]),\n    message: Schema.String,\n  },\n  { httpApiStatus: 400 },\n) {}\n\nexport class McpInvocationError extends Schema.TaggedErrorClass<McpInvocationError>()(\n  \"McpInvocationError\",\n  {\n    toolName: Schema.String,\n    message: Schema.String,\n  },\n  { httpApiStatus: 400 },\n) {}\n\nexport class McpOAuthError extends Schema.TaggedErrorClass<McpOAuthError>()(\n  \"McpOAuthError\",\n  {\n    message: Schema.String,\n  },\n  { httpApiStatus: 400 },\n) {}\n","import { Schema } from \"effect\";\n\nimport { McpStoredSourceData } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Stored source — the shape persisted by the binding store and exposed\n// via the getSource HTTP endpoint.\n// ---------------------------------------------------------------------------\n\nexport class McpStoredSourceSchema extends Schema.Class<McpStoredSourceSchema>(\"McpStoredSource\")({\n  namespace: Schema.String,\n  name: Schema.String,\n  config: McpStoredSourceData,\n}) {}\n\nexport type McpStoredSourceSchemaType = typeof McpStoredSourceSchema.Type;\n","import { HttpApiBuilder } from \"effect/unstable/httpapi\";\nimport { Context, Effect } from \"effect\";\n\nimport { addGroup, capture } from \"@executor-js/api\";\nimport type {\n  McpPluginExtension,\n  McpProbeEndpointInput,\n  McpSourceConfig,\n  McpUpdateSourceInput,\n} from \"../sdk/plugin\";\nimport type { SecretBackedValue } from \"../sdk/types\";\nimport { McpStoredSourceSchema } from \"../sdk/stored-source\";\nimport { McpGroup } from \"./group\";\n\n// ---------------------------------------------------------------------------\n// Service tag — holds the raw extension shape the executor produces.\n// Handlers wrap their generator bodies with `capture(...)` from\n// `@executor-js/api`, which translates `StorageError` to `InternalError`\n// at the edge; that's why the tag type matches the SDK shape directly\n// (no `Captured<>` inversion).\n// ---------------------------------------------------------------------------\n\nexport class McpExtensionService extends Context.Service<McpExtensionService, McpPluginExtension\n>()(\"McpExtensionService\") {}\n\n// ---------------------------------------------------------------------------\n// Composed API\n// ---------------------------------------------------------------------------\n\nconst ExecutorApiWithMcp = addGroup(McpGroup);\n\n// ---------------------------------------------------------------------------\n// Convert API payload → McpSourceConfig\n// ---------------------------------------------------------------------------\n\nconst toSourceConfig = (\n  payload: { transport: \"remote\" | \"stdio\" } & Record<string, unknown>,\n  scope: string,\n): McpSourceConfig => {\n  if (payload.transport === \"stdio\") {\n    const p = payload as {\n      transport: \"stdio\";\n      name: string;\n      command: string;\n      args?: readonly string[];\n      env?: Record<string, string>;\n      cwd?: string;\n      namespace?: string;\n    };\n    return {\n      transport: \"stdio\",\n      scope,\n      name: p.name,\n      command: p.command,\n      args: p.args ? [...p.args] : undefined,\n      env: p.env,\n      cwd: p.cwd,\n      namespace: p.namespace,\n    };\n  }\n\n  const p = payload as {\n    transport: \"remote\";\n    name: string;\n    endpoint: string;\n    remoteTransport?: \"streamable-http\" | \"sse\" | \"auto\";\n    queryParams?: Record<string, SecretBackedValue>;\n    headers?: Record<string, SecretBackedValue>;\n    namespace?: string;\n    auth?: { kind: string } & Record<string, unknown>;\n  };\n\n  return {\n    transport: \"remote\",\n    scope,\n    name: p.name,\n    endpoint: p.endpoint,\n    remoteTransport: p.remoteTransport,\n    queryParams: p.queryParams,\n    headers: p.headers,\n    namespace: p.namespace,\n    auth: p.auth as McpSourceConfig extends { auth?: infer A } ? A : never,\n  };\n};\n\n// ---------------------------------------------------------------------------\n// Handlers\n//\n// Each handler is exactly: yield the extension service, call the method,\n// return. Plugin SDK errors flow through the typed channel and are\n// schema-encoded to 4xx by HttpApi (see group.ts `.addError(...)` calls).\n// Defects bubble up and are captured + downgraded to `InternalError(traceId)`\n// by the API-level observability middleware (see apps/cloud/src/observability.ts).\n//\n// No `sanitize*`, no `liftDomainErrors`, no `withObservability` per handler.\n// If you find yourself adding error-handling here you're in the wrong layer.\n// ---------------------------------------------------------------------------\n\nexport const McpHandlers = HttpApiBuilder.group(ExecutorApiWithMcp, \"mcp\", (handlers) =>\n  handlers\n    .handle(\"probeEndpoint\", ({ payload }) =>\n      capture(\n        Effect.gen(function* () {\n          const ext = yield* McpExtensionService;\n          return yield* ext.probeEndpoint(payload as McpProbeEndpointInput);\n        }),\n      ),\n    )\n    .handle(\"addSource\", ({ params: path, payload }) =>\n      capture(\n        Effect.gen(function* () {\n          const ext = yield* McpExtensionService;\n          return yield* ext.addSource(\n            toSourceConfig(payload as Parameters<typeof toSourceConfig>[0], path.scopeId),\n          );\n        }),\n      ),\n    )\n    .handle(\"removeSource\", ({ params: path, payload }) =>\n      capture(\n        Effect.gen(function* () {\n          const ext = yield* McpExtensionService;\n          yield* ext.removeSource(payload.namespace, path.scopeId);\n          return { removed: true };\n        }),\n      ),\n    )\n    .handle(\"refreshSource\", ({ params: path, payload }) =>\n      capture(\n        Effect.gen(function* () {\n          const ext = yield* McpExtensionService;\n          return yield* ext.refreshSource(payload.namespace, path.scopeId);\n        }),\n      ),\n    )\n    .handle(\"getSource\", ({ params: path }) =>\n      capture(\n        Effect.gen(function* () {\n          const ext = yield* McpExtensionService;\n          const source = yield* ext.getSource(path.namespace, path.scopeId);\n          return source\n            ? new McpStoredSourceSchema({\n                namespace: source.namespace,\n                name: source.name,\n                config: source.config,\n              })\n            : null;\n        }),\n      ),\n    )\n    .handle(\"updateSource\", ({ params: path, payload }) =>\n      capture(\n        Effect.gen(function* () {\n          const ext = yield* McpExtensionService;\n          yield* ext.updateSource(path.namespace, path.scopeId, {\n            name: payload.name,\n            endpoint: payload.endpoint,\n            headers: payload.headers,\n            queryParams: payload.queryParams,\n            auth: payload.auth as McpUpdateSourceInput[\"auth\"],\n          });\n          return { updated: true };\n        }),\n      ),\n    ),\n);\n","import type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { SSEClientTransport } from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { CfWorkerJsonSchemaValidator } from \"@modelcontextprotocol/sdk/validation/cfworker\";\nimport { Effect } from \"effect\";\n\n// NOTE: `StdioClientTransport` is NOT imported eagerly. The upstream module\n// (`@modelcontextprotocol/sdk/client/stdio.js`) touches `node:child_process`\n// at evaluation time, which crashes workerd (incl. vitest-pool-workers) at\n// SIGSEGV on module instantiation. Cloud callers set\n// `dangerouslyAllowStdioMCP: false` and never reach the stdio branch below;\n// prod bundles that DO use stdio load it via a dynamic import inside the\n// stdio branch of `createMcpConnector`.\n\nimport type { McpRemoteSourceData, McpStdioSourceData } from \"./types\";\nimport { McpConnectionError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Connection type\n// ---------------------------------------------------------------------------\n\nexport type McpConnection = {\n  readonly client: Client;\n  readonly close: () => Promise<void>;\n};\n\nexport type McpConnector = Effect.Effect<McpConnection, McpConnectionError>;\n\n// ---------------------------------------------------------------------------\n// Connector input — extends stored source data with resolved auth\n// ---------------------------------------------------------------------------\n\nexport type RemoteConnectorInput = Omit<\n  McpRemoteSourceData,\n  \"auth\" | \"remoteTransport\" | \"headers\" | \"queryParams\"\n> & {\n  readonly remoteTransport?: McpRemoteSourceData[\"remoteTransport\"];\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n  readonly authProvider?: OAuthClientProvider;\n};\n\nexport type StdioConnectorInput = McpStdioSourceData;\n\nexport type ConnectorInput = RemoteConnectorInput | StdioConnectorInput;\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst buildEndpointUrl = (endpoint: string, queryParams: Record<string, string>): URL => {\n  const url = new URL(endpoint);\n  for (const [key, value] of Object.entries(queryParams)) {\n    url.searchParams.set(key, value);\n  }\n  return url;\n};\n\n// Use the cfworker JSON Schema validator instead of the SDK's default\n// (Ajv). Ajv compiles schemas via `new Function(...)`, which throws\n// `Code generation from strings disallowed for this context` when the\n// MCP plugin runs inside a Cloudflare Worker (executor.sh). The\n// cfworker validator does not use code generation and works in every\n// runtime we ship to.\nconst createClient = (): Client =>\n  new Client(\n    { name: \"executor-mcp\", version: \"0.1.0\" },\n    {\n      capabilities: { elicitation: { form: {}, url: {} } },\n      jsonSchemaValidator: new CfWorkerJsonSchemaValidator(),\n    },\n  );\n\nconst connectionFromClient = (client: Client): McpConnection => ({\n  client,\n  close: () => client.close(),\n});\n\nconst connectClient = (input: {\n  transport: string;\n  createTransport: () => Parameters<Client[\"connect\"]>[0];\n}): Effect.Effect<McpConnection, McpConnectionError> =>\n  Effect.gen(function* () {\n    const client = createClient();\n    const transportInstance = input.createTransport();\n\n    yield* Effect.tryPromise({\n      try: () => client.connect(transportInstance),\n      catch: (cause) =>\n        new McpConnectionError({\n          transport: input.transport,\n          message: `Failed connecting via ${input.transport}: ${\n            cause instanceof Error ? cause.message : String(cause)\n          }`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.connection.handshake\", {\n        attributes: { \"plugin.mcp.transport\": input.transport },\n      }),\n    );\n\n    return connectionFromClient(client);\n  });\n\n// ---------------------------------------------------------------------------\n// Public factory\n// ---------------------------------------------------------------------------\n\nexport const createMcpConnector = (input: ConnectorInput): McpConnector => {\n  if (input.transport === \"stdio\") {\n    const command = input.command.trim();\n    if (!command) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message: \"MCP stdio transport requires a command\",\n        }),\n      );\n    }\n\n    return Effect.gen(function* () {\n      // Dynamic import so the underlying module (which evaluates\n      // `node:child_process`) is only loaded when stdio is actually used.\n      const { createStdioTransport } = yield* Effect.tryPromise({\n        try: () => import(\"./stdio-connector\"),\n        catch: (cause) =>\n          new McpConnectionError({\n            transport: \"stdio\",\n            message: `Failed to load stdio transport module: ${\n              cause instanceof Error ? cause.message : String(cause)\n            }`,\n          }),\n      });\n\n      return yield* connectClient({\n        transport: \"stdio\",\n        createTransport: () =>\n          createStdioTransport({\n            command,\n            args: input.args,\n            env: input.env,\n            cwd: input.cwd?.trim().length ? input.cwd.trim() : undefined,\n          }),\n      });\n    });\n  }\n\n  // Remote transport\n  const headers = input.headers ?? {};\n  const remoteTransport = input.remoteTransport ?? \"auto\";\n  const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;\n\n  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});\n\n  const connectStreamableHttp = connectClient({\n    transport: \"streamable-http\",\n    createTransport: () =>\n      new StreamableHTTPClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  const connectSse = connectClient({\n    transport: \"sse\",\n    createTransport: () =>\n      new SSEClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  if (remoteTransport === \"streamable-http\") return connectStreamableHttp;\n  if (remoteTransport === \"sse\") return connectSse;\n\n  // auto — try streamable-http first, fall back to SSE\n  return connectStreamableHttp.pipe(Effect.catch(() => connectSse));\n};\n","// ---------------------------------------------------------------------------\n// MCP tool discovery — connect to an MCP server and list its tools\n// ---------------------------------------------------------------------------\n\nimport { Effect } from \"effect\";\n\nimport type { McpConnector } from \"./connection\";\nimport { McpToolDiscoveryError } from \"./errors\";\nimport {\n  extractManifestFromListToolsResult,\n  isListToolsResult,\n  type McpToolManifest,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Connect to an MCP server and discover all available tools.\n * Returns the parsed manifest containing server metadata and tool entries.\n */\nexport const discoverTools = (\n  connector: McpConnector,\n): Effect.Effect<McpToolManifest, McpToolDiscoveryError> =>\n  Effect.gen(function* () {\n    // Acquire connection\n    const connection = yield* connector.pipe(\n      Effect.mapError(\n        (err) =>\n          new McpToolDiscoveryError({\n            stage: \"connect\",\n            message: `Failed connecting to MCP server: ${err.message}`,\n          }),\n      ),\n    );\n\n    // List tools\n    const listResult = yield* Effect.tryPromise({\n      try: () => connection.client.listTools(),\n      catch: (cause) =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: `Failed listing MCP tools: ${\n            cause instanceof Error ? cause.message : String(cause)\n          }`,\n        }),\n    });\n\n    if (!isListToolsResult(listResult)) {\n      yield* Effect.promise(() => connection.close().catch(() => {}));\n      return yield* Effect.fail(\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"MCP listTools response did not match the expected schema\",\n        }),\n      );\n    }\n\n    const manifest = extractManifestFromListToolsResult(listResult, {\n      serverInfo: connection.client.getServerVersion?.(),\n    });\n\n    // Close the connection after discovery\n    yield* Effect.promise(() => connection.close().catch(() => {}));\n\n    return manifest;\n  });\n","import { Schema } from \"effect\";\n\nimport { McpToolAnnotations } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Output types\n// ---------------------------------------------------------------------------\n\nexport interface McpToolManifestEntry {\n  readonly toolId: string;\n  readonly toolName: string;\n  readonly description: string | null;\n  readonly inputSchema?: unknown;\n  readonly outputSchema?: unknown;\n  readonly annotations?: McpToolAnnotations;\n}\n\nexport interface McpServerMetadata {\n  readonly name: string | null;\n  readonly version: string | null;\n}\n\nexport interface McpToolManifest {\n  readonly server: McpServerMetadata | null;\n  readonly tools: readonly McpToolManifestEntry[];\n}\n\n// ---------------------------------------------------------------------------\n// Schemas\n// ---------------------------------------------------------------------------\n\nconst ListedTool = Schema.Struct({\n  name: Schema.String,\n  description: Schema.optional(Schema.NullOr(Schema.String)),\n  inputSchema: Schema.optional(Schema.Unknown),\n  parameters: Schema.optional(Schema.Unknown),\n  outputSchema: Schema.optional(Schema.Unknown),\n  annotations: Schema.optional(McpToolAnnotations),\n});\n\nconst ListToolsResult = Schema.Struct({\n  tools: Schema.Array(ListedTool),\n});\n\nconst ServerInfo = Schema.Struct({\n  name: Schema.optional(Schema.String),\n  version: Schema.optional(Schema.String),\n});\n\nconst decodeListToolsResult = Schema.decodeUnknownOption(ListToolsResult);\nconst decodeServerInfo = Schema.decodeUnknownOption(ServerInfo);\n\nexport const isListToolsResult = (value: unknown): boolean =>\n  decodeListToolsResult(value)._tag === \"Some\";\n\n// ---------------------------------------------------------------------------\n// Tool ID sanitization\n// ---------------------------------------------------------------------------\n\nconst sanitize = (value: string): string => {\n  const s = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return s || \"tool\";\n};\n\nconst uniqueId = (value: string, seen: Map<string, number>): string => {\n  const base = sanitize(value);\n  const n = (seen.get(base) ?? 0) + 1;\n  seen.set(base, n);\n  return n === 1 ? base : `${base}_${n}`;\n};\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport const joinToolPath = (namespace: string | undefined, toolId: string): string =>\n  namespace?.trim() ? `${namespace}.${toolId}` : toolId;\n\nexport const extractManifestFromListToolsResult = (\n  listToolsResult: unknown,\n  metadata?: { serverInfo?: unknown },\n): McpToolManifest => {\n  const seen = new Map<string, number>();\n\n  const listed = decodeListToolsResult(listToolsResult).pipe((opt) =>\n    opt._tag === \"Some\" ? opt.value.tools : [],\n  );\n\n  const server = decodeServerInfo(metadata?.serverInfo).pipe((opt): McpServerMetadata | null =>\n    opt._tag === \"Some\"\n      ? { name: opt.value.name ?? null, version: opt.value.version ?? null }\n      : null,\n  );\n\n  const tools = listed.flatMap((tool): McpToolManifestEntry[] => {\n    const toolName = tool.name.trim();\n    if (!toolName) return [];\n\n    return [\n      {\n        toolId: uniqueId(toolName, seen),\n        toolName,\n        description: tool.description ?? null,\n        inputSchema: tool.inputSchema ?? tool.parameters,\n        outputSchema: tool.outputSchema,\n        annotations: tool.annotations,\n      },\n    ];\n  });\n\n  return { server, tools };\n};\n\n// ---------------------------------------------------------------------------\n// Namespace derivation\n// ---------------------------------------------------------------------------\n\nconst slugify = (value: string): string =>\n  value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n\nconst hostnameOf = (url: string): string | null => {\n  try {\n    return new URL(url).hostname;\n  } catch {\n    return null;\n  }\n};\n\nconst basenameOf = (path: string): string => path.trim().split(/[\\\\/]/).pop() ?? path.trim();\n\nexport const deriveMcpNamespace = (input: {\n  name?: string | null;\n  endpoint?: string | null;\n  command?: string | null;\n}): string => {\n  if (input.name?.trim()) return slugify(input.name) || \"mcp\";\n\n  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;\n  if (fromEndpoint) return slugify(fromEndpoint) || \"mcp\";\n\n  if (input.command?.trim()) return slugify(basenameOf(input.command)) || \"mcp\";\n\n  return \"mcp\";\n};\n","// ---------------------------------------------------------------------------\n// MCP tool invocation — shared helper called from plugin.invokeTool.\n//\n// Responsible for:\n//   1. Finding/creating a cached MCP client connection for the source.\n//   2. Installing a per-invocation `ElicitRequestSchema` handler that\n//      bridges MCP's elicit capability into the host's elicit function\n//      threaded via `InvokeToolInput.elicit`.\n//   3. Calling `client.callTool({ name, arguments })`.\n//   4. Retrying once on connection failure (invalidate + reconnect).\n// ---------------------------------------------------------------------------\n\nimport { Cause, Effect, Exit, Schema, ScopedCache } from \"effect\";\n\nimport { ElicitRequestSchema } from \"@modelcontextprotocol/sdk/types.js\";\n\nimport {\n  FormElicitation,\n  UrlElicitation,\n  type Elicit,\n  type ElicitationRequest,\n} from \"@executor-js/sdk/core\";\n\nimport { McpConnectionError, McpInvocationError } from \"./errors\";\nimport type { McpConnection } from \"./connection\";\nimport type { McpStoredSourceData } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst asRecord = (value: unknown): Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : {};\n\nconst connectionCacheKey = (\n  sd: McpStoredSourceData,\n  invokerScope: string,\n): string =>\n  sd.transport === \"stdio\"\n    ? `stdio:${sd.command}`\n    : // Remote sources may resolve per-user secrets (OAuth tokens, header\n      // auth) via scope shadowing, so two users invoking the same source\n      // get different Authorization headers. The connection caches that\n      // header in transport state, so the cache key must include the\n      // invoking scope — otherwise user B re-uses user A's connection\n      // (and user A's tokens).\n      `remote:${invokerScope}:${sd.endpoint}`;\n\n// ---------------------------------------------------------------------------\n// Elicitation bridge — decode incoming MCP ElicitRequest, route through\n// the host's elicit function, marshal the response back to MCP shape.\n// ---------------------------------------------------------------------------\n\nconst McpElicitParams = Schema.Union([\n  Schema.Struct({\n    mode: Schema.Literal(\"url\"),\n    message: Schema.String,\n    url: Schema.String,\n    elicitationId: Schema.optional(Schema.String),\n    id: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    mode: Schema.optional(Schema.Literal(\"form\")),\n    message: Schema.String,\n    requestedSchema: Schema.Record(Schema.String, Schema.Unknown),\n  }),\n]);\ntype McpElicitParams = typeof McpElicitParams.Type;\n\nconst decodeElicitParams = Schema.decodeUnknownSync(McpElicitParams);\n\nconst toElicitationRequest = (params: McpElicitParams): ElicitationRequest =>\n  params.mode === \"url\"\n    ? new UrlElicitation({\n        message: params.message,\n        url: params.url,\n        elicitationId: params.elicitationId ?? params.id ?? \"\",\n      })\n    : new FormElicitation({\n        message: params.message,\n        requestedSchema: params.requestedSchema,\n      });\n\nconst installElicitationHandler = (\n  client: McpConnection[\"client\"],\n  elicit: Elicit,\n): void => {\n  client.setRequestHandler(\n    ElicitRequestSchema,\n    async (request: { params: unknown }) => {\n      const params = decodeElicitParams(request.params);\n      const req = toElicitationRequest(params);\n      // Use runPromiseExit so we can inspect typed failures — `elicit`\n      // fails with `ElicitationDeclinedError` on decline/cancel, which\n      // we translate into the equivalent MCP elicit response instead of\n      // surfacing as a JSON-RPC error.\n      const exit = await Effect.runPromiseExit(elicit(req));\n      if (Exit.isSuccess(exit)) {\n        const response = exit.value;\n        return {\n          action: response.action,\n          ...(response.action === \"accept\" && response.content\n            ? { content: response.content }\n            : {}),\n        };\n      }\n      const failure = exit.cause.reasons.find(Cause.isFailReason);\n      if (failure) {\n        const err = failure.error as {\n          readonly _tag?: string;\n          readonly action?: \"decline\" | \"cancel\";\n        };\n        if (err._tag === \"ElicitationDeclinedError\") {\n          return { action: err.action ?? \"decline\" };\n        }\n      }\n      throw Cause.squash(exit.cause);\n    },\n  );\n};\n\n// ---------------------------------------------------------------------------\n// Single tool call — install handler, callTool, return raw result\n// ---------------------------------------------------------------------------\n\nconst useConnection = (\n  connection: McpConnection,\n  toolName: string,\n  args: Record<string, unknown>,\n  elicit: Elicit,\n): Effect.Effect<unknown, McpInvocationError> =>\n  Effect.gen(function* () {\n    installElicitationHandler(connection.client, elicit);\n    return yield* Effect.tryPromise({\n      try: () => connection.client.callTool({ name: toolName, arguments: args }),\n      catch: (cause) =>\n        new McpInvocationError({\n          toolName,\n          message: `MCP tool call failed for ${toolName}: ${\n            cause instanceof Error ? cause.message : String(cause)\n          }`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.client.call_tool\", {\n        attributes: { \"mcp.tool.name\": toolName },\n      }),\n    );\n  });\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport interface InvokeMcpToolInput {\n  readonly toolId: string;\n  readonly toolName: string;\n  readonly args: unknown;\n  readonly sourceData: McpStoredSourceData;\n  /** Innermost executor scope id at invoke time. Mixed into the\n   *  connection cache key so per-user OAuth/secret resolution doesn't\n   *  collapse multiple users onto one shared connection. */\n  readonly invokerScope: string;\n  readonly resolveConnector: () => Effect.Effect<McpConnection, McpConnectionError>;\n  readonly connectionCache: ScopedCache.ScopedCache<\n    string,\n    McpConnection,\n    McpConnectionError\n  >;\n  readonly pendingConnectors: Map<\n    string,\n    Effect.Effect<McpConnection, McpConnectionError>\n  >;\n  readonly elicit: Elicit;\n}\n\nexport const invokeMcpTool = (\n  input: InvokeMcpToolInput,\n): Effect.Effect<unknown, McpConnectionError | McpInvocationError> => {\n  const transport: string =\n    input.sourceData.transport === \"stdio\"\n      ? \"stdio\"\n      : (input.sourceData.remoteTransport ?? \"auto\");\n  return Effect.gen(function* () {\n    const cacheKey = connectionCacheKey(input.sourceData, input.invokerScope);\n    const args = asRecord(input.args);\n\n    // Register the connector for the cache lookup (side-channel pattern\n    // — the ScopedCache lookup closure reads from `pendingConnectors`).\n    const connector = input.resolveConnector();\n    input.pendingConnectors.set(cacheKey, connector);\n\n    // Check cache state BEFORE acquire so the span clearly attributes\n    // tail latency to either a cold handshake (miss) or warm reuse (hit).\n    // Without this every `plugin.mcp.connection.acquire` span looks the\n    // same in Axiom and you have to cross-reference the\n    // `plugin.mcp.connection.handshake` count to back out the hit rate.\n    const cacheHit = yield* ScopedCache.has(input.connectionCache, cacheKey);\n\n    const firstConnection = yield* ScopedCache.get(input.connectionCache, cacheKey).pipe(\n      Effect.withSpan(\"plugin.mcp.connection.acquire\", {\n        attributes: {\n          \"plugin.mcp.transport\": transport,\n          \"plugin.mcp.cache_key\": cacheKey,\n          \"plugin.mcp.attempt\": 1,\n          \"plugin.mcp.cache_hit\": cacheHit,\n        },\n      }),\n    );\n\n    return yield* useConnection(\n      firstConnection,\n      input.toolName,\n      args,\n      input.elicit,\n    ).pipe(\n      // On failure, invalidate the cache and retry once with a fresh\n      // connection. Matches the old invoker's retry-once semantics.\n      Effect.catch(() =>\n        Effect.gen(function* () {\n          yield* ScopedCache.invalidate(input.connectionCache, cacheKey);\n          input.pendingConnectors.set(cacheKey, connector);\n          const fresh = yield* ScopedCache.get(input.connectionCache, cacheKey);\n          return yield* useConnection(\n            fresh,\n            input.toolName,\n            args,\n            input.elicit,\n          );\n        }).pipe(\n          Effect.withSpan(\"plugin.mcp.invoke.retry\", {\n            attributes: {\n              \"plugin.mcp.transport\": transport,\n              \"plugin.mcp.cache_key\": cacheKey,\n              \"mcp.tool.name\": input.toolName,\n            },\n          }),\n        ),\n      ),\n    );\n  }).pipe(\n    Effect.scoped,\n    Effect.withSpan(\"plugin.mcp.invoke\", {\n      attributes: {\n        \"mcp.tool.name\": input.toolName,\n        \"plugin.mcp.tool_id\": input.toolId,\n        \"plugin.mcp.transport\": transport,\n      },\n    }),\n  );\n};\n","// ---------------------------------------------------------------------------\n// MCP endpoint shape probe — decide whether an unknown HTTP endpoint is\n// actually speaking MCP before we try to classify it as such.\n//\n// Background:\n//\n//   `discoverTools` (via the MCP SDK's StreamableHTTP / SSE transport)\n//   fails for every non-MCP endpoint too — 200-with-HTML, 400-GraphQL,\n//   404, etc. all surface as the same opaque transport error. When\n//   `discoverTools` fails, plugin.ts falls through to\n//   `startMcpOAuthAuthorization`, which succeeds against *any* URL whose\n//   origin publishes OAuth 2.0 Protected Resource + Authorization Server\n//   Metadata (RFC 9728 + RFC 8414) — that's what the MCP SDK's `auth()`\n//   consumes. Plenty of non-MCP APIs (Railway's `backboard.railway.com/\n//   graphql/v2`, anything backed by a standards-compliant OAuth AS)\n//   publish that metadata, so the fall-through misclassifies them.\n//\n// The MCP authorization spec (`modelcontextprotocol.io/specification/\n// draft/basic/authorization`) mandates the handshake that distinguishes\n// a real MCP-requires-OAuth endpoint from the general case:\n//\n//   - On an unauthenticated request the server MUST respond `401` and\n//     include `WWW-Authenticate: Bearer` with a `resource_metadata=`\n//     attribute pointing at its RFC 9728 document.\n//\n// This module issues an unauth JSON-RPC `initialize` POST and checks\n// exactly that shape. That's enough to separate \"MCP server that needs\n// OAuth\" from \"non-MCP service whose host happens to publish OAuth\n// metadata\". It's a single `fetch`, no MCP-SDK session state, no OAuth\n// round-trip, no DCR — every non-MCP endpoint exits here.\n// ---------------------------------------------------------------------------\n\nimport { Effect } from \"effect\";\n\n/** MCP initialize request body used as the shape probe. Any real MCP\n *  server either answers it (unauth-OK server) or returns the spec-\n *  mandated 401 + WWW-Authenticate pair. A non-MCP endpoint hit with\n *  this body will respond with whatever it does for unknown JSON\n *  payloads — 400, 404, HTML, a GraphQL error envelope, etc. — none of\n *  which match the gate below. */\nconst INITIALIZE_BODY = JSON.stringify({\n  jsonrpc: \"2.0\",\n  id: 1,\n  method: \"initialize\",\n  params: {\n    protocolVersion: \"2025-06-18\",\n    capabilities: {},\n    clientInfo: { name: \"executor-probe\", version: \"0\" },\n  },\n});\n\n/** Header-name lookup is case-insensitive per RFC 7230. `fetch`'s\n *  `Response.headers` already lower-cases, but we normalise explicitly\n *  to stay robust against test mocks that construct `Headers` loosely. */\nconst readHeader = (headers: Headers, name: string): string | null => {\n  const direct = headers.get(name);\n  if (direct !== null) return direct;\n  const lower = name.toLowerCase();\n  for (const [k, v] of headers) {\n    if (k.toLowerCase() === lower) return v;\n  }\n  return null;\n};\n\nexport type McpShapeProbeResult =\n  /** Server answered initialize successfully — either a 2xx with a\n   *  JSON-RPC payload, or a 401 + WWW-Authenticate: Bearer (RFC 6750\n   *  challenge) that the MCP auth spec requires. */\n  | { readonly kind: \"mcp\"; readonly requiresAuth: boolean }\n  /** Endpoint is reachable but the response does not look like MCP. */\n  | { readonly kind: \"not-mcp\"; readonly reason: string }\n  /** Transport-level failure (DNS, TLS, timeout, abort, ...). */\n  | { readonly kind: \"unreachable\"; readonly reason: string };\n\nexport interface ProbeOptions {\n  /** Injected for tests. Defaults to the global `fetch`. */\n  readonly fetch?: typeof fetch;\n  /** Abort the request after this many ms. Default 8000. */\n  readonly timeoutMs?: number;\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n}\n\n/**\n * Hit `endpoint` with a JSON-RPC `initialize` POST and classify the\n * response according to the MCP authorization spec.\n *\n * Returns `{kind: \"mcp\"}` only when the endpoint either:\n *   - answers with 2xx (unauth-OK MCP server), or\n *   - responds 401 with a `Bearer` WWW-Authenticate challenge.\n *\n * Anything else (400, 404, 200-with-HTML, 200-with-GraphQL-errors, ...)\n * is classified `not-mcp`. Transport errors surface as `unreachable`.\n */\nexport const probeMcpEndpointShape = (\n  endpoint: string,\n  options: ProbeOptions = {},\n): Effect.Effect<McpShapeProbeResult> =>\n  Effect.gen(function* () {\n    const fetchImpl = options.fetch ?? globalThis.fetch;\n    const timeoutMs = options.timeoutMs ?? 8_000;\n\n    const outcome = yield* Effect.tryPromise({\n      try: async (): Promise<McpShapeProbeResult> => {\n        const controller = new AbortController();\n        const timer = setTimeout(() => controller.abort(), timeoutMs);\n        try {\n          const classify = (response: Response, method: \"GET\" | \"POST\") => {\n            if (response.status === 401) {\n              const wwwAuth = readHeader(response.headers, \"www-authenticate\");\n              if (wwwAuth && /^\\s*bearer\\b/i.test(wwwAuth)) {\n                return { kind: \"mcp\", requiresAuth: true } as const;\n              }\n              return {\n                kind: \"not-mcp\",\n                reason:\n                  \"401 without Bearer WWW-Authenticate — not an MCP auth challenge\",\n              } as const;\n            }\n\n            if (response.status >= 200 && response.status < 300) {\n              if (method === \"GET\") {\n                const contentType = readHeader(response.headers, \"content-type\") ?? \"\";\n                if (!/^\\s*text\\/event-stream\\b/i.test(contentType)) {\n                  return {\n                    kind: \"not-mcp\",\n                    reason: \"GET response is not an SSE stream\",\n                  } as const;\n                }\n              }\n              return { kind: \"mcp\", requiresAuth: false } as const;\n            }\n\n            return null;\n          };\n\n          const url = new URL(endpoint);\n          for (const [key, value] of Object.entries(options.queryParams ?? {})) {\n            url.searchParams.set(key, value);\n          }\n          const authHeaders = options.headers ?? {};\n\n          const postResponse = await fetchImpl(url, {\n            method: \"POST\",\n            headers: {\n              ...authHeaders,\n              \"content-type\": \"application/json\",\n              accept: \"application/json, text/event-stream\",\n            },\n            body: INITIALIZE_BODY,\n            signal: controller.signal,\n          });\n\n          const postResult = classify(postResponse, \"POST\");\n          if (postResult) return postResult;\n\n          if ([404, 405, 406, 415].includes(postResponse.status)) {\n            const getResponse = await fetchImpl(url, {\n              method: \"GET\",\n              headers: { ...authHeaders, accept: \"text/event-stream\" },\n              signal: controller.signal,\n            });\n            const getResult = classify(getResponse, \"GET\");\n            if (getResult) return getResult;\n          }\n\n          return {\n            kind: \"not-mcp\",\n            reason: `unexpected status ${postResponse.status} for initialize`,\n          };\n        } finally {\n          clearTimeout(timer);\n        }\n      },\n      catch: (cause) => cause,\n    }).pipe(\n      Effect.catch((cause) =>\n        Effect.succeed<McpShapeProbeResult>({\n          kind: \"unreachable\",\n          reason: cause instanceof Error ? cause.message : String(cause),\n        }),\n      ),\n    );\n\n    return outcome;\n  }).pipe(Effect.withSpan(\"mcp.plugin.probe_shape\"));\n"],"mappings":";AAAA,SAAS,QAAQ,cAAc;AAC/B,SAAS,iBAAiB,yBAAyB;AAQ5C,IAAM,qBAAqB,OAAO,SAAS,CAAC,mBAAmB,OAAO,MAAM,CAAC;AAI7E,IAAM,eAAe,OAAO,SAAS,CAAC,mBAAmB,OAAO,SAAS,MAAM,CAAC;AAcvF,IAAM,aAAa,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO;AAGvD,IAAM,oBAAoB,OAAO,MAAM;AAAA,EAC5C,OAAO,OAAO,EAAE,MAAM,OAAO,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC9C,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,QAAQ;AAAA,IAC7B,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO,SAAS,OAAO,MAAM;AAAA,EACvC,CAAC;AAAA,EACD,OAAO,OAAO;AAAA,IACZ,MAAM,OAAO,QAAQ,QAAQ;AAAA,IAC7B,cAAc,OAAO;AAAA,IACrB,kBAAkB,OAAO,SAAS,OAAO,MAAM;AAAA,IAC/C,sBAAsB,OAAO,SAAS,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EACpE,CAAC;AACH,CAAC;AAQD,IAAM,YAAY,OAAO,OAAO,OAAO,QAAQ,OAAO,MAAM;AAErD,IAAM,sBAAsB,OAAO,OAAO;AAAA,EAC/C,WAAW,OAAO,QAAQ,QAAQ;AAAA;AAAA,EAElC,UAAU,OAAO;AAAA;AAAA,EAEjB,iBAAiB,mBAAmB;AAAA,IAClC,OAAO;AAAA,IACP,OAAO,uBAAuB,OAAO,QAAQ,MAAe,CAAC;AAAA,EAC/D;AAAA;AAAA,EAEA,aAAa,OAAO,SAAS,eAAe;AAAA;AAAA,EAE5C,SAAS,OAAO,SAAS,eAAe;AAAA;AAAA,EAExC,MAAM;AACR,CAAC;AAGM,IAAM,qBAAqB,OAAO,OAAO;AAAA,EAC9C,WAAW,OAAO,QAAQ,OAAO;AAAA;AAAA,EAEjC,SAAS,OAAO;AAAA;AAAA,EAEhB,MAAM,OAAO,SAAS,OAAO,MAAM,OAAO,MAAM,CAAC;AAAA;AAAA,EAEjD,KAAK,OAAO,SAAS,SAAS;AAAA;AAAA,EAE9B,KAAK,OAAO,SAAS,OAAO,MAAM;AACpC,CAAC;AAGM,IAAM,sBAAsB,OAAO,MAAM,CAAC,qBAAqB,kBAAkB,CAAC;AAOlF,IAAM,qBAAqB,OAAO,OAAO;AAAA,EAC9C,OAAO,OAAO,SAAS,OAAO,MAAM;AAAA,EACpC,cAAc,OAAO,SAAS,OAAO,OAAO;AAAA,EAC5C,iBAAiB,OAAO,SAAS,OAAO,OAAO;AAAA,EAC/C,gBAAgB,OAAO,SAAS,OAAO,OAAO;AAAA,EAC9C,eAAe,OAAO,SAAS,OAAO,OAAO;AAC/C,CAAC;AAGM,IAAM,iBAAN,cAA6B,OAAO,MAAsB,gBAAgB,EAAE;AAAA,EACjF,QAAQ,OAAO;AAAA,EACf,UAAU,OAAO;AAAA,EACjB,aAAa,OAAO,OAAO,OAAO,MAAM;AAAA,EACxC,aAAa,OAAO,SAAS,OAAO,OAAO;AAAA,EAC3C,cAAc,OAAO,SAAS,OAAO,OAAO;AAAA,EAC5C,aAAa,OAAO,SAAS,kBAAkB;AACjD,CAAC,EAAE;AAAC;;;ACtGJ,SAAS,UAAAA,SAAQ,UAAAC,eAAc;AAE/B;AAAA,EACE;AAAA,OAGK;AAQA,IAAM,YAAY,aAAa;AAAA,EACpC,YAAY;AAAA,IACV,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,MAAM,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACvC,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,MACvC,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,WAAW,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACzD,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,MACxC,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C;AAAA,EACF;AACF,CAAC;AASD,IAAM,mBAAmBC,QAAO,kBAAkB,mBAAmB;AACrE,IAAM,mBAAmBA,QAAO,WAAW,mBAAmB;AAE9D,IAAM,gBAAgBA,QAAO,kBAAkB,cAAc;AAC7D,IAAM,gBAAgBA,QAAO,WAAW,cAAc;AAEtD,IAAM,aAAa,CAAC,UAA4B;AAC9C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI;AACF,WAAO,KAAK,MAAM,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAmFO,IAAM,eAAe,CAAC;AAAA,EAC3B,SAAS;AACX,MAA+C;AAC7C,SAAO;AAAA,IACL,sBAAsB,CAAC,WAAW,UAChCC,QAAO,IAAI,aAAa;AACtB,YAAM,OAAO,OAAO,GAAG,SAAS;AAAA,QAC9B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,aAAO,KAAK,IAAI,CAAC,SAAS;AAAA,QACxB,QAAQ,IAAI;AAAA,QACZ,SAAS,cAAc,WAAW,IAAI,OAAO,CAAC;AAAA,MAChD,EAAE;AAAA,IACJ,CAAC;AAAA,IAEH,YAAY,CAAC,QAAQ,UACnBA,QAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,OAAO;AAAA,UAC7B,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,UAAU,cAAc,WAAW,IAAI,OAAO,CAAC;AACrD,aAAO,EAAE,SAAS,WAAW,IAAI,UAAU;AAAA,IAC7C,CAAC;AAAA,IAEH,aAAa,CAAC,WAAW,OAAO,YAC9BA,QAAO,IAAI,aAAa;AACtB,UAAI,QAAQ,WAAW,EAAG;AAC1B,YAAM,MAAM,oBAAI,KAAK;AACrB,aAAO,GAAG,WAAW;AAAA,QACnB,OAAO;AAAA,QACP,MAAM,QAAQ,IAAI,CAAC,OAAO;AAAA,UACxB,IAAI,EAAE;AAAA,UACN,UAAU;AAAA,UACV,WAAW;AAAA,UACX,SAAS,cAAc,EAAE,OAAO;AAAA,UAChC,YAAY;AAAA,QACd,EAAE;AAAA,QACF,cAAc;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,IAEH,2BAA2B,CAAC,WAAW,UACrC,GACG,WAAW;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,QACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,QACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,MACpC;AAAA,IACF,CAAC,EACA,KAAKA,QAAO,MAAM;AAAA,IAEvB,WAAW,CAAC,WAAW,UACrBA,QAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO;AAAA,QACL,WAAW,IAAI;AAAA,QACf,OAAO,IAAI;AAAA,QACX,MAAM,IAAI;AAAA,QACV,QAAQ,iBAAiB,WAAW,IAAI,MAAM,CAAC;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,IAEH,iBAAiB,CAAC,WAAW,UAC3BA,QAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO,iBAAiB,WAAW,IAAI,MAAM,CAAC;AAAA,IAChD,CAAC;AAAA,IAEH,WAAW,CAAC,WACVA,QAAO,IAAI,aAAa;AACtB,YAAM,MAAM,oBAAI,KAAK;AACrB,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,OAAO,MAAM;AAAA,QAC3C;AAAA,MACF,CAAC;AACD,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,MAAM;AAAA,UACJ,IAAI,OAAO;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,MAAM,OAAO;AAAA,UACb,QAAQ,iBAAiB,OAAO,MAAM;AAAA,UACtC,YAAY;AAAA,QACd;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,IAEH,cAAc,CAAC,WAAW,UACxBA,QAAO,IAAI,aAAa;AACtB,aAAO,GAAG,WAAW;AAAA,QACnB,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACL;AACF;;;ACrRA,SAAS,UAAU,UAAAC,SAAQ,QAAAC,OAAM,QAAQ,OAAO,eAAAC,oBAAmB;;;ACAnE,SAAS,iBAAiB,oBAAoB;AAC9C,SAAS,UAAAC,eAAc;AACvB,SAAS,SAAS,mBAAAC,wBAAuB;AACzC,SAAS,qBAAqB;;;ACE9B,SAAS,UAAAC,eAAc;AAEhB,IAAM,qBAAN,cAAiCA,QAAO,iBAAqC;AAAA,EAClF;AAAA,EACA;AAAA,IACE,WAAWA,QAAO;AAAA,IAClB,SAASA,QAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;AAEI,IAAM,wBAAN,cAAoCA,QAAO,iBAAwC;AAAA,EACxF;AAAA,EACA;AAAA,IACE,OAAOA,QAAO,SAAS,CAAC,WAAW,YAAY,CAAC;AAAA,IAChD,SAASA,QAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;AAEI,IAAM,qBAAN,cAAiCA,QAAO,iBAAqC;AAAA,EAClF;AAAA,EACA;AAAA,IACE,UAAUA,QAAO;AAAA,IACjB,SAASA,QAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;AAEI,IAAM,gBAAN,cAA4BA,QAAO,iBAAgC;AAAA,EACxE;AAAA,EACA;AAAA,IACE,SAASA,QAAO;AAAA,EAClB;AAAA,EACA,EAAE,eAAe,IAAI;AACvB,EAAE;AAAC;;;ACxCH,SAAS,UAAAC,eAAc;AAShB,IAAM,wBAAN,cAAoCC,QAAO,MAA6B,iBAAiB,EAAE;AAAA,EAChG,WAAWA,QAAO;AAAA,EAClB,MAAMA,QAAO;AAAA,EACb,QAAQ;AACV,CAAC,EAAE;AAAC;;;AFDJ,IAAM,cAAc,EAAE,SAAS,QAAQ;AACvC,IAAM,eAAe,EAAE,SAAS,SAAS,WAAWC,QAAO,OAAO;AAMlE,IAAM,cAAcA,QAAO,MAAM;AAAA,EAC/BA,QAAO,OAAO,EAAE,MAAMA,QAAO,QAAQ,MAAM,EAAE,CAAC;AAAA,EAC9CA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,QAAQ,QAAQ;AAAA,IAC7B,YAAYA,QAAO;AAAA,IACnB,UAAUA,QAAO;AAAA,IACjB,QAAQA,QAAO,SAASA,QAAO,MAAM;AAAA,EACvC,CAAC;AAAA,EACDA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAAA,IAI7B,cAAcA,QAAO;AAAA,IACrB,kBAAkBA,QAAO,SAASA,QAAO,MAAM;AAAA,IAC/C,sBAAsBA,QAAO,SAASA,QAAO,OAAOA,QAAO,MAAM,CAAC;AAAA,EACpE,CAAC;AACH,CAAC;AAED,IAAMC,aAAYD,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM;AAK5D,IAAM,yBAAyBA,QAAO,OAAO;AAAA,EAC3C,WAAWA,QAAO,QAAQ,QAAQ;AAAA,EAClC,MAAMA,QAAO;AAAA,EACb,UAAUA,QAAO;AAAA,EACjB,iBAAiBA,QAAO,SAASA,QAAO,SAAS,CAAC,mBAAmB,OAAO,MAAM,CAAC,CAAC;AAAA,EACpF,WAAWA,QAAO,SAASA,QAAO,MAAM;AAAA,EACxC,aAAaA,QAAO,SAASE,gBAAe;AAAA,EAC5C,SAASF,QAAO,SAASE,gBAAe;AAAA,EACxC,MAAMF,QAAO,SAAS,WAAW;AACnC,CAAC;AAED,IAAM,wBAAwBA,QAAO,OAAO;AAAA,EAC1C,WAAWA,QAAO,QAAQ,OAAO;AAAA,EACjC,MAAMA,QAAO;AAAA,EACb,SAASA,QAAO;AAAA,EAChB,MAAMA,QAAO,SAASA,QAAO,MAAMA,QAAO,MAAM,CAAC;AAAA,EACjD,KAAKA,QAAO,SAASC,UAAS;AAAA,EAC9B,KAAKD,QAAO,SAASA,QAAO,MAAM;AAAA,EAClC,WAAWA,QAAO,SAASA,QAAO,MAAM;AAC1C,CAAC;AAED,IAAM,mBAAmBA,QAAO,MAAM,CAAC,wBAAwB,qBAAqB,CAAC;AAMrF,IAAM,sBAAsBA,QAAO,OAAO;AAAA,EACxC,MAAMA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,UAAUA,QAAO,SAASA,QAAO,MAAM;AAAA,EACvC,SAASA,QAAO,SAASE,gBAAe;AAAA,EACxC,aAAaF,QAAO,SAASE,gBAAe;AAAA,EAC5C,MAAMF,QAAO,SAAS,WAAW;AACnC,CAAC;AAED,IAAM,uBAAuBA,QAAO,OAAO;AAAA,EACzC,SAASA,QAAO;AAClB,CAAC;AAED,IAAM,uBAAuBA,QAAO,OAAO;AAAA,EACzC,UAAUA,QAAO;AAAA,EACjB,SAASA,QAAO,SAASE,gBAAe;AAAA,EACxC,aAAaF,QAAO,SAASE,gBAAe;AAC9C,CAAC;AAED,IAAM,wBAAwBF,QAAO,OAAO;AAAA,EAC1C,WAAWA,QAAO;AAAA,EAClB,eAAeA,QAAO;AAAA,EACtB,MAAMA,QAAO;AAAA,EACb,WAAWA,QAAO;AAAA,EAClB,WAAWA,QAAO,OAAOA,QAAO,MAAM;AAAA,EACtC,YAAYA,QAAO,OAAOA,QAAO,MAAM;AACzC,CAAC;AAED,IAAM,mBAAmBA,QAAO,OAAO;AAAA,EACrC,WAAWA,QAAO;AACpB,CAAC;AAMD,IAAM,oBAAoBA,QAAO,OAAO;AAAA,EACtC,WAAWA,QAAO;AAAA,EAClB,WAAWA,QAAO;AACpB,CAAC;AAED,IAAM,wBAAwBA,QAAO,OAAO;AAAA,EAC1C,WAAWA,QAAO;AACpB,CAAC;AAED,IAAM,uBAAuBA,QAAO,OAAO;AAAA,EACzC,SAASA,QAAO;AAClB,CAAC;AAkBM,IAAM,WAAW,aAAa,KAAK,KAAK,EAC5C;AAAA,EACC,gBAAgB,KAAK,iBAAiB,8BAA8B;AAAA,IAClE,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,oBAAoB,qBAAqB;AAAA,EAClE,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,KAAK,aAAa,gCAAgC;AAAA,IAChE,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,oBAAoB,qBAAqB;AAAA,EAClE,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,KAAK,gBAAgB,uCAAuC;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,oBAAoB,qBAAqB;AAAA,EAClE,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,KAAK,iBAAiB,wCAAwC;AAAA,IAC5E,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,oBAAoB,qBAAqB;AAAA,EAClE,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,IAAI,aAAa,2CAA2C;AAAA,IAC1E,QAAQ;AAAA,IACR,SAASA,QAAO,OAAO,qBAAqB;AAAA,IAC5C,OAAO,CAAC,eAAe,oBAAoB,qBAAqB;AAAA,EAClE,CAAC;AACH,EACC;AAAA,EACC,gBAAgB,MAAM,gBAAgB,2CAA2C;AAAA,IAC/E,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,SAAS;AAAA,IACT,OAAO,CAAC,eAAe,oBAAoB,qBAAqB;AAAA,EAClE,CAAC;AACH;;;AGrLF,SAAS,sBAAsB;AAC/B,SAAS,SAAS,UAAAG,eAAc;AAEhC,SAAS,UAAU,eAAe;AAmB3B,IAAM,sBAAN,cAAkC,QAAQ,QAC/C,EAAE,qBAAqB,EAAE;AAAC;AAM5B,IAAM,qBAAqB,SAAS,QAAQ;AAM5C,IAAM,iBAAiB,CACrB,SACA,UACoB;AACpB,MAAI,QAAQ,cAAc,SAAS;AACjC,UAAMC,KAAI;AASV,WAAO;AAAA,MACL,WAAW;AAAA,MACX;AAAA,MACA,MAAMA,GAAE;AAAA,MACR,SAASA,GAAE;AAAA,MACX,MAAMA,GAAE,OAAO,CAAC,GAAGA,GAAE,IAAI,IAAI;AAAA,MAC7B,KAAKA,GAAE;AAAA,MACP,KAAKA,GAAE;AAAA,MACP,WAAWA,GAAE;AAAA,IACf;AAAA,EACF;AAEA,QAAM,IAAI;AAWV,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,MAAM,EAAE;AAAA,IACR,UAAU,EAAE;AAAA,IACZ,iBAAiB,EAAE;AAAA,IACnB,aAAa,EAAE;AAAA,IACf,SAAS,EAAE;AAAA,IACX,WAAW,EAAE;AAAA,IACb,MAAM,EAAE;AAAA,EACV;AACF;AAeO,IAAM,cAAc,eAAe;AAAA,EAAM;AAAA,EAAoB;AAAA,EAAO,CAAC,aAC1E,SACG;AAAA,IAAO;AAAA,IAAiB,CAAC,EAAE,QAAQ,MAClC;AAAA,MACEC,QAAO,IAAI,aAAa;AACtB,cAAM,MAAM,OAAO;AACnB,eAAO,OAAO,IAAI,cAAc,OAAgC;AAAA,MAClE,CAAC;AAAA,IACH;AAAA,EACF,EACC;AAAA,IAAO;AAAA,IAAa,CAAC,EAAE,QAAQ,MAAM,QAAQ,MAC5C;AAAA,MACEA,QAAO,IAAI,aAAa;AACtB,cAAM,MAAM,OAAO;AACnB,eAAO,OAAO,IAAI;AAAA,UAChB,eAAe,SAAiD,KAAK,OAAO;AAAA,QAC9E;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,EACC;AAAA,IAAO;AAAA,IAAgB,CAAC,EAAE,QAAQ,MAAM,QAAQ,MAC/C;AAAA,MACEA,QAAO,IAAI,aAAa;AACtB,cAAM,MAAM,OAAO;AACnB,eAAO,IAAI,aAAa,QAAQ,WAAW,KAAK,OAAO;AACvD,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,EACF,EACC;AAAA,IAAO;AAAA,IAAiB,CAAC,EAAE,QAAQ,MAAM,QAAQ,MAChD;AAAA,MACEA,QAAO,IAAI,aAAa;AACtB,cAAM,MAAM,OAAO;AACnB,eAAO,OAAO,IAAI,cAAc,QAAQ,WAAW,KAAK,OAAO;AAAA,MACjE,CAAC;AAAA,IACH;AAAA,EACF,EACC;AAAA,IAAO;AAAA,IAAa,CAAC,EAAE,QAAQ,KAAK,MACnC;AAAA,MACEA,QAAO,IAAI,aAAa;AACtB,cAAM,MAAM,OAAO;AACnB,cAAM,SAAS,OAAO,IAAI,UAAU,KAAK,WAAW,KAAK,OAAO;AAChE,eAAO,SACH,IAAI,sBAAsB;AAAA,UACxB,WAAW,OAAO;AAAA,UAClB,MAAM,OAAO;AAAA,UACb,QAAQ,OAAO;AAAA,QACjB,CAAC,IACD;AAAA,MACN,CAAC;AAAA,IACH;AAAA,EACF,EACC;AAAA,IAAO;AAAA,IAAgB,CAAC,EAAE,QAAQ,MAAM,QAAQ,MAC/C;AAAA,MACEA,QAAO,IAAI,aAAa;AACtB,cAAM,MAAM,OAAO;AACnB,eAAO,IAAI,aAAa,KAAK,WAAW,KAAK,SAAS;AAAA,UACpD,MAAM,QAAQ;AAAA,UACd,UAAU,QAAQ;AAAA,UAClB,SAAS,QAAQ;AAAA,UACjB,aAAa,QAAQ;AAAA,UACrB,MAAM,QAAQ;AAAA,QAChB,CAAC;AACD,eAAO,EAAE,SAAS,KAAK;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,EACF;AACJ;;;AJ9JA;AAAA,EACE;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,OAIrB;;;AKbP,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAC9C,SAAS,mCAAmC;AAC5C,SAAS,UAAAC,eAAc;AA8CvB,IAAM,mBAAmB,CAAC,UAAkB,gBAA6C;AACvF,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,SAAO;AACT;AAQA,IAAM,eAAe,MACnB,IAAI;AAAA,EACF,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,EACzC;AAAA,IACE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE;AAAA,IACnD,qBAAqB,IAAI,4BAA4B;AAAA,EACvD;AACF;AAEF,IAAM,uBAAuB,CAAC,YAAmC;AAAA,EAC/D;AAAA,EACA,OAAO,MAAM,OAAO,MAAM;AAC5B;AAEA,IAAM,gBAAgB,CAAC,UAIrBC,QAAO,IAAI,aAAa;AACtB,QAAM,SAAS,aAAa;AAC5B,QAAM,oBAAoB,MAAM,gBAAgB;AAEhD,SAAOA,QAAO,WAAW;AAAA,IACvB,KAAK,MAAM,OAAO,QAAQ,iBAAiB;AAAA,IAC3C,OAAO,CAAC,UACN,IAAI,mBAAmB;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,SAAS,yBAAyB,MAAM,SAAS,KAC/C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACDA,QAAO,SAAS,mCAAmC;AAAA,MACjD,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,IACxD,CAAC;AAAA,EACH;AAEA,SAAO,qBAAqB,MAAM;AACpC,CAAC;AAMI,IAAM,qBAAqB,CAAC,UAAwC;AACzE,MAAI,MAAM,cAAc,SAAS;AAC/B,UAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAI,CAAC,SAAS;AACZ,aAAOA,QAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAOA,QAAO,IAAI,aAAa;AAG7B,YAAM,EAAE,qBAAqB,IAAI,OAAOA,QAAO,WAAW;AAAA,QACxD,KAAK,MAAM,OAAO,+BAAmB;AAAA,QACrC,OAAO,CAAC,UACN,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS,0CACP,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,QACF,CAAC;AAAA,MACL,CAAC;AAED,aAAO,OAAO,cAAc;AAAA,QAC1B,WAAW;AAAA,QACX,iBAAiB,MACf,qBAAqB;AAAA,UACnB;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,KAAK,MAAM;AAAA,UACX,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,MAAM,IAAI,KAAK,IAAI;AAAA,QACrD,CAAC;AAAA,MACL,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAGA,QAAM,UAAU,MAAM,WAAW,CAAC;AAClC,QAAM,kBAAkB,MAAM,mBAAmB;AACjD,QAAM,cAAc,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI;AAEpE,QAAM,WAAW,iBAAiB,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC;AAEzE,QAAM,wBAAwB,cAAc;AAAA,IAC1C,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,8BAA8B,UAAU;AAAA,MAC1C;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,QAAM,aAAa,cAAc;AAAA,IAC/B,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,mBAAmB,UAAU;AAAA,MAC/B;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,MAAI,oBAAoB,kBAAmB,QAAO;AAClD,MAAI,oBAAoB,MAAO,QAAO;AAGtC,SAAO,sBAAsB,KAAKA,QAAO,MAAM,MAAM,UAAU,CAAC;AAClE;;;AC9KA,SAAS,UAAAC,eAAc;;;ACJvB,SAAS,UAAAC,eAAc;AA+BvB,IAAM,aAAaC,QAAO,OAAO;AAAA,EAC/B,MAAMA,QAAO;AAAA,EACb,aAAaA,QAAO,SAASA,QAAO,OAAOA,QAAO,MAAM,CAAC;AAAA,EACzD,aAAaA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC3C,YAAYA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC1C,cAAcA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC5C,aAAaA,QAAO,SAAS,kBAAkB;AACjD,CAAC;AAED,IAAM,kBAAkBA,QAAO,OAAO;AAAA,EACpC,OAAOA,QAAO,MAAM,UAAU;AAChC,CAAC;AAED,IAAM,aAAaA,QAAO,OAAO;AAAA,EAC/B,MAAMA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,SAASA,QAAO,SAASA,QAAO,MAAM;AACxC,CAAC;AAED,IAAM,wBAAwBA,QAAO,oBAAoB,eAAe;AACxE,IAAM,mBAAmBA,QAAO,oBAAoB,UAAU;AAEvD,IAAM,oBAAoB,CAAC,UAChC,sBAAsB,KAAK,EAAE,SAAS;AAMxC,IAAM,WAAW,CAAC,UAA0B;AAC1C,QAAM,IAAI,MACP,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK;AACd;AAEA,IAAM,WAAW,CAAC,OAAe,SAAsC;AACrE,QAAM,OAAO,SAAS,KAAK;AAC3B,QAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK;AAClC,OAAK,IAAI,MAAM,CAAC;AAChB,SAAO,MAAM,IAAI,OAAO,GAAG,IAAI,IAAI,CAAC;AACtC;AASO,IAAM,qCAAqC,CAChD,iBACA,aACoB;AACpB,QAAM,OAAO,oBAAI,IAAoB;AAErC,QAAM,SAAS,sBAAsB,eAAe,EAAE;AAAA,IAAK,CAAC,QAC1D,IAAI,SAAS,SAAS,IAAI,MAAM,QAAQ,CAAC;AAAA,EAC3C;AAEA,QAAM,SAAS,iBAAiB,UAAU,UAAU,EAAE;AAAA,IAAK,CAAC,QAC1D,IAAI,SAAS,SACT,EAAE,MAAM,IAAI,MAAM,QAAQ,MAAM,SAAS,IAAI,MAAM,WAAW,KAAK,IACnE;AAAA,EACN;AAEA,QAAM,QAAQ,OAAO,QAAQ,CAAC,SAAiC;AAC7D,UAAM,WAAW,KAAK,KAAK,KAAK;AAChC,QAAI,CAAC,SAAU,QAAO,CAAC;AAEvB,WAAO;AAAA,MACL;AAAA,QACE,QAAQ,SAAS,UAAU,IAAI;AAAA,QAC/B;AAAA,QACA,aAAa,KAAK,eAAe;AAAA,QACjC,aAAa,KAAK,eAAe,KAAK;AAAA,QACtC,cAAc,KAAK;AAAA,QACnB,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,MAAM;AACzB;AAMA,IAAM,UAAU,CAAC,UACf,MACG,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAE3B,IAAM,aAAa,CAAC,QAA+B;AACjD,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,aAAa,CAAC,SAAyB,KAAK,KAAK,EAAE,MAAM,OAAO,EAAE,IAAI,KAAK,KAAK,KAAK;AAEpF,IAAM,qBAAqB,CAAC,UAIrB;AACZ,MAAI,MAAM,MAAM,KAAK,EAAG,QAAO,QAAQ,MAAM,IAAI,KAAK;AAEtD,QAAM,eAAe,MAAM,UAAU,KAAK,IAAI,WAAW,MAAM,QAAQ,IAAI;AAC3E,MAAI,aAAc,QAAO,QAAQ,YAAY,KAAK;AAElD,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO,QAAQ,WAAW,MAAM,OAAO,CAAC,KAAK;AAExE,SAAO;AACT;;;ADhIO,IAAM,gBAAgB,CAC3B,cAEAC,QAAO,IAAI,aAAa;AAEtB,QAAM,aAAa,OAAO,UAAU;AAAA,IAClCA,QAAO;AAAA,MACL,CAAC,QACC,IAAI,sBAAsB;AAAA,QACxB,OAAO;AAAA,QACP,SAAS,oCAAoC,IAAI,OAAO;AAAA,MAC1D,CAAC;AAAA,IACL;AAAA,EACF;AAGA,QAAM,aAAa,OAAOA,QAAO,WAAW;AAAA,IAC1C,KAAK,MAAM,WAAW,OAAO,UAAU;AAAA,IACvC,OAAO,CAAC,UACN,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS,6BACP,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,IACF,CAAC;AAAA,EACL,CAAC;AAED,MAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,WAAOA,QAAO,QAAQ,MAAM,WAAW,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC,CAAC;AAC9D,WAAO,OAAOA,QAAO;AAAA,MACnB,IAAI,sBAAsB;AAAA,QACxB,OAAO;AAAA,QACP,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,WAAW,mCAAmC,YAAY;AAAA,IAC9D,YAAY,WAAW,OAAO,mBAAmB;AAAA,EACnD,CAAC;AAGD,SAAOA,QAAO,QAAQ,MAAM,WAAW,MAAM,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC,CAAC;AAE9D,SAAO;AACT,CAAC;;;AEvDH,SAAS,OAAO,UAAAC,SAAQ,MAAM,UAAAC,SAAQ,mBAAmB;AAEzD,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAUP,IAAM,WAAW,CAAC,UAChB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IAC9D,QACD,CAAC;AAEP,IAAM,qBAAqB,CACzB,IACA,iBAEA,GAAG,cAAc,UACb,SAAS,GAAG,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOnB,UAAU,YAAY,IAAI,GAAG,QAAQ;AAAA;AAO3C,IAAM,kBAAkBC,QAAO,MAAM;AAAA,EACnCA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,QAAQ,KAAK;AAAA,IAC1B,SAASA,QAAO;AAAA,IAChB,KAAKA,QAAO;AAAA,IACZ,eAAeA,QAAO,SAASA,QAAO,MAAM;AAAA,IAC5C,IAAIA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,CAAC;AAAA,EACDA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,SAASA,QAAO,QAAQ,MAAM,CAAC;AAAA,IAC5C,SAASA,QAAO;AAAA,IAChB,iBAAiBA,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAAA,EAC9D,CAAC;AACH,CAAC;AAGD,IAAM,qBAAqBA,QAAO,kBAAkB,eAAe;AAEnE,IAAM,uBAAuB,CAAC,WAC5B,OAAO,SAAS,QACZ,IAAI,eAAe;AAAA,EACjB,SAAS,OAAO;AAAA,EAChB,KAAK,OAAO;AAAA,EACZ,eAAe,OAAO,iBAAiB,OAAO,MAAM;AACtD,CAAC,IACD,IAAI,gBAAgB;AAAA,EAClB,SAAS,OAAO;AAAA,EAChB,iBAAiB,OAAO;AAC1B,CAAC;AAEP,IAAM,4BAA4B,CAChC,QACA,WACS;AACT,SAAO;AAAA,IACL;AAAA,IACA,OAAO,YAAiC;AACtC,YAAM,SAAS,mBAAmB,QAAQ,MAAM;AAChD,YAAM,MAAM,qBAAqB,MAAM;AAKvC,YAAM,OAAO,MAAMC,QAAO,eAAe,OAAO,GAAG,CAAC;AACpD,UAAI,KAAK,UAAU,IAAI,GAAG;AACxB,cAAM,WAAW,KAAK;AACtB,eAAO;AAAA,UACL,QAAQ,SAAS;AAAA,UACjB,GAAI,SAAS,WAAW,YAAY,SAAS,UACzC,EAAE,SAAS,SAAS,QAAQ,IAC5B,CAAC;AAAA,QACP;AAAA,MACF;AACA,YAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,YAAY;AAC1D,UAAI,SAAS;AACX,cAAM,MAAM,QAAQ;AAIpB,YAAI,IAAI,SAAS,4BAA4B;AAC3C,iBAAO,EAAE,QAAQ,IAAI,UAAU,UAAU;AAAA,QAC3C;AAAA,MACF;AACA,YAAM,MAAM,OAAO,KAAK,KAAK;AAAA,IAC/B;AAAA,EACF;AACF;AAMA,IAAM,gBAAgB,CACpB,YACA,UACA,MACA,WAEAA,QAAO,IAAI,aAAa;AACtB,4BAA0B,WAAW,QAAQ,MAAM;AACnD,SAAO,OAAOA,QAAO,WAAW;AAAA,IAC9B,KAAK,MAAM,WAAW,OAAO,SAAS,EAAE,MAAM,UAAU,WAAW,KAAK,CAAC;AAAA,IACzE,OAAO,CAAC,UACN,IAAI,mBAAmB;AAAA,MACrB;AAAA,MACA,SAAS,4BAA4B,QAAQ,KAC3C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,IACF,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACDA,QAAO,SAAS,+BAA+B;AAAA,MAC7C,YAAY,EAAE,iBAAiB,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AACF,CAAC;AA4BI,IAAM,gBAAgB,CAC3B,UACoE;AACpE,QAAM,YACJ,MAAM,WAAW,cAAc,UAC3B,UACC,MAAM,WAAW,mBAAmB;AAC3C,SAAOA,QAAO,IAAI,aAAa;AAC7B,UAAM,WAAW,mBAAmB,MAAM,YAAY,MAAM,YAAY;AACxE,UAAM,OAAO,SAAS,MAAM,IAAI;AAIhC,UAAM,YAAY,MAAM,iBAAiB;AACzC,UAAM,kBAAkB,IAAI,UAAU,SAAS;AAO/C,UAAM,WAAW,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ;AAEvE,UAAM,kBAAkB,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ,EAAE;AAAA,MAC9EA,QAAO,SAAS,iCAAiC;AAAA,QAC/C,YAAY;AAAA,UACV,wBAAwB;AAAA,UACxB,wBAAwB;AAAA,UACxB,sBAAsB;AAAA,UACtB,wBAAwB;AAAA,QAC1B;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,OAAO;AAAA,MACZ;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,MAAM;AAAA,IACR,EAAE;AAAA;AAAA;AAAA,MAGAA,QAAO;AAAA,QAAM,MACXA,QAAO,IAAI,aAAa;AACtB,iBAAO,YAAY,WAAW,MAAM,iBAAiB,QAAQ;AAC7D,gBAAM,kBAAkB,IAAI,UAAU,SAAS;AAC/C,gBAAM,QAAQ,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ;AACpE,iBAAO,OAAO;AAAA,YACZ;AAAA,YACA,MAAM;AAAA,YACN;AAAA,YACA,MAAM;AAAA,UACR;AAAA,QACF,CAAC,EAAE;AAAA,UACDA,QAAO,SAAS,2BAA2B;AAAA,YACzC,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB;AAAA,cACxB,iBAAiB,MAAM;AAAA,YACzB;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC,EAAE;AAAA,IACDA,QAAO;AAAA,IACPA,QAAO,SAAS,qBAAqB;AAAA,MACnC,YAAY;AAAA,QACV,iBAAiB,MAAM;AAAA,QACvB,sBAAsB,MAAM;AAAA,QAC5B,wBAAwB;AAAA,MAC1B;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;AC3NA,SAAS,UAAAC,eAAc;AAQvB,IAAM,kBAAkB,KAAK,UAAU;AAAA,EACrC,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,QAAQ;AAAA,EACR,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,MAAM,kBAAkB,SAAS,IAAI;AAAA,EACrD;AACF,CAAC;AAKD,IAAM,aAAa,CAAC,SAAkB,SAAgC;AACpE,QAAM,SAAS,QAAQ,IAAI,IAAI;AAC/B,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,QAAQ,KAAK,YAAY;AAC/B,aAAW,CAAC,GAAG,CAAC,KAAK,SAAS;AAC5B,QAAI,EAAE,YAAY,MAAM,MAAO,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAgCO,IAAM,wBAAwB,CACnC,UACA,UAAwB,CAAC,MAEzBA,QAAO,IAAI,aAAa;AACtB,QAAM,YAAY,QAAQ,SAAS,WAAW;AAC9C,QAAM,YAAY,QAAQ,aAAa;AAEvC,QAAM,UAAU,OAAOA,QAAO,WAAW;AAAA,IACvC,KAAK,YAA0C;AAC7C,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,UAAI;AACF,cAAM,WAAW,CAAC,UAAoB,WAA2B;AAC/D,cAAI,SAAS,WAAW,KAAK;AAC3B,kBAAM,UAAU,WAAW,SAAS,SAAS,kBAAkB;AAC/D,gBAAI,WAAW,gBAAgB,KAAK,OAAO,GAAG;AAC5C,qBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,YAC3C;AACA,mBAAO;AAAA,cACL,MAAM;AAAA,cACN,QACE;AAAA,YACJ;AAAA,UACF;AAEA,cAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,gBAAI,WAAW,OAAO;AACpB,oBAAM,cAAc,WAAW,SAAS,SAAS,cAAc,KAAK;AACpE,kBAAI,CAAC,4BAA4B,KAAK,WAAW,GAAG;AAClD,uBAAO;AAAA,kBACL,MAAM;AAAA,kBACN,QAAQ;AAAA,gBACV;AAAA,cACF;AAAA,YACF;AACA,mBAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,UAC5C;AAEA,iBAAO;AAAA,QACT;AAEA,cAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,eAAe,CAAC,CAAC,GAAG;AACpE,cAAI,aAAa,IAAI,KAAK,KAAK;AAAA,QACjC;AACA,cAAM,cAAc,QAAQ,WAAW,CAAC;AAExC,cAAM,eAAe,MAAM,UAAU,KAAK;AAAA,UACxC,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,GAAG;AAAA,YACH,gBAAgB;AAAA,YAChB,QAAQ;AAAA,UACV;AAAA,UACA,MAAM;AAAA,UACN,QAAQ,WAAW;AAAA,QACrB,CAAC;AAED,cAAM,aAAa,SAAS,cAAc,MAAM;AAChD,YAAI,WAAY,QAAO;AAEvB,YAAI,CAAC,KAAK,KAAK,KAAK,GAAG,EAAE,SAAS,aAAa,MAAM,GAAG;AACtD,gBAAM,cAAc,MAAM,UAAU,KAAK;AAAA,YACvC,QAAQ;AAAA,YACR,SAAS,EAAE,GAAG,aAAa,QAAQ,oBAAoB;AAAA,YACvD,QAAQ,WAAW;AAAA,UACrB,CAAC;AACD,gBAAM,YAAY,SAAS,aAAa,KAAK;AAC7C,cAAI,UAAW,QAAO;AAAA,QACxB;AAEA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,qBAAqB,aAAa,MAAM;AAAA,QAClD;AAAA,MACF,UAAE;AACA,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,IACA,OAAO,CAAC,UAAU;AAAA,EACpB,CAAC,EAAE;AAAA,IACDA,QAAO;AAAA,MAAM,CAAC,UACZA,QAAO,QAA6B;AAAA,QAClC,MAAM;AAAA,QACN,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT,CAAC,EAAE,KAAKA,QAAO,SAAS,wBAAwB,CAAC;;;ATtJnD;AAAA,EACE;AAAA,OAMK;AAwEP,IAAM,qBAAqB,CAAC,WAAiD;AAC3E,MAAI,OAAO,cAAc,SAAS;AAChC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C,aAAa,OAAO;AAAA,IACpB,SAAS,OAAO;AAAA,IAChB,MAAM,OAAO,QAAQ,EAAE,MAAM,OAAO;AAAA,EACtC;AACF;AAEA,IAAM,qBAAqB,CAAC,WAC1B,OAAO,aACP,mBAAmB;AAAA,EACjB,MAAM,OAAO;AAAA,EACb,UAAU,OAAO,cAAc,WAAW,OAAO,WAAW;AAAA,EAC5D,SAAS,OAAO,cAAc,UAAU,OAAO,UAAU;AAC3D,CAAC;AAEH,IAAM,YAAY,CAAC,UACjB,IAAI,eAAe;AAAA,EACjB,QAAQ,MAAM;AAAA,EACd,UAAU,MAAM;AAAA,EAChB,aAAa,MAAM;AAAA,EACnB,aAAa,MAAM;AAAA,EACnB,cAAc,MAAM;AAAA,EACpB,aAAa,MAAM;AACrB,CAAC;AAcH,IAAM,oBAAoB,CAAC,iBAA8C;AAAA,EACvE,IAAI,cAAc;AAChB,WAAO;AAAA,EACT;AAAA,EACA,IAAI,iBAAiB;AACnB,WAAO;AAAA,MACL,eAAe,CAAC,iCAAiC;AAAA,MACjD,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,mBAAmB,MAAM;AAAA,EACzB,uBAAuB,MAAM;AAAA,EAC7B,QAAQ,OAAO,EAAE,cAAc,aAAa,YAAY,SAAS;AAAA,EACjE,YAAY,MAAM;AAAA,EAClB,yBAAyB,YAAY;AACnC,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAAA,EACA,kBAAkB,MAAM;AAAA,EACxB,cAAc,MAAM;AAClB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EACA,oBAAoB,MAAM;AAAA,EAC1B,gBAAgB,MAAM;AACxB;AAEA,IAAM,wBAAwB,CAAC,YAC7B,IAAI,mBAAmB,EAAE,WAAW,UAAU,QAAQ,CAAC;AAEzD,IAAM,oBAAoB,CAAC,YACzB,IAAI,sBAAsB,EAAE,OAAO,cAAc,QAAQ,CAAC;AAE5D,IAAM,yBAAyB,CAC7B,QACA,QAEA,6BAA6B;AAAA,EAC3B;AAAA,EACA,WAAW,IAAI,QAAQ;AAAA,EACvB,WAAW,CAAC,OAAO,UACjB,sBAAsB,6BAA6B,MAAM,QAAQ,GAAG;AAAA,EACtE,SAAS,CAAC,KAAK,OAAO,UACpB,UAAU,OAAO,IAAI,SAAS,iCAC1B,sBAAsB,6BAA6B,MAAM,QAAQ,GAAG,IACpE;AACR,CAAC,EAAE;AAAA,EACDC,QAAO;AAAA,IAAS,CAAC,QACf,UAAU,OAAO,IAAI,SAAS,iCAC1B,sBAAsB,0BAA0B,IAChD;AAAA,EACN;AACF;AAEF,IAAM,iBAAiB,CACrB,WACuC;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,QAAQ,MAAM,EAAE;AAAA,IACrC,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM;AAAA,EAC5D;AACA,SAAO,QAAQ,SAAS,IAAI,OAAO,YAAY,OAAO,IAAI;AAC5D;AAMA,IAAM,wBAAwB,CAC5B,IACA,KACA,eACuE;AACvE,MAAI,GAAG,cAAc,SAAS;AAC5B,QAAI,CAAC,YAAY;AACf,aAAOA,QAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAOA,QAAO,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,SAAS,GAAG;AAAA,MACZ,MAAM,GAAG;AAAA,MACT,KAAK,GAAG;AAAA,MACR,KAAK,GAAG;AAAA,IACV,CAAC;AAAA,EACH;AAEA,SAAOA,QAAO,IAAI,aAAa;AAC7B,UAAM,kBAAkB,OAAO,uBAAuB,GAAG,SAAS,GAAG;AACrE,UAAM,sBAAsB,OAAO,uBAAuB,GAAG,aAAa,GAAG;AAC7E,UAAM,UAAkC,EAAE,GAAI,mBAAmB,CAAC,EAAG;AACrE,QAAI;AAEJ,UAAM,OAAO,GAAG;AAChB,QAAI,KAAK,SAAS,UAAU;AAC1B,YAAM,MAAM,OAAO,IAAI,QACpB,IAAI,KAAK,QAAQ,EACjB;AAAA,QACCA,QAAO;AAAA,UAAS,CAAC,QACf,UAAU,OAAO,IAAI,SAAS,iCAC1B,sBAAsB,6BAA6B,KAAK,QAAQ,GAAG,IACnE;AAAA,QACN;AAAA,MACF;AACF,UAAI,QAAQ,MAAM;AAChB,eAAO,OAAOA,QAAO;AAAA,UACnB,sBAAsB,6BAA6B,KAAK,QAAQ,GAAG;AAAA,QACrE;AAAA,MACF;AACA,cAAQ,KAAK,UAAU,IAAI,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,GAAG,KAAK;AAAA,IACpE,WAAW,KAAK,SAAS,UAAU;AAMjC,YAAM,cAAc,OAAO,IAAI,YAC5B,YAAY,KAAK,YAAY,EAC7B;AAAA,QACCA,QAAO;AAAA,UAAS,CAAC,QACf;AAAA,YACE,uCAAuC,KAAK,YAAY,MACtD,aAAa,MAAO,IAA4B,UAAU,OAAO,GAAG,CACtE;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACF,qBAAe,kBAAkB,WAAW;AAAA,IAC9C;AAEA,WAAO;AAAA,MACL,WAAW;AAAA,MACX,UAAU,GAAG;AAAA,MACb,iBAAiB,GAAG;AAAA,MACpB,aAAa;AAAA,MACb,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AAAA,MACrD;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAcA,IAAM,cAAc,MAClBA,QAAO,IAAI,aAAa;AACtB,QAAM,aAAa,OAAO,MAAM,KAAK;AACrC,QAAM,oBAAoB,oBAAI,IAA8D;AAC5F,QAAM,kBAAkB,OAAOC,aAAY,KAAK;AAAA,IAC9C,QAAQ,CAAC,QACPD,QAAO;AAAA,MACLA,QAAO,QAAQ,MAAM;AACnB,cAAM,YAAY,kBAAkB,IAAI,GAAG;AAC3C,YAAI,CAAC,WAAW;AACd,iBAAOA,QAAO;AAAA,YACZ,IAAI,mBAAmB;AAAA,cACrB,WAAW;AAAA,cACX,SAAS,iCAAiC,GAAG;AAAA,YAC/C,CAAC;AAAA,UACH;AAAA,QACF;AACA,eAAO;AAAA,MACT,CAAC;AAAA,MACD,CAAC,eAAeA,QAAO,QAAQ,MAAM,WAAW,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC,CAAC;AAAA,IACzE;AAAA,IACF,UAAU;AAAA,IACV,YAAY,SAAS,QAAQ,CAAC;AAAA,EAChC,CAAC,EAAE,KAAK,MAAM,QAAQ,UAAU,CAAC;AAEjC,SAAO,EAAE,iBAAiB,mBAAmB,WAAW;AAC1D,CAAC;AAmBH,IAAM,YAAY,CAAC,OAAuB,GAAG,iBAAiB,GAAG,EAAE;AAEnE,IAAM,eAAe,CAAC,SAAmE;AACvF,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,OAAQ,QAAO,EAAE,MAAM,OAAO;AAChD,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,QAAQ,UAAU,KAAK,QAAQ;AAAA,MAC/B,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,KAAK;AAAA,EACrB;AACF;AAEA,IAAM,mBAAmB,CACvB,WACA,YACA,WACiB;AACjB,MAAI,OAAO,cAAc,SAAS;AAChC,UAAME,SAA6B;AAAA,MACjC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,MAAM;AAAA,MACN,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ;AAAA,IACF;AACA,WAAOA;AAAA,EACT;AACA,QAAM,QAA8B;AAAA,IAClC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,MAAM;AAAA,IACN,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,aAAa,eAAe,OAAO,WAAW;AAAA,IAC9C,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,MAAM,aAAa,OAAO,IAAI;AAAA,EAChC;AACA,SAAO;AACT;AAEO,IAAM,YAAY,aAAa,CAAC,YAA+B;AACpE,QAAM,aAAa,SAAS,4BAA4B;AAIxD,QAAM,aAA6C,EAAE,SAAS,KAAK;AAEnE,QAAM,gBAAgB,MACpB,WAAW,UACPF,QAAO,QAAQ,WAAW,OAAO,IACjC,YAAY,EAAE;AAAA,IACZA,QAAO;AAAA,MAAI,CAAC,OACVA,QAAO,KAAK,MAAM;AAChB,mBAAW,UAAU;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AAEN,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,SAAS,CAAC,SAA0B,aAAa,IAAI;AAAA,IAErD,WAAW,CAAC,QAAQ;AAClB,YAAM,gBAAgB,CAAC,UACrBA,QAAO,IAAI,aAAa;AACtB,cAAM,WAAW,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC3D,cAAM,UAAU,SAAS,KAAK;AAC9B,YAAI,CAAC,SAAS;AACZ,iBAAO,OAAOA,QAAO,KAAK,sBAAsB,0BAA0B,CAAC;AAAA,QAC7E;AAEA,cAAM,OAAO,OAAOA,QAAO,IAAI;AAAA,UAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;AAAA,UAC5B,OAAO,MAAM;AAAA,QACf,CAAC,EAAE;AAAA,UACDA,QAAO,cAAc,MAAM,KAAK;AAAA,QAClC;AACA,cAAM,YAAY,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAE1D,cAAM,eACJ,OAAO,UAAU,WACb,SACA,OAAO,uBAAuB,MAAM,SAAS,GAAG;AACtD,cAAM,mBACJ,OAAO,UAAU,WACb,SACA,OAAO,uBAAuB,MAAM,aAAa,GAAG;AAE1D,cAAM,YAAY,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AAED,cAAM,SAAS,OAAO,cAAc,SAAS,EAAE;AAAA,UAC7CA,QAAO,IAAI,CAAC,OAAO,EAAE,IAAI,MAAe,UAAU,EAAE,EAAE;AAAA,UACtDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,UAAU,KAAK,CAAC,CAAC;AAAA,UACzEA,QAAO,SAAS,2BAA2B;AAAA,QAC7C;AAEA,YAAI,OAAO,MAAM,OAAO,UAAU;AAChC,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,eAAe;AAAA,YACf,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,YACtC;AAAA,YACA,WAAW,OAAO,SAAS,MAAM;AAAA,YACjC,YAAY,OAAO,SAAS,QAAQ,QAAQ;AAAA,UAC9C;AAAA,QACF;AAQA,cAAM,QAAQ,OAAO,sBAAsB,SAAS;AAAA,UAClD,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AACD,YAAI,MAAM,SAAS,OAAO;AACxB,iBAAO,OAAOA,QAAO;AAAA,YACnB;AAAA,cACE,MAAM,SAAS,YACX,8CAA8C,MAAM,MAAM,KAC1D,6BAA6B,MAAM,MAAM;AAAA,YAC/C;AAAA,UACF;AAAA,QACF;AAEA,cAAM,cAAc,OAAO,IAAI,MAC5B,MAAM;AAAA,UACL,UAAU;AAAA,UACV,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC,EACA;AAAA,UACCA,QAAO,IAAI,MAAM,IAAI;AAAA,UACrBA,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC;AAAA,UACxCA,QAAO,SAAS,wBAAwB;AAAA,QAC1C;AAEF,YAAI,aAAa;AACf,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,eAAe;AAAA,YACf;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,YAAY;AAAA,UACd;AAAA,QACF;AAEA,eAAO,OAAOA,QAAO;AAAA,UACnB,sBAAsB,+DAA+D;AAAA,QACvF;AAAA,MACF,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,gBAAgB,OAAO,UAAU,WAAW,QAAQ,MAAM,SAAS;AAAA,QACnF,CAAC;AAAA,MACH;AAEF,YAAM,aAAa,SAAS;AAE5B,YAAM,YAAY,CAAC,WACjBA,QAAO,IAAI,aAAa;AACtB,cAAM,YAAY,mBAAmB,MAAM;AAC3C,cAAM,KAAK,mBAAmB,MAAM;AASpC,cAAM,WAAW,OAAO,sBAAsB,IAAI,KAAK,UAAU,EAAE;AAAA,UACjEA,QAAO;AAAA,UACPA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,OAAO,UAAU,QAAQ,KAAK,GAAG,cAAc,SAAS;AAC1D,iBAAO,OAAOA,QAAO,KAAK,SAAS,OAAO;AAAA,QAC5C;AAMA,cAAM,YAIJ,OAAO,UAAU,QAAQ,IACrB,OAAO,cAAc,mBAAmB,SAAS,OAAO,CAAC,EAAE;AAAA,UACzDA,QAAO;AAAA,YAAS,CAAC,QACf,kBAAkB,yBAAyB,IAAI,OAAO,EAAE;AAAA,UAC1D;AAAA,UACAA,QAAO;AAAA,UACPA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH,IACA,OAAO,KAAK,SAAS,OAAO;AAClC,cAAM,WACJ,OAAO,UAAU,SAAS,IACtB,UAAU,UACV,EAAE,QAAQ,QAAW,OAAO,CAAC,EAAW;AAE9C,cAAM,aAAa,OAAO,QAAQ,SAAS,QAAQ,QAAQ;AAE3D,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AAItB,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,OAAO,KAAK;AACpE,mBAAO,IAAI,QAAQ,aAAa,WAAW,OAAO,KAAK;AAEvD,mBAAO,IAAI,QAAQ,UAAU;AAAA,cAC3B;AAAA,cACA,OAAO,OAAO;AAAA,cACd,MAAM;AAAA,cACN,QAAQ;AAAA,YACV,CAAC;AAED,mBAAO,IAAI,QAAQ;AAAA,cACjB;AAAA,cACA,OAAO;AAAA,cACP,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBACzB,QAAQ,GAAG,SAAS,IAAI,EAAE,MAAM;AAAA,gBAChC,SAAS,UAAU,CAAC;AAAA,cACtB,EAAE;AAAA,YACJ;AAEA,mBAAO,IAAI,KAAK,QAAQ,SAAS;AAAA,cAC/B,IAAI;AAAA,cACJ,OAAO,OAAO;AAAA,cACd,MAAM;AAAA,cACN,MAAM;AAAA,cACN,KAAK,GAAG,cAAc,WAAW,GAAG,WAAW;AAAA,cAC/C,WAAW;AAAA,cACX,YAAY;AAAA,cACZ,SAAS,GAAG,cAAc;AAAA,cAC1B,OAAO,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBAChC,MAAM,EAAE;AAAA,gBACR,aAAa,EAAE,eAAe,aAAa,EAAE,QAAQ;AAAA,gBACrD,aAAa,EAAE;AAAA,gBACf,cAAc,EAAE;AAAA,cAClB,EAAE;AAAA,YACJ,CAAC;AAAA,UACH,CAAC;AAAA,QACH,EACC;AAAA,UACCA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,yBAAyB,SAAS,MAAM;AAAA,YAC1C;AAAA,UACF,CAAC;AAAA,QACH;AAEF,YAAI,YAAY;AACd,iBAAO,WACJ,aAAa,iBAAiB,WAAW,YAAY,MAAM,CAAC,EAC5D,KAAKA,QAAO,SAAS,+BAA+B,CAAC;AAAA,QAC1D;AAEA,YAAI,OAAO,UAAU,SAAS,GAAG;AAC/B,iBAAO,OAAOA,QAAO,KAAK,UAAU,OAAO;AAAA,QAC7C;AACA,eAAO,EAAE,WAAW,SAAS,MAAM,QAAQ,UAAU;AAAA,MACvD,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY;AAAA,YACV,wBAAwB,OAAO;AAAA,YAC/B,mBAAmB,OAAO;AAAA,UAC5B;AAAA,QACF,CAAC;AAAA,MACH;AAEF,YAAM,eAAe,CAAC,WAAmB,UACvCA,QAAO,IAAI,aAAa;AACtB,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AACtB,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,KAAK;AAC7D,mBAAO,IAAI,QAAQ,aAAa,WAAW,KAAK;AAChD,mBAAO,IAAI,KAAK,QAAQ,WAAW,SAAS;AAAA,UAC9C,CAAC;AAAA,QACH,EACC,KAAKA,QAAO,SAAS,2BAA2B,CAAC;AACpD,YAAI,YAAY;AACd,iBAAO,WACJ,aAAa,SAAS,EACtB,KAAKA,QAAO,SAAS,+BAA+B,CAAC;AAAA,QAC1D;AAAA,MACF,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,4BAA4B;AAAA,UAC1C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,gBAAgB,CAAC,WAAmB,UACxCA,QAAO,IAAI,aAAa;AACtB,cAAM,KAAK,OAAO,IAAI,QAAQ,gBAAgB,WAAW,KAAK,EAAE;AAAA,UAC9DA,QAAO,SAAS,iCAAiC;AAAA,YAC/C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH;AACA,YAAI,CAAC,IAAI;AACP,iBAAO,OAAOA,QAAO;AAAA,YACnB,sBAAsB,oCAAoC,SAAS,GAAG;AAAA,UACxE;AAAA,QACF;AAEA,cAAM,KAAK,OAAO,sBAAsB,IAAI,KAAK,UAAU,EAAE;AAAA,UAC3DA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,WAAW,OAAO,cAAc,mBAAmB,EAAE,CAAC,EAAE;AAAA,UAC5DA,QAAO,SAAS,CAAC,QAAQ,kBAAkB,uBAAuB,IAAI,OAAO,EAAE,CAAC;AAAA,UAChFA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH;AAEA,cAAM,WAAW,OAAO,IAAI,QAAQ,UAAU,WAAW,KAAK;AAC9D,cAAM,aAAa,SAAS,QAAQ,QAAQ,UAAU,QAAQ;AAE9D,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AACtB,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,KAAK;AAC7D,mBAAO,IAAI,KAAK,QAAQ,WAAW,SAAS;AAE5C,mBAAO,IAAI,QAAQ;AAAA,cACjB;AAAA,cACA;AAAA,cACA,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBACzB,QAAQ,GAAG,SAAS,IAAI,EAAE,MAAM;AAAA,gBAChC,SAAS,UAAU,CAAC;AAAA,cACtB,EAAE;AAAA,YACJ;AACA,mBAAO,IAAI,KAAK,QAAQ,SAAS;AAAA,cAC/B,IAAI;AAAA,cACJ;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,cACN,KAAK,GAAG,cAAc,WAAW,GAAG,WAAW;AAAA,cAC/C,WAAW;AAAA,cACX,YAAY;AAAA,cACZ,SAAS,GAAG,cAAc;AAAA,cAC1B,OAAO,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBAChC,MAAM,EAAE;AAAA,gBACR,aAAa,EAAE,eAAe,aAAa,EAAE,QAAQ;AAAA,gBACrD,aAAa,EAAE;AAAA,gBACf,cAAc,EAAE;AAAA,cAClB,EAAE;AAAA,YACJ,CAAC;AAAA,UACH,CAAC;AAAA,QACH,EACC;AAAA,UACCA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,yBAAyB,SAAS,MAAM;AAAA,YAC1C;AAAA,UACF,CAAC;AAAA,QACH;AAEF,eAAO,EAAE,WAAW,SAAS,MAAM,OAAO;AAAA,MAC5C,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,eAAe,CAAC,WAAmB,OAAe,UACtDA,QAAO,IAAI,aAAa;AACtB,cAAM,WAAW,OAAO,IAAI,QAAQ,UAAU,WAAW,KAAK;AAC9D,YAAI,CAAC,YAAY,SAAS,OAAO,cAAc,SAAU;AAEzD,cAAM,SAAS,SAAS;AACxB,cAAM,gBAAqC;AAAA,UACzC,GAAG;AAAA,UACH,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,UACnE,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,UAChE,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,UACvD,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,QAC9E;AAEA,eAAO,IAAI,QAAQ,UAAU;AAAA,UAC3B;AAAA,UACA;AAAA,UACA,MAAM,MAAM,MAAM,KAAK,KAAK,SAAS;AAAA,UACrC,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,4BAA4B;AAAA,UAC1C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,YAAY,CAAC,WAAmB,UACpC,IAAI,QAAQ,UAAU,WAAW,KAAK,EAAE;AAAA,QACtCA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IAEA,YAAY,CAAC,EAAE,KAAK,SAAS,MAAM,OAAO,MACxCA,QAAO,IAAI,aAAa;AACtB,YAAM,UAAU,OAAO,cAAc;AAOrC,YAAM,YAAY,QAAQ;AAC1B,YAAM,QAAQ,OAAO,IAAI,QAAQ,WAAW,QAAQ,IAAI,SAAS,EAAE;AAAA,QACjEA,QAAO,SAAS,2BAA2B;AAAA,UACzC,YAAY,EAAE,iBAAiB,QAAQ,GAAG;AAAA,QAC5C,CAAC;AAAA,MACH;AACA,UAAI,CAAC,OAAO;AACV,eAAO,OAAOA,QAAO,KAAK,IAAI,MAAM,kCAAkC,QAAQ,EAAE,GAAG,CAAC;AAAA,MACtF;AAEA,YAAM,KAAK,OAAO,IAAI,QAAQ,gBAAgB,MAAM,WAAW,SAAS,EAAE;AAAA,QACxEA,QAAO,SAAS,iCAAiC;AAAA,UAC/C,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,QACxD,CAAC;AAAA,MACH;AACA,UAAI,CAAC,IAAI;AACP,eAAO,OAAOA,QAAO;AAAA,UACnB,IAAI,MAAM,uCAAuC,MAAM,SAAS,GAAG;AAAA,QACrE;AAAA,MACF;AAEA,aAAO,OAAO,cAAc;AAAA,QAC1B,QAAQ,QAAQ;AAAA,QAChB,UAAU,MAAM,QAAQ;AAAA,QACxB;AAAA,QACA,YAAY;AAAA,QACZ,cAAc,IAAI,OAAO,CAAC,EAAG;AAAA,QAC7B,kBAAkB,MAChB,sBAAsB,IAAI,KAAK,UAAU,EAAE;AAAA,UACzCA,QAAO,QAAQ,CAAC,OAAO,mBAAmB,EAAE,CAAC;AAAA,UAC7CA,QAAO;AAAA,YAAS,CAAC,QACf,eAAe,qBACX,MACA,IAAI,mBAAmB;AAAA,cACrB,WAAW;AAAA,cACX,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,YAC1D,CAAC;AAAA,UACP;AAAA,UACAA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB,MAAM;AAAA,cAC9B,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AAAA,QACF,iBAAiB,QAAQ;AAAA,QACzB,mBAAmB,QAAQ;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH,CAAC,EAAE;AAAA,MACDA,QAAO,SAAS,0BAA0B;AAAA,QACxC,YAAY;AAAA,UACV,iBAAiB,QAAQ;AAAA,UACzB,sBAAsB,QAAQ;AAAA,QAChC;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEF,QAAQ,CAAC,EAAE,KAAK,IAAI,MAClBA,QAAO,IAAI,aAAa;AACtB,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,SAAS,OAAOA,QAAO,IAAI;AAAA,QAC/B,KAAK,MAAM,IAAI,IAAI,OAAO;AAAA,QAC1B,OAAO,CAAC,UAAU;AAAA,MACpB,CAAC,EAAE,KAAKA,QAAO,MAAM;AACrB,UAAI,OAAO,SAAS,OAAQ,QAAO;AAEnC,YAAM,OAAO,OAAO,MAAM,YAAY;AACtC,YAAM,YAAY,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAE1D,YAAM,YAAY,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,YAAY,OAAO,cAAc,SAAS,EAAE;AAAA,QAChDA,QAAO,IAAI,MAAM,IAAI;AAAA,QACrBA,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC;AAAA,QACxCA,QAAO,SAAS,2BAA2B;AAAA,MAC7C;AAEA,UAAI,WAAW;AACb,eAAO,IAAI,sBAAsB;AAAA,UAC/B,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAIA,YAAM,QAAQ,OAAO,sBAAsB,OAAO;AAClD,UAAI,MAAM,SAAS,MAAO,QAAO;AAOjC,YAAM,UAAU,OAAO,IAAI,MAAM,MAAM,EAAE,UAAU,QAAQ,CAAC,EAAE;AAAA,QAC5DA,QAAO,IAAI,MAAM,IAAI;AAAA,QACrBA,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC;AAAA,QACxCA,QAAO,SAAS,wBAAwB;AAAA,MAC1C;AACA,UAAI,CAAC,QAAS,QAAO;AAErB,aAAO,IAAI,sBAAsB;AAAA,QAC/B,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU;AAAA,QACV;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,CAAC,EAAE;AAAA,MACDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,IAAI,CAAC;AAAA,MACvCA,QAAO,SAAS,qBAAqB;AAAA,QACnC,YAAY,EAAE,gBAAgB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOF,oBAAoB,CAAC,EAAE,KAAK,UAAU,SAAS,MAC7CA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;AAC1D,YAAM,UAAU,OAAOA,QAAO;AAAA,QAC5B,CAAC,GAAG,MAAM;AAAA,QACV,CAAC,UACCA,QAAO,IAAI,aAAa;AACtB,gBAAM,OAAO,OAAO,IAAI,QAAQ,qBAAqB,UAAU,KAAK;AACpE,gBAAM,OAAO,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC3D,iBAAO,CAAC,OAAO,IAAI;AAAA,QACrB,CAAC;AAAA,QACH,EAAE,aAAa,YAAY;AAAA,MAC7B;AACA,YAAM,UAAU,IAAI,IAAI,OAAO;AAE/B,YAAM,MAAuC,CAAC;AAC9C,iBAAW,OAAO,UAAU;AAC1B,cAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ,GAAG,IAAI,IAAI,EAAE;AACrD,cAAM,MAAM,SAAS;AACrB,YAAI,KAAK,oBAAoB,MAAM;AACjC,cAAI,IAAI,EAAE,IAAI;AAAA,YACZ,kBAAkB;AAAA,YAClB,qBAAqB,IAAI,SAAS,SAAS,YAAY,IAAI;AAAA,UAC7D;AAAA,QACF,OAAO;AACL,cAAI,IAAI,EAAE,IAAI,EAAE,kBAAkB,MAAM;AAAA,QAC1C;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,cAAc,CAAC,EAAE,KAAK,UAAU,MAAM,MACpCA,QAAO,IAAI,aAAa;AACtB,aAAO,IAAI,QAAQ,0BAA0B,UAAU,KAAK;AAC5D,aAAO,IAAI,QAAQ,aAAa,UAAU,KAAK;AAAA,IACjD,CAAC;AAAA,IAEH,eAAe,MAAMA,QAAO;AAAA;AAAA;AAAA;AAAA,IAM5B,OAAO,MACLA,QAAO,IAAI,aAAa;AACtB,YAAM,UAAU,WAAW;AAC3B,UAAI,SAAS;AACX,gBAAQ,kBAAkB,MAAM;AAChC,eAAOC,aAAY,cAAc,QAAQ,eAAe;AACxD,eAAO,MAAM,MAAM,QAAQ,YAAYE,MAAK,IAAI;AAChD,mBAAW,UAAU;AAAA,MACvB;AAAA,IACF,CAAC,EAAE,KAAKH,QAAO,SAAS,kBAAkB,CAAC;AAAA;AAAA;AAAA;AAAA,IAK7C,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,kBAAkB;AAAA,EACpB;AACF,CAAC;","names":["Effect","Schema","Schema","Effect","Effect","Exit","ScopedCache","Schema","SecretBackedMap","Schema","Schema","Schema","Schema","StringMap","SecretBackedMap","Effect","p","Effect","Effect","Effect","Effect","Schema","Schema","Effect","Effect","Schema","Schema","Effect","Effect","Effect","ScopedCache","entry","Exit"]}