@executor-js/plugin-mcp 1.4.27 → 1.4.29

package/dist/{EditMcpSource-CWN6HIC4.js → EditMcpSource-FAWEECNU.js}

@@ -202,7 +202,7 @@ function StdioReadOnly(props) {
   return /* @__PURE__ */ jsxs("div", { className: "space-y-6", children: [
     /* @__PURE__ */ jsxs("div", { children: [
       /* @__PURE__ */ jsx("h1", { className: "text-xl font-semibold text-foreground", children: "Edit MCP Source" }),
-      /* @__PURE__ */ jsx("p", { className: "mt-1 text-sm text-muted-foreground", children: "Stdio MCP sources cannot be edited in the UI. Modify the executor.jsonc config file directly." })
+      /* @__PURE__ */ jsx("p", { className: "mt-1 text-sm text-muted-foreground", children: "Stdio MCP sources cannot be edited in the UI. Remove and recreate the source with the updated command." })
     ] }),
     /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-3 rounded-lg border border-border bg-card px-4 py-3", children: [
       /* @__PURE__ */ jsxs("div", { className: "min-w-0 flex-1", children: [
@@ -256,4 +256,4 @@ function EditMcpSource({
 export {
   EditMcpSource as default
 };
-//# sourceMappingURL=EditMcpSource-CWN6HIC4.js.map
+//# sourceMappingURL=EditMcpSource-FAWEECNU.js.map

package/dist/{EditMcpSource-CWN6HIC4.js.map → EditMcpSource-FAWEECNU.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/react/EditMcpSource.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport { useAtomValue, useAtomSet } from \"@effect/atom-react\";\nimport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\nimport * as Exit from \"effect/Exit\";\nimport {\n  mcpSourceAtom,\n  mcpSourceBindingsAtom,\n  setMcpSourceBinding,\n  updateMcpSource,\n} from \"./atoms\";\nimport { connectionsAtom } from \"@executor-js/react/api/atoms\";\nimport { useScope, useScopeStack } from \"@executor-js/react/api/scope-context\";\nimport { connectionWriteKeys, sourceWriteKeys } from \"@executor-js/react/api/reactivity-keys\";\nimport { slugifyNamespace, useSourceIdentity } from \"@executor-js/react/plugins/source-identity\";\nimport { useCredentialTargetScope } from \"@executor-js/react/plugins/credential-target-scope\";\nimport { useSecretPickerSecrets } from \"@executor-js/react/plugins/use-secret-picker-secrets\";\nimport {\n  HttpCredentialsEditor,\n  serializeHttpCredentials,\n  serializeScopedHttpCredentials,\n  type HttpCredentialsState,\n} from \"@executor-js/react/plugins/http-credentials\";\nimport {\n  effectiveCredentialBindingForScope,\n  httpCredentialsFromConfiguredCredentialBindings,\n  initialCredentialTargetScope,\n} from \"@executor-js/react/plugins/credential-bindings\";\nimport { SourceOAuthConnectionControl } from \"@executor-js/react/plugins/source-oauth-connection\";\nimport { Button } from \"@executor-js/react/components/button\";\nimport { Badge } from \"@executor-js/react/components/badge\";\nimport { ScopeId } from \"@executor-js/sdk/core\";\nimport { McpRemoteSourceFields } from \"./McpRemoteSourceFields\";\nimport {\n  McpSourceBindingInput,\n  type McpCredentialInput,\n  type McpSourceBindingRef,\n} from \"../sdk/types\";\nimport type { McpStoredSourceSchemaType } from \"../sdk/stored-source\";\n\n// ---------------------------------------------------------------------------\n// Remote edit form\n// ---------------------------------------------------------------------------\n\nfunction RemoteEditForm(props: {\n  sourceId: string;\n  initial: McpStoredSourceSchemaType & { config: { transport: \"remote\" } };\n  bindings: readonly McpSourceBindingRef[];\n  onSave: () => void;\n}) {\n  const displayScope = useScope();\n  const scopeStack = useScopeStack();\n  const sourceScope = ScopeId.make(props.initial.scope);\n  const { credentialTargetScope, credentialScopeOptions } = useCredentialTargetScope({\n    sourceScope,\n    initialTargetScope: initialCredentialTargetScope(sourceScope, props.bindings),\n  });\n  const {\n    credentialTargetScope: oauthCredentialTargetScope,\n    setCredentialTargetScope: setOAuthCredentialTargetScope,\n  } = useCredentialTargetScope({\n    sourceScope,\n    initialTargetScope: initialCredentialTargetScope(sourceScope, props.bindings),\n  });\n  const doUpdate = useAtomSet(updateMcpSource, { mode: \"promiseExit\" });\n  const setBinding = useAtomSet(setMcpSourceBinding, { mode: \"promise\" });\n  const secretList = useSecretPickerSecrets();\n  const connectionsResult = useAtomValue(connectionsAtom(displayScope));\n\n  const identity = useSourceIdentity({\n    fallbackName: props.initial.name,\n    fallbackNamespace: props.initial.namespace,\n  });\n  const [endpoint, setEndpoint] = useState(props.initial.config.endpoint);\n  const [credentials, setCredentials] = useState<HttpCredentialsState>(() =>\n    httpCredentialsFromConfiguredCredentialBindings({\n      headers: props.initial.config.headers,\n      queryParams: props.initial.config.queryParams,\n      bindings: props.bindings,\n    }),\n  );\n  const [saving, setSaving] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [credentialsDirty, setCredentialsDirty] = useState(false);\n\n  const identityDirty = identity.name.trim() !== props.initial.name.trim();\n  const metadataDirty = identityDirty || endpoint.trim() !== props.initial.config.endpoint.trim();\n  const dirty = metadataDirty || credentialsDirty;\n  const oauth2 = props.initial.config.auth.kind === \"oauth2\" ? props.initial.config.auth : null;\n  const connections = AsyncResult.isSuccess(connectionsResult) ? connectionsResult.value : [];\n  const scopeRanks = new Map(scopeStack.map((scope, index) => [scope.id, index] as const));\n  const connectionBinding = oauth2\n    ? effectiveCredentialBindingForScope(\n        props.bindings,\n        oauth2.connectionSlot,\n        oauthCredentialTargetScope,\n        scopeRanks,\n      )\n    : null;\n  const boundConnectionId =\n    connectionBinding?.value.kind === \"connection\" ? connectionBinding.value.connectionId : null;\n  const isConnected =\n    boundConnectionId !== null &&\n    connections.some((connection) => connection.id === boundConnectionId);\n  const oauthRequestCredentials = serializeHttpCredentials(credentials);\n\n  const handleCredentialsChange = (next: HttpCredentialsState) => {\n    setCredentials(next);\n    setCredentialsDirty(true);\n  };\n\n  const handleSave = async () => {\n    setSaving(true);\n    setError(null);\n    const { headers, queryParams } = serializeScopedHttpCredentials(\n      credentials,\n      credentialTargetScope,\n    );\n    const payload: {\n      sourceScope: ScopeId;\n      name?: string;\n      endpoint?: string;\n      headers?: Record<string, McpCredentialInput>;\n      queryParams?: Record<string, McpCredentialInput>;\n      credentialTargetScope?: ScopeId;\n    } = {\n      sourceScope,\n      name: metadataDirty ? identity.name.trim() || undefined : undefined,\n      endpoint: metadataDirty ? endpoint.trim() || undefined : undefined,\n    };\n    if (credentialsDirty) {\n      payload.headers = headers;\n      payload.queryParams = queryParams as Record<string, McpCredentialInput>;\n      payload.credentialTargetScope = credentialTargetScope;\n    }\n    const exit = await doUpdate({\n      params: { scopeId: displayScope, namespace: props.sourceId },\n      payload,\n      reactivityKeys: sourceWriteKeys,\n    });\n    if (Exit.isFailure(exit)) {\n      setError(\"Failed to update source\");\n      setSaving(false);\n      return;\n    }\n    setCredentialsDirty(false);\n    setSaving(false);\n    props.onSave();\n  };\n\n  return (\n    <div className=\"space-y-6\">\n      <div>\n        <h1 className=\"text-xl font-semibold text-foreground\">Edit MCP Source</h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          Update the endpoint and headers for this MCP connection.\n        </p>\n      </div>\n\n      <div className=\"flex items-center gap-3 rounded-lg border border-border bg-card px-4 py-3\">\n        <div className=\"min-w-0 flex-1\">\n          <p className=\"truncate text-sm font-semibold text-card-foreground\">{props.sourceId}</p>\n        </div>\n        <Badge variant=\"secondary\" className=\"text-xs\">\n          remote\n        </Badge>\n      </div>\n\n      <McpRemoteSourceFields\n        url={endpoint}\n        onUrlChange={setEndpoint}\n        identity={identity}\n        preview={{\n          name: props.initial.name,\n          serverName: props.initial.name,\n          connected: true,\n          toolCount: null,\n        }}\n        namespaceReadOnly\n      />\n\n      <HttpCredentialsEditor\n        credentials={credentials}\n        onChange={handleCredentialsChange}\n        existingSecrets={secretList}\n        sourceName={identity.name}\n        targetScope={credentialTargetScope}\n        credentialScopeOptions={credentialScopeOptions}\n        bindingScopeOptions={credentialScopeOptions}\n      />\n\n      {oauth2 && (\n        <SourceOAuthConnectionControl\n          popupName=\"mcp-oauth\"\n          pluginId=\"mcp\"\n          namespace={slugifyNamespace(props.initial.namespace) || \"mcp\"}\n          fallbackNamespace=\"mcp\"\n          endpoint={endpoint.trim()}\n          tokenScope={oauthCredentialTargetScope}\n          onTokenScopeChange={setOAuthCredentialTargetScope}\n          credentialScopeOptions={credentialScopeOptions}\n          connectionId={boundConnectionId}\n          sourceLabel={`${identity.name.trim() || props.initial.namespace || \"MCP\"} OAuth`}\n          headers={oauthRequestCredentials.headers}\n          queryParams={oauthRequestCredentials.queryParams}\n          isConnected={isConnected}\n          onConnected={async (connectionId) => {\n            await setBinding({\n              params: { scopeId: oauthCredentialTargetScope },\n              payload: McpSourceBindingInput.make({\n                sourceId: props.sourceId,\n                sourceScope,\n                scope: oauthCredentialTargetScope,\n                slot: oauth2.connectionSlot,\n                value: { kind: \"connection\", connectionId },\n              }),\n              reactivityKeys: [...sourceWriteKeys, ...connectionWriteKeys],\n            });\n          }}\n          reconnectingLabel=\"Reconnecting…\"\n          signingInLabel=\"Signing in…\"\n        />\n      )}\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/30 bg-destructive/5 px-3 py-2\">\n          <p className=\"text-sm text-destructive\">{error}</p>\n        </div>\n      )}\n\n      <div className=\"flex items-center justify-between border-t border-border pt-4\">\n        <Button variant=\"ghost\" onClick={props.onSave}>\n          Cancel\n        </Button>\n        <Button onClick={handleSave} disabled={!dirty || saving}>\n          {saving ? \"Saving…\" : \"Save changes\"}\n        </Button>\n      </div>\n    </div>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Stdio read-only view\n// ---------------------------------------------------------------------------\n\nfunction StdioReadOnly(props: {\n  sourceId: string;\n  initial: McpStoredSourceSchemaType & { config: { transport: \"stdio\" } };\n  onSave: () => void;\n}) {\n  const { command, args } = props.initial.config;\n  return (\n    <div className=\"space-y-6\">\n      <div>\n        <h1 className=\"text-xl font-semibold text-foreground\">Edit MCP Source</h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          Stdio MCP sources cannot be edited in the UI. Modify the executor.jsonc config file\n          directly.\n        </p>\n      </div>\n\n      <div className=\"flex items-center gap-3 rounded-lg border border-border bg-card px-4 py-3\">\n        <div className=\"min-w-0 flex-1\">\n          <p className=\"truncate text-sm font-semibold text-card-foreground\">{props.sourceId}</p>\n          <p className=\"mt-0.5 text-xs text-muted-foreground font-mono\">\n            {command} {(args ?? []).join(\" \")}\n          </p>\n        </div>\n        <Badge variant=\"secondary\" className=\"text-xs\">\n          stdio\n        </Badge>\n      </div>\n\n      <div className=\"flex items-center justify-end border-t border-border pt-4\">\n        <Button onClick={props.onSave}>Done</Button>\n      </div>\n    </div>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Main component\n// ---------------------------------------------------------------------------\n\nexport default function EditMcpSource({\n  sourceId,\n  onSave,\n}: {\n  readonly sourceId: string;\n  readonly onSave: () => void;\n}) {\n  const scopeId = useScope();\n  const sourceResult = useAtomValue(mcpSourceAtom(scopeId, sourceId)) as AsyncResult.AsyncResult<\n    McpStoredSourceSchemaType | null,\n    unknown\n  >;\n  const source =\n    AsyncResult.isSuccess(sourceResult) && sourceResult.value ? sourceResult.value : null;\n  const sourceScope = source ? ScopeId.make(source.scope) : scopeId;\n  const bindingsResult = useAtomValue(mcpSourceBindingsAtom(scopeId, sourceId, sourceScope));\n\n  if (!AsyncResult.isSuccess(sourceResult) || !source || !AsyncResult.isSuccess(bindingsResult)) {\n    return (\n      <div className=\"space-y-6\">\n        <div>\n          <h1 className=\"text-xl font-semibold text-foreground\">Edit MCP Source</h1>\n          <p className=\"mt-1 text-sm text-muted-foreground\">Loading configuration…</p>\n        </div>\n      </div>\n    );\n  }\n\n  if (source.config.transport === \"stdio\") {\n    return (\n      <StdioReadOnly\n        sourceId={sourceId}\n        initial={source as McpStoredSourceSchemaType & { config: { transport: \"stdio\" } }}\n        onSave={onSave}\n      />\n    );\n  }\n\n  return (\n    <RemoteEditForm\n      sourceId={sourceId}\n      initial={source as McpStoredSourceSchemaType & { config: { transport: \"remote\" } }}\n      bindings={bindingsResult.value}\n      onSave={onSave}\n    />\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,cAAc,kBAAkB;AACzC,YAAY,iBAAiB;AAC7B,YAAY,UAAU;AAOtB,SAAS,uBAAuB;AAChC,SAAS,UAAU,qBAAqB;AACxC,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,kBAAkB,yBAAyB;AACpD,SAAS,gCAAgC;AACzC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,eAAe;AAyHlB,SACE,KADF;AA5GN,SAAS,eAAe,OAKrB;AACD,QAAM,eAAe,SAAS;AAC9B,QAAM,aAAa,cAAc;AACjC,QAAM,cAAc,QAAQ,KAAK,MAAM,QAAQ,KAAK;AACpD,QAAM,EAAE,uBAAuB,uBAAuB,IAAI,yBAAyB;AAAA,IACjF;AAAA,IACA,oBAAoB,6BAA6B,aAAa,MAAM,QAAQ;AAAA,EAC9E,CAAC;AACD,QAAM;AAAA,IACJ,uBAAuB;AAAA,IACvB,0BAA0B;AAAA,EAC5B,IAAI,yBAAyB;AAAA,IAC3B;AAAA,IACA,oBAAoB,6BAA6B,aAAa,MAAM,QAAQ;AAAA,EAC9E,CAAC;AACD,QAAM,WAAW,WAAW,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACpE,QAAM,aAAa,WAAW,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtE,QAAM,aAAa,uBAAuB;AAC1C,QAAM,oBAAoB,aAAa,gBAAgB,YAAY,CAAC;AAEpE,QAAM,WAAW,kBAAkB;AAAA,IACjC,cAAc,MAAM,QAAQ;AAAA,IAC5B,mBAAmB,MAAM,QAAQ;AAAA,EACnC,CAAC;AACD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,MAAM,QAAQ,OAAO,QAAQ;AACtE,QAAM,CAAC,aAAa,cAAc,IAAI;AAAA,IAA+B,MACnE,gDAAgD;AAAA,MAC9C,SAAS,MAAM,QAAQ,OAAO;AAAA,MAC9B,aAAa,MAAM,QAAQ,OAAO;AAAA,MAClC,UAAU,MAAM;AAAA,IAClB,CAAC;AAAA,EACH;AACA,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,SAAS,KAAK;AAE9D,QAAM,gBAAgB,SAAS,KAAK,KAAK,MAAM,MAAM,QAAQ,KAAK,KAAK;AACvE,QAAM,gBAAgB,iBAAiB,SAAS,KAAK,MAAM,MAAM,QAAQ,OAAO,SAAS,KAAK;AAC9F,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,SAAS,WAAW,MAAM,QAAQ,OAAO,OAAO;AACzF,QAAM,cAA0B,sBAAU,iBAAiB,IAAI,kBAAkB,QAAQ,CAAC;AAC1F,QAAM,aAAa,IAAI,IAAI,WAAW,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAU,CAAC;AACvF,QAAM,oBAAoB,SACtB;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF,IACA;AACJ,QAAM,oBACJ,mBAAmB,MAAM,SAAS,eAAe,kBAAkB,MAAM,eAAe;AAC1F,QAAM,cACJ,sBAAsB,QACtB,YAAY,KAAK,CAAC,eAAe,WAAW,OAAO,iBAAiB;AACtE,QAAM,0BAA0B,yBAAyB,WAAW;AAEpE,QAAM,0BAA0B,CAAC,SAA+B;AAC9D,mBAAe,IAAI;AACnB,wBAAoB,IAAI;AAAA,EAC1B;AAEA,QAAM,aAAa,YAAY;AAC7B,cAAU,IAAI;AACd,aAAS,IAAI;AACb,UAAM,EAAE,SAAS,YAAY,IAAI;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AACA,UAAM,UAOF;AAAA,MACF;AAAA,MACA,MAAM,gBAAgB,SAAS,KAAK,KAAK,KAAK,SAAY;AAAA,MAC1D,UAAU,gBAAgB,SAAS,KAAK,KAAK,SAAY;AAAA,IAC3D;AACA,QAAI,kBAAkB;AACpB,cAAQ,UAAU;AAClB,cAAQ,cAAc;AACtB,cAAQ,wBAAwB;AAAA,IAClC;AACA,UAAM,OAAO,MAAM,SAAS;AAAA,MAC1B,QAAQ,EAAE,SAAS,cAAc,WAAW,MAAM,SAAS;AAAA,MAC3D;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAS,eAAU,IAAI,GAAG;AACxB,eAAS,yBAAyB;AAClC,gBAAU,KAAK;AACf;AAAA,IACF;AACA,wBAAoB,KAAK;AACzB,cAAU,KAAK;AACf,UAAM,OAAO;AAAA,EACf;AAEA,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,yBAAC,SACC;AAAA,0BAAC,QAAG,WAAU,yCAAwC,6BAAe;AAAA,MACrE,oBAAC,OAAE,WAAU,sCAAqC,sEAElD;AAAA,OACF;AAAA,IAEA,qBAAC,SAAI,WAAU,6EACb;AAAA,0BAAC,SAAI,WAAU,kBACb,8BAAC,OAAE,WAAU,uDAAuD,gBAAM,UAAS,GACrF;AAAA,MACA,oBAAC,SAAM,SAAQ,aAAY,WAAU,WAAU,oBAE/C;AAAA,OACF;AAAA,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,aAAa;AAAA,QACb;AAAA,QACA,SAAS;AAAA,UACP,MAAM,MAAM,QAAQ;AAAA,UACpB,YAAY,MAAM,QAAQ;AAAA,UAC1B,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AAAA,QACA,mBAAiB;AAAA;AAAA,IACnB;AAAA,IAEA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,aAAa;AAAA,QACb;AAAA,QACA,qBAAqB;AAAA;AAAA,IACvB;AAAA,IAEC,UACC;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QACV,UAAS;AAAA,QACT,WAAW,iBAAiB,MAAM,QAAQ,SAAS,KAAK;AAAA,QACxD,mBAAkB;AAAA,QAClB,UAAU,SAAS,KAAK;AAAA,QACxB,YAAY;AAAA,QACZ,oBAAoB;AAAA,QACpB;AAAA,QACA,cAAc;AAAA,QACd,aAAa,GAAG,SAAS,KAAK,KAAK,KAAK,MAAM,QAAQ,aAAa,KAAK;AAAA,QACxE,SAAS,wBAAwB;AAAA,QACjC,aAAa,wBAAwB;AAAA,QACrC;AAAA,QACA,aAAa,OAAO,iBAAiB;AACnC,gBAAM,WAAW;AAAA,YACf,QAAQ,EAAE,SAAS,2BAA2B;AAAA,YAC9C,SAAS,sBAAsB,KAAK;AAAA,cAClC,UAAU,MAAM;AAAA,cAChB;AAAA,cACA,OAAO;AAAA,cACP,MAAM,OAAO;AAAA,cACb,OAAO,EAAE,MAAM,cAAc,aAAa;AAAA,YAC5C,CAAC;AAAA,YACD,gBAAgB,CAAC,GAAG,iBAAiB,GAAG,mBAAmB;AAAA,UAC7D,CAAC;AAAA,QACH;AAAA,QACA,mBAAkB;AAAA,QAClB,gBAAe;AAAA;AAAA,IACjB;AAAA,IAGD,SACC,oBAAC,SAAI,WAAU,sEACb,8BAAC,OAAE,WAAU,4BAA4B,iBAAM,GACjD;AAAA,IAGF,qBAAC,SAAI,WAAU,iEACb;AAAA,0BAAC,UAAO,SAAQ,SAAQ,SAAS,MAAM,QAAQ,oBAE/C;AAAA,MACA,oBAAC,UAAO,SAAS,YAAY,UAAU,CAAC,SAAS,QAC9C,mBAAS,iBAAY,gBACxB;AAAA,OACF;AAAA,KACF;AAEJ;AAMA,SAAS,cAAc,OAIpB;AACD,QAAM,EAAE,SAAS,KAAK,IAAI,MAAM,QAAQ;AACxC,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,yBAAC,SACC;AAAA,0BAAC,QAAG,WAAU,yCAAwC,6BAAe;AAAA,MACrE,oBAAC,OAAE,WAAU,sCAAqC,2GAGlD;AAAA,OACF;AAAA,IAEA,qBAAC,SAAI,WAAU,6EACb;AAAA,2BAAC,SAAI,WAAU,kBACb;AAAA,4BAAC,OAAE,WAAU,uDAAuD,gBAAM,UAAS;AAAA,QACnF,qBAAC,OAAE,WAAU,kDACV;AAAA;AAAA,UAAQ;AAAA,WAAG,QAAQ,CAAC,GAAG,KAAK,GAAG;AAAA,WAClC;AAAA,SACF;AAAA,MACA,oBAAC,SAAM,SAAQ,aAAY,WAAU,WAAU,mBAE/C;AAAA,OACF;AAAA,IAEA,oBAAC,SAAI,WAAU,6DACb,8BAAC,UAAO,SAAS,MAAM,QAAQ,kBAAI,GACrC;AAAA,KACF;AAEJ;AAMe,SAAR,cAA+B;AAAA,EACpC;AAAA,EACA;AACF,GAGG;AACD,QAAM,UAAU,SAAS;AACzB,QAAM,eAAe,aAAa,cAAc,SAAS,QAAQ,CAAC;AAIlE,QAAM,SACQ,sBAAU,YAAY,KAAK,aAAa,QAAQ,aAAa,QAAQ;AACnF,QAAM,cAAc,SAAS,QAAQ,KAAK,OAAO,KAAK,IAAI;AAC1D,QAAM,iBAAiB,aAAa,sBAAsB,SAAS,UAAU,WAAW,CAAC;AAEzF,MAAI,CAAa,sBAAU,YAAY,KAAK,CAAC,UAAU,CAAa,sBAAU,cAAc,GAAG;AAC7F,WACE,oBAAC,SAAI,WAAU,aACb,+BAAC,SACC;AAAA,0BAAC,QAAG,WAAU,yCAAwC,6BAAe;AAAA,MACrE,oBAAC,OAAE,WAAU,sCAAqC,yCAAsB;AAAA,OAC1E,GACF;AAAA,EAEJ;AAEA,MAAI,OAAO,OAAO,cAAc,SAAS;AACvC,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,SAAS;AAAA,QACT;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,SAAS;AAAA,MACT,UAAU,eAAe;AAAA,MACzB;AAAA;AAAA,EACF;AAEJ;","names":[]}
+{"version":3,"sources":["../src/react/EditMcpSource.tsx"],"sourcesContent":["import { useState } from \"react\";\nimport { useAtomValue, useAtomSet } from \"@effect/atom-react\";\nimport * as AsyncResult from \"effect/unstable/reactivity/AsyncResult\";\nimport * as Exit from \"effect/Exit\";\nimport {\n  mcpSourceAtom,\n  mcpSourceBindingsAtom,\n  setMcpSourceBinding,\n  updateMcpSource,\n} from \"./atoms\";\nimport { connectionsAtom } from \"@executor-js/react/api/atoms\";\nimport { useScope, useScopeStack } from \"@executor-js/react/api/scope-context\";\nimport { connectionWriteKeys, sourceWriteKeys } from \"@executor-js/react/api/reactivity-keys\";\nimport { slugifyNamespace, useSourceIdentity } from \"@executor-js/react/plugins/source-identity\";\nimport { useCredentialTargetScope } from \"@executor-js/react/plugins/credential-target-scope\";\nimport { useSecretPickerSecrets } from \"@executor-js/react/plugins/use-secret-picker-secrets\";\nimport {\n  HttpCredentialsEditor,\n  serializeHttpCredentials,\n  serializeScopedHttpCredentials,\n  type HttpCredentialsState,\n} from \"@executor-js/react/plugins/http-credentials\";\nimport {\n  effectiveCredentialBindingForScope,\n  httpCredentialsFromConfiguredCredentialBindings,\n  initialCredentialTargetScope,\n} from \"@executor-js/react/plugins/credential-bindings\";\nimport { SourceOAuthConnectionControl } from \"@executor-js/react/plugins/source-oauth-connection\";\nimport { Button } from \"@executor-js/react/components/button\";\nimport { Badge } from \"@executor-js/react/components/badge\";\nimport { ScopeId } from \"@executor-js/sdk/core\";\nimport { McpRemoteSourceFields } from \"./McpRemoteSourceFields\";\nimport {\n  McpSourceBindingInput,\n  type McpCredentialInput,\n  type McpSourceBindingRef,\n} from \"../sdk/types\";\nimport type { McpStoredSourceSchemaType } from \"../sdk/stored-source\";\n\n// ---------------------------------------------------------------------------\n// Remote edit form\n// ---------------------------------------------------------------------------\n\nfunction RemoteEditForm(props: {\n  sourceId: string;\n  initial: McpStoredSourceSchemaType & { config: { transport: \"remote\" } };\n  bindings: readonly McpSourceBindingRef[];\n  onSave: () => void;\n}) {\n  const displayScope = useScope();\n  const scopeStack = useScopeStack();\n  const sourceScope = ScopeId.make(props.initial.scope);\n  const { credentialTargetScope, credentialScopeOptions } = useCredentialTargetScope({\n    sourceScope,\n    initialTargetScope: initialCredentialTargetScope(sourceScope, props.bindings),\n  });\n  const {\n    credentialTargetScope: oauthCredentialTargetScope,\n    setCredentialTargetScope: setOAuthCredentialTargetScope,\n  } = useCredentialTargetScope({\n    sourceScope,\n    initialTargetScope: initialCredentialTargetScope(sourceScope, props.bindings),\n  });\n  const doUpdate = useAtomSet(updateMcpSource, { mode: \"promiseExit\" });\n  const setBinding = useAtomSet(setMcpSourceBinding, { mode: \"promise\" });\n  const secretList = useSecretPickerSecrets();\n  const connectionsResult = useAtomValue(connectionsAtom(displayScope));\n\n  const identity = useSourceIdentity({\n    fallbackName: props.initial.name,\n    fallbackNamespace: props.initial.namespace,\n  });\n  const [endpoint, setEndpoint] = useState(props.initial.config.endpoint);\n  const [credentials, setCredentials] = useState<HttpCredentialsState>(() =>\n    httpCredentialsFromConfiguredCredentialBindings({\n      headers: props.initial.config.headers,\n      queryParams: props.initial.config.queryParams,\n      bindings: props.bindings,\n    }),\n  );\n  const [saving, setSaving] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [credentialsDirty, setCredentialsDirty] = useState(false);\n\n  const identityDirty = identity.name.trim() !== props.initial.name.trim();\n  const metadataDirty = identityDirty || endpoint.trim() !== props.initial.config.endpoint.trim();\n  const dirty = metadataDirty || credentialsDirty;\n  const oauth2 = props.initial.config.auth.kind === \"oauth2\" ? props.initial.config.auth : null;\n  const connections = AsyncResult.isSuccess(connectionsResult) ? connectionsResult.value : [];\n  const scopeRanks = new Map(scopeStack.map((scope, index) => [scope.id, index] as const));\n  const connectionBinding = oauth2\n    ? effectiveCredentialBindingForScope(\n        props.bindings,\n        oauth2.connectionSlot,\n        oauthCredentialTargetScope,\n        scopeRanks,\n      )\n    : null;\n  const boundConnectionId =\n    connectionBinding?.value.kind === \"connection\" ? connectionBinding.value.connectionId : null;\n  const isConnected =\n    boundConnectionId !== null &&\n    connections.some((connection) => connection.id === boundConnectionId);\n  const oauthRequestCredentials = serializeHttpCredentials(credentials);\n\n  const handleCredentialsChange = (next: HttpCredentialsState) => {\n    setCredentials(next);\n    setCredentialsDirty(true);\n  };\n\n  const handleSave = async () => {\n    setSaving(true);\n    setError(null);\n    const { headers, queryParams } = serializeScopedHttpCredentials(\n      credentials,\n      credentialTargetScope,\n    );\n    const payload: {\n      sourceScope: ScopeId;\n      name?: string;\n      endpoint?: string;\n      headers?: Record<string, McpCredentialInput>;\n      queryParams?: Record<string, McpCredentialInput>;\n      credentialTargetScope?: ScopeId;\n    } = {\n      sourceScope,\n      name: metadataDirty ? identity.name.trim() || undefined : undefined,\n      endpoint: metadataDirty ? endpoint.trim() || undefined : undefined,\n    };\n    if (credentialsDirty) {\n      payload.headers = headers;\n      payload.queryParams = queryParams as Record<string, McpCredentialInput>;\n      payload.credentialTargetScope = credentialTargetScope;\n    }\n    const exit = await doUpdate({\n      params: { scopeId: displayScope, namespace: props.sourceId },\n      payload,\n      reactivityKeys: sourceWriteKeys,\n    });\n    if (Exit.isFailure(exit)) {\n      setError(\"Failed to update source\");\n      setSaving(false);\n      return;\n    }\n    setCredentialsDirty(false);\n    setSaving(false);\n    props.onSave();\n  };\n\n  return (\n    <div className=\"space-y-6\">\n      <div>\n        <h1 className=\"text-xl font-semibold text-foreground\">Edit MCP Source</h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          Update the endpoint and headers for this MCP connection.\n        </p>\n      </div>\n\n      <div className=\"flex items-center gap-3 rounded-lg border border-border bg-card px-4 py-3\">\n        <div className=\"min-w-0 flex-1\">\n          <p className=\"truncate text-sm font-semibold text-card-foreground\">{props.sourceId}</p>\n        </div>\n        <Badge variant=\"secondary\" className=\"text-xs\">\n          remote\n        </Badge>\n      </div>\n\n      <McpRemoteSourceFields\n        url={endpoint}\n        onUrlChange={setEndpoint}\n        identity={identity}\n        preview={{\n          name: props.initial.name,\n          serverName: props.initial.name,\n          connected: true,\n          toolCount: null,\n        }}\n        namespaceReadOnly\n      />\n\n      <HttpCredentialsEditor\n        credentials={credentials}\n        onChange={handleCredentialsChange}\n        existingSecrets={secretList}\n        sourceName={identity.name}\n        targetScope={credentialTargetScope}\n        credentialScopeOptions={credentialScopeOptions}\n        bindingScopeOptions={credentialScopeOptions}\n      />\n\n      {oauth2 && (\n        <SourceOAuthConnectionControl\n          popupName=\"mcp-oauth\"\n          pluginId=\"mcp\"\n          namespace={slugifyNamespace(props.initial.namespace) || \"mcp\"}\n          fallbackNamespace=\"mcp\"\n          endpoint={endpoint.trim()}\n          tokenScope={oauthCredentialTargetScope}\n          onTokenScopeChange={setOAuthCredentialTargetScope}\n          credentialScopeOptions={credentialScopeOptions}\n          connectionId={boundConnectionId}\n          sourceLabel={`${identity.name.trim() || props.initial.namespace || \"MCP\"} OAuth`}\n          headers={oauthRequestCredentials.headers}\n          queryParams={oauthRequestCredentials.queryParams}\n          isConnected={isConnected}\n          onConnected={async (connectionId) => {\n            await setBinding({\n              params: { scopeId: oauthCredentialTargetScope },\n              payload: McpSourceBindingInput.make({\n                sourceId: props.sourceId,\n                sourceScope,\n                scope: oauthCredentialTargetScope,\n                slot: oauth2.connectionSlot,\n                value: { kind: \"connection\", connectionId },\n              }),\n              reactivityKeys: [...sourceWriteKeys, ...connectionWriteKeys],\n            });\n          }}\n          reconnectingLabel=\"Reconnecting…\"\n          signingInLabel=\"Signing in…\"\n        />\n      )}\n\n      {error && (\n        <div className=\"rounded-lg border border-destructive/30 bg-destructive/5 px-3 py-2\">\n          <p className=\"text-sm text-destructive\">{error}</p>\n        </div>\n      )}\n\n      <div className=\"flex items-center justify-between border-t border-border pt-4\">\n        <Button variant=\"ghost\" onClick={props.onSave}>\n          Cancel\n        </Button>\n        <Button onClick={handleSave} disabled={!dirty || saving}>\n          {saving ? \"Saving…\" : \"Save changes\"}\n        </Button>\n      </div>\n    </div>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Stdio read-only view\n// ---------------------------------------------------------------------------\n\nfunction StdioReadOnly(props: {\n  sourceId: string;\n  initial: McpStoredSourceSchemaType & { config: { transport: \"stdio\" } };\n  onSave: () => void;\n}) {\n  const { command, args } = props.initial.config;\n  return (\n    <div className=\"space-y-6\">\n      <div>\n        <h1 className=\"text-xl font-semibold text-foreground\">Edit MCP Source</h1>\n        <p className=\"mt-1 text-sm text-muted-foreground\">\n          Stdio MCP sources cannot be edited in the UI. Remove and recreate the source with the\n          updated command.\n        </p>\n      </div>\n\n      <div className=\"flex items-center gap-3 rounded-lg border border-border bg-card px-4 py-3\">\n        <div className=\"min-w-0 flex-1\">\n          <p className=\"truncate text-sm font-semibold text-card-foreground\">{props.sourceId}</p>\n          <p className=\"mt-0.5 text-xs text-muted-foreground font-mono\">\n            {command} {(args ?? []).join(\" \")}\n          </p>\n        </div>\n        <Badge variant=\"secondary\" className=\"text-xs\">\n          stdio\n        </Badge>\n      </div>\n\n      <div className=\"flex items-center justify-end border-t border-border pt-4\">\n        <Button onClick={props.onSave}>Done</Button>\n      </div>\n    </div>\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Main component\n// ---------------------------------------------------------------------------\n\nexport default function EditMcpSource({\n  sourceId,\n  onSave,\n}: {\n  readonly sourceId: string;\n  readonly onSave: () => void;\n}) {\n  const scopeId = useScope();\n  const sourceResult = useAtomValue(mcpSourceAtom(scopeId, sourceId)) as AsyncResult.AsyncResult<\n    McpStoredSourceSchemaType | null,\n    unknown\n  >;\n  const source =\n    AsyncResult.isSuccess(sourceResult) && sourceResult.value ? sourceResult.value : null;\n  const sourceScope = source ? ScopeId.make(source.scope) : scopeId;\n  const bindingsResult = useAtomValue(mcpSourceBindingsAtom(scopeId, sourceId, sourceScope));\n\n  if (!AsyncResult.isSuccess(sourceResult) || !source || !AsyncResult.isSuccess(bindingsResult)) {\n    return (\n      <div className=\"space-y-6\">\n        <div>\n          <h1 className=\"text-xl font-semibold text-foreground\">Edit MCP Source</h1>\n          <p className=\"mt-1 text-sm text-muted-foreground\">Loading configuration…</p>\n        </div>\n      </div>\n    );\n  }\n\n  if (source.config.transport === \"stdio\") {\n    return (\n      <StdioReadOnly\n        sourceId={sourceId}\n        initial={source as McpStoredSourceSchemaType & { config: { transport: \"stdio\" } }}\n        onSave={onSave}\n      />\n    );\n  }\n\n  return (\n    <RemoteEditForm\n      sourceId={sourceId}\n      initial={source as McpStoredSourceSchemaType & { config: { transport: \"remote\" } }}\n      bindings={bindingsResult.value}\n      onSave={onSave}\n    />\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,SAAS,cAAc,kBAAkB;AACzC,YAAY,iBAAiB;AAC7B,YAAY,UAAU;AAOtB,SAAS,uBAAuB;AAChC,SAAS,UAAU,qBAAqB;AACxC,SAAS,qBAAqB,uBAAuB;AACrD,SAAS,kBAAkB,yBAAyB;AACpD,SAAS,gCAAgC;AACzC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,eAAe;AAyHlB,SACE,KADF;AA5GN,SAAS,eAAe,OAKrB;AACD,QAAM,eAAe,SAAS;AAC9B,QAAM,aAAa,cAAc;AACjC,QAAM,cAAc,QAAQ,KAAK,MAAM,QAAQ,KAAK;AACpD,QAAM,EAAE,uBAAuB,uBAAuB,IAAI,yBAAyB;AAAA,IACjF;AAAA,IACA,oBAAoB,6BAA6B,aAAa,MAAM,QAAQ;AAAA,EAC9E,CAAC;AACD,QAAM;AAAA,IACJ,uBAAuB;AAAA,IACvB,0BAA0B;AAAA,EAC5B,IAAI,yBAAyB;AAAA,IAC3B;AAAA,IACA,oBAAoB,6BAA6B,aAAa,MAAM,QAAQ;AAAA,EAC9E,CAAC;AACD,QAAM,WAAW,WAAW,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACpE,QAAM,aAAa,WAAW,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtE,QAAM,aAAa,uBAAuB;AAC1C,QAAM,oBAAoB,aAAa,gBAAgB,YAAY,CAAC;AAEpE,QAAM,WAAW,kBAAkB;AAAA,IACjC,cAAc,MAAM,QAAQ;AAAA,IAC5B,mBAAmB,MAAM,QAAQ;AAAA,EACnC,CAAC;AACD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,MAAM,QAAQ,OAAO,QAAQ;AACtE,QAAM,CAAC,aAAa,cAAc,IAAI;AAAA,IAA+B,MACnE,gDAAgD;AAAA,MAC9C,SAAS,MAAM,QAAQ,OAAO;AAAA,MAC9B,aAAa,MAAM,QAAQ,OAAO;AAAA,MAClC,UAAU,MAAM;AAAA,IAClB,CAAC;AAAA,EACH;AACA,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAS,KAAK;AAC1C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,kBAAkB,mBAAmB,IAAI,SAAS,KAAK;AAE9D,QAAM,gBAAgB,SAAS,KAAK,KAAK,MAAM,MAAM,QAAQ,KAAK,KAAK;AACvE,QAAM,gBAAgB,iBAAiB,SAAS,KAAK,MAAM,MAAM,QAAQ,OAAO,SAAS,KAAK;AAC9F,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,SAAS,WAAW,MAAM,QAAQ,OAAO,OAAO;AACzF,QAAM,cAA0B,sBAAU,iBAAiB,IAAI,kBAAkB,QAAQ,CAAC;AAC1F,QAAM,aAAa,IAAI,IAAI,WAAW,IAAI,CAAC,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAU,CAAC;AACvF,QAAM,oBAAoB,SACtB;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF,IACA;AACJ,QAAM,oBACJ,mBAAmB,MAAM,SAAS,eAAe,kBAAkB,MAAM,eAAe;AAC1F,QAAM,cACJ,sBAAsB,QACtB,YAAY,KAAK,CAAC,eAAe,WAAW,OAAO,iBAAiB;AACtE,QAAM,0BAA0B,yBAAyB,WAAW;AAEpE,QAAM,0BAA0B,CAAC,SAA+B;AAC9D,mBAAe,IAAI;AACnB,wBAAoB,IAAI;AAAA,EAC1B;AAEA,QAAM,aAAa,YAAY;AAC7B,cAAU,IAAI;AACd,aAAS,IAAI;AACb,UAAM,EAAE,SAAS,YAAY,IAAI;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AACA,UAAM,UAOF;AAAA,MACF;AAAA,MACA,MAAM,gBAAgB,SAAS,KAAK,KAAK,KAAK,SAAY;AAAA,MAC1D,UAAU,gBAAgB,SAAS,KAAK,KAAK,SAAY;AAAA,IAC3D;AACA,QAAI,kBAAkB;AACpB,cAAQ,UAAU;AAClB,cAAQ,cAAc;AACtB,cAAQ,wBAAwB;AAAA,IAClC;AACA,UAAM,OAAO,MAAM,SAAS;AAAA,MAC1B,QAAQ,EAAE,SAAS,cAAc,WAAW,MAAM,SAAS;AAAA,MAC3D;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAS,eAAU,IAAI,GAAG;AACxB,eAAS,yBAAyB;AAClC,gBAAU,KAAK;AACf;AAAA,IACF;AACA,wBAAoB,KAAK;AACzB,cAAU,KAAK;AACf,UAAM,OAAO;AAAA,EACf;AAEA,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,yBAAC,SACC;AAAA,0BAAC,QAAG,WAAU,yCAAwC,6BAAe;AAAA,MACrE,oBAAC,OAAE,WAAU,sCAAqC,sEAElD;AAAA,OACF;AAAA,IAEA,qBAAC,SAAI,WAAU,6EACb;AAAA,0BAAC,SAAI,WAAU,kBACb,8BAAC,OAAE,WAAU,uDAAuD,gBAAM,UAAS,GACrF;AAAA,MACA,oBAAC,SAAM,SAAQ,aAAY,WAAU,WAAU,oBAE/C;AAAA,OACF;AAAA,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,aAAa;AAAA,QACb;AAAA,QACA,SAAS;AAAA,UACP,MAAM,MAAM,QAAQ;AAAA,UACpB,YAAY,MAAM,QAAQ;AAAA,UAC1B,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AAAA,QACA,mBAAiB;AAAA;AAAA,IACnB;AAAA,IAEA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,aAAa;AAAA,QACb;AAAA,QACA,qBAAqB;AAAA;AAAA,IACvB;AAAA,IAEC,UACC;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QACV,UAAS;AAAA,QACT,WAAW,iBAAiB,MAAM,QAAQ,SAAS,KAAK;AAAA,QACxD,mBAAkB;AAAA,QAClB,UAAU,SAAS,KAAK;AAAA,QACxB,YAAY;AAAA,QACZ,oBAAoB;AAAA,QACpB;AAAA,QACA,cAAc;AAAA,QACd,aAAa,GAAG,SAAS,KAAK,KAAK,KAAK,MAAM,QAAQ,aAAa,KAAK;AAAA,QACxE,SAAS,wBAAwB;AAAA,QACjC,aAAa,wBAAwB;AAAA,QACrC;AAAA,QACA,aAAa,OAAO,iBAAiB;AACnC,gBAAM,WAAW;AAAA,YACf,QAAQ,EAAE,SAAS,2BAA2B;AAAA,YAC9C,SAAS,sBAAsB,KAAK;AAAA,cAClC,UAAU,MAAM;AAAA,cAChB;AAAA,cACA,OAAO;AAAA,cACP,MAAM,OAAO;AAAA,cACb,OAAO,EAAE,MAAM,cAAc,aAAa;AAAA,YAC5C,CAAC;AAAA,YACD,gBAAgB,CAAC,GAAG,iBAAiB,GAAG,mBAAmB;AAAA,UAC7D,CAAC;AAAA,QACH;AAAA,QACA,mBAAkB;AAAA,QAClB,gBAAe;AAAA;AAAA,IACjB;AAAA,IAGD,SACC,oBAAC,SAAI,WAAU,sEACb,8BAAC,OAAE,WAAU,4BAA4B,iBAAM,GACjD;AAAA,IAGF,qBAAC,SAAI,WAAU,iEACb;AAAA,0BAAC,UAAO,SAAQ,SAAQ,SAAS,MAAM,QAAQ,oBAE/C;AAAA,MACA,oBAAC,UAAO,SAAS,YAAY,UAAU,CAAC,SAAS,QAC9C,mBAAS,iBAAY,gBACxB;AAAA,OACF;AAAA,KACF;AAEJ;AAMA,SAAS,cAAc,OAIpB;AACD,QAAM,EAAE,SAAS,KAAK,IAAI,MAAM,QAAQ;AACxC,SACE,qBAAC,SAAI,WAAU,aACb;AAAA,yBAAC,SACC;AAAA,0BAAC,QAAG,WAAU,yCAAwC,6BAAe;AAAA,MACrE,oBAAC,OAAE,WAAU,sCAAqC,oHAGlD;AAAA,OACF;AAAA,IAEA,qBAAC,SAAI,WAAU,6EACb;AAAA,2BAAC,SAAI,WAAU,kBACb;AAAA,4BAAC,OAAE,WAAU,uDAAuD,gBAAM,UAAS;AAAA,QACnF,qBAAC,OAAE,WAAU,kDACV;AAAA;AAAA,UAAQ;AAAA,WAAG,QAAQ,CAAC,GAAG,KAAK,GAAG;AAAA,WAClC;AAAA,SACF;AAAA,MACA,oBAAC,SAAM,SAAQ,aAAY,WAAU,WAAU,mBAE/C;AAAA,OACF;AAAA,IAEA,oBAAC,SAAI,WAAU,6DACb,8BAAC,UAAO,SAAS,MAAM,QAAQ,kBAAI,GACrC;AAAA,KACF;AAEJ;AAMe,SAAR,cAA+B;AAAA,EACpC;AAAA,EACA;AACF,GAGG;AACD,QAAM,UAAU,SAAS;AACzB,QAAM,eAAe,aAAa,cAAc,SAAS,QAAQ,CAAC;AAIlE,QAAM,SACQ,sBAAU,YAAY,KAAK,aAAa,QAAQ,aAAa,QAAQ;AACnF,QAAM,cAAc,SAAS,QAAQ,KAAK,OAAO,KAAK,IAAI;AAC1D,QAAM,iBAAiB,aAAa,sBAAsB,SAAS,UAAU,WAAW,CAAC;AAEzF,MAAI,CAAa,sBAAU,YAAY,KAAK,CAAC,UAAU,CAAa,sBAAU,cAAc,GAAG;AAC7F,WACE,oBAAC,SAAI,WAAU,aACb,+BAAC,SACC;AAAA,0BAAC,QAAG,WAAU,yCAAwC,6BAAe;AAAA,MACrE,oBAAC,OAAE,WAAU,sCAAqC,yCAAsB;AAAA,OAC1E,GACF;AAAA,EAEJ;AAEA,MAAI,OAAO,OAAO,cAAc,SAAS;AACvC,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,SAAS;AAAA,QACT;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC;AAAA,MACA,SAAS;AAAA,MACT,UAAU,eAAe;AAAA,MACzB;AAAA;AAAA,EACF;AAEJ;","names":[]}

package/dist/{chunk-NQT7NAGE.js → chunk-2DOCEPYN.js}

@@ -808,6 +808,41 @@ var isOAuthErrorBody = (body) => {
   if (Array.isArray(obj.errors)) return false;
   return typeof obj.error === "string";
 };
+var ProtectedResourceMetadata = Schema4.Struct({
+  resource: Schema4.String,
+  authorization_servers: Schema4.Array(Schema4.String)
+});
+var decodeProtectedResourceMetadata = Schema4.decodeUnknownOption(
+  Schema4.fromJsonString(ProtectedResourceMetadata)
+);
+var protectedResourceMetadataUrl = (endpoint) => {
+  const path = endpoint.pathname === "/" ? "" : endpoint.pathname;
+  return `${endpoint.origin}/.well-known/oauth-protected-resource${path}`;
+};
+var resourceMatchesEndpoint = (resource, endpoint) => {
+  if (!URL.canParse(resource)) return false;
+  const parsed = new URL(resource);
+  if (parsed.origin !== endpoint.origin) return false;
+  const resourcePath = parsed.pathname.replace(/\/+$/, "");
+  const endpointPath = endpoint.pathname.replace(/\/+$/, "");
+  return endpointPath === resourcePath || endpointPath.startsWith(`${resourcePath}/`);
+};
+var probeProtectedResourceMetadata = (client, endpoint, timeoutMs) => Effect5.gen(function* () {
+  const response = yield* client.execute(
+    HttpClientRequest.get(protectedResourceMetadataUrl(endpoint)).pipe(
+      HttpClientRequest.setHeader("accept", "application/json")
+    )
+  ).pipe(Effect5.timeout(Duration.millis(timeoutMs)));
+  if (response.status < 200 || response.status >= 300) return false;
+  const body = yield* response.text.pipe(
+    Effect5.timeout(Duration.millis(timeoutMs)),
+    Effect5.catch(() => Effect5.succeed(""))
+  );
+  const metadata = decodeProtectedResourceMetadata(body);
+  if (Option4.isNone(metadata)) return false;
+  if (metadata.value.authorization_servers.length === 0) return false;
+  return resourceMatchesEndpoint(metadata.value.resource, endpoint);
+}).pipe(Effect5.catch(() => Effect5.succeed(false)));
 var ErrorMessageShape = Schema4.Struct({ message: Schema4.String });
 var decodeErrorMessageShape = Schema4.decodeUnknownOption(ErrorMessageShape);
 var reasonFromBoundaryCause = (cause) => {
@@ -836,6 +871,9 @@ var probeMcpEndpointShape = (endpoint, options = {}) => Effect5.gen(function* ()
       if (response.status === 401) {
         const wwwAuth = readHeader(response.headers, "www-authenticate");
         if (!wwwAuth || !/^\s*bearer\b/i.test(wwwAuth)) {
+          if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {
+            return { kind: "mcp", requiresAuth: true };
+          }
           return {
             kind: "not-mcp",
             category: "auth-required",
@@ -851,6 +889,9 @@ var probeMcpEndpointShape = (endpoint, options = {}) => Effect5.gen(function* ()
         if (isSse) return { kind: "mcp", requiresAuth: true };
         const body = yield* readBody(response);
         if (!isJsonRpcEnvelope(body) && !isOAuthErrorBody(body)) {
+          if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {
+            return { kind: "mcp", requiresAuth: true };
+          }
           return {
             kind: "not-mcp",
             category: "auth-required",
@@ -2274,4 +2315,4 @@ export {
   makeMcpStore,
   mcpPlugin
 };
-//# sourceMappingURL=chunk-NQT7NAGE.js.map
+//# sourceMappingURL=chunk-2DOCEPYN.js.map

package/dist/{chunk-NQT7NAGE.js.map → chunk-2DOCEPYN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/sdk/binding-store.ts","../src/sdk/plugin.ts","../src/sdk/connection.ts","../src/sdk/discover.ts","../src/sdk/manifest.ts","../src/sdk/invoke.ts","../src/sdk/probe-shape.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// MCP plugin storage — four tables:\n//   - mcp_source: per-source structural data (transport, endpoint,\n//     stdio command/args/env, etc.) plus the auth flattened into\n//     columns so source-owned credential slots are queryable. The non-ref\n//     structural data still lives in `config` as JSON because it's\n//     plugin-private and varies by transport (`remote` vs `stdio`\n//     have different shapes).\n//   - mcp_source_header / mcp_source_query_param: child tables for\n//     remote sources' headers and query_params SecretBackedMap entries.\n//   - mcp_binding: per-tool McpToolBinding (toolId/toolName/description/\n//     input+output schemas/annotations). Stays JSON: it carries no\n//     refs, and `inputSchema` / `outputSchema` are arbitrary\n//     user-supplied JSON Schemas — a legitimate JSON case.\n// OAuth session storage lives at the core level in `oauth2_session`\n// and is owned by `ctx.oauth`.\n// ---------------------------------------------------------------------------\n\nimport { Effect, Option, Schema } from \"effect\";\n\nimport {\n  ConfiguredCredentialBinding,\n  defineSchema,\n  type StorageDeps,\n  type StorageFailure,\n} from \"@executor-js/sdk/core\";\n\nimport {\n  McpToolBinding,\n  McpStoredSourceData,\n  type McpConnectionAuth,\n  type ConfiguredMcpCredentialValue,\n} from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Schema\n// ---------------------------------------------------------------------------\n\nexport const mcpSchema = defineSchema({\n  mcp_source: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      name: { type: \"string\", required: true },\n      // Plugin-private structural data minus the ref-bearing fields\n      // (auth, headers, queryParams). For remote sources: transport,\n      // endpoint, remoteTransport. For stdio: transport, command,\n      // args, env, cwd.\n      config: { type: \"json\", required: true },\n      // Flattened McpConnectionAuth. The stored source only names slots;\n      // concrete per-user/per-workspace values live in core credential_binding.\n      auth_kind: {\n        type: [\"none\", \"header\", \"oauth2\"],\n        required: true,\n        defaultValue: \"none\",\n      },\n      // Header-auth fields.\n      auth_header_name: { type: \"string\", required: false },\n      auth_header_slot: { type: \"string\", required: false },\n      auth_header_prefix: { type: \"string\", required: false },\n      // OAuth2 auth fields.\n      auth_connection_slot: { type: \"string\", required: false },\n      auth_client_id_slot: {\n        type: \"string\",\n        required: false,\n      },\n      auth_client_secret_slot: {\n        type: \"string\",\n        required: false,\n      },\n      created_at: { type: \"date\", required: true },\n    },\n  },\n  mcp_source_header: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      source_id: { type: \"string\", required: true, index: true },\n      name: { type: \"string\", required: true },\n      kind: { type: [\"text\", \"binding\"], required: true },\n      text_value: { type: \"string\", required: false },\n      slot_key: { type: \"string\", required: false },\n      prefix: { type: \"string\", required: false },\n    },\n  },\n  mcp_source_query_param: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      source_id: { type: \"string\", required: true, index: true },\n      name: { type: \"string\", required: true },\n      kind: { type: [\"text\", \"binding\"], required: true },\n      text_value: { type: \"string\", required: false },\n      slot_key: { type: \"string\", required: false },\n      prefix: { type: \"string\", required: false },\n    },\n  },\n  mcp_binding: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      source_id: { type: \"string\", required: true, index: true },\n      binding: { type: \"json\", required: true },\n      created_at: { type: \"date\", required: true },\n    },\n  },\n});\n\nexport type McpSchema = typeof mcpSchema;\n\n// ---------------------------------------------------------------------------\n// Serialization helpers — JSON columns round-trip through the adapter as\n// either plain objects or serialized strings depending on the backend.\n// ---------------------------------------------------------------------------\n\nconst decodeSourceData = Schema.decodeUnknownSync(McpStoredSourceData);\nconst encodeSourceData = Schema.encodeSync(McpStoredSourceData);\n\nconst decodeBinding = Schema.decodeUnknownSync(McpToolBinding);\nconst encodeBinding = Schema.encodeSync(McpToolBinding);\nconst decodeJson = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown));\n\nconst coerceJson = (value: unknown): unknown => {\n  if (typeof value !== \"string\") return value;\n  return Option.getOrElse(decodeJson(value), () => value);\n};\n\n// --- auth column packing/unpacking ------------------------------------------\n\ninterface AuthColumns {\n  readonly auth_kind: \"none\" | \"header\" | \"oauth2\";\n  readonly auth_header_name?: string;\n  readonly auth_header_slot?: string;\n  readonly auth_header_prefix?: string;\n  readonly auth_connection_slot?: string;\n  readonly auth_client_id_slot?: string;\n  readonly auth_client_secret_slot?: string;\n}\n\nconst authToColumns = (auth: McpConnectionAuth): AuthColumns => {\n  if (auth.kind === \"header\") {\n    return {\n      auth_kind: \"header\",\n      auth_header_name: auth.headerName,\n      auth_header_slot: auth.secretSlot,\n      auth_header_prefix: auth.prefix,\n    };\n  }\n  if (auth.kind === \"oauth2\") {\n    return {\n      auth_kind: \"oauth2\",\n      auth_connection_slot: auth.connectionSlot,\n      auth_client_id_slot: auth.clientIdSlot,\n      auth_client_secret_slot: auth.clientSecretSlot,\n    };\n  }\n  return { auth_kind: \"none\" };\n};\n\nconst columnsToAuth = (row: Record<string, unknown>): McpConnectionAuth => {\n  const kind = row.auth_kind;\n  if (kind === \"header\" && typeof row.auth_header_slot === \"string\") {\n    const prefix = row.auth_header_prefix as string | null | undefined;\n    return {\n      kind: \"header\",\n      headerName: (row.auth_header_name as string | null) ?? \"\",\n      secretSlot: row.auth_header_slot,\n      ...(prefix ? { prefix } : {}),\n    };\n  }\n  if (kind === \"oauth2\" && typeof row.auth_connection_slot === \"string\") {\n    const cid = row.auth_client_id_slot as string | null | undefined;\n    const csec = row.auth_client_secret_slot as string | null | undefined;\n    return {\n      kind: \"oauth2\",\n      connectionSlot: row.auth_connection_slot,\n      ...(cid ? { clientIdSlot: cid } : {}),\n      ...(csec ? { clientSecretSlot: csec } : {}),\n    };\n  }\n  return { kind: \"none\" };\n};\n\n// --- ConfiguredCredentialValue map <-> child rows ---------------------------\n\ninterface ConfiguredCredentialRow {\n  readonly id: string;\n  readonly scope_id: string;\n  readonly source_id: string;\n  readonly name: string;\n  readonly kind: \"text\" | \"binding\";\n  readonly text_value?: string;\n  readonly slot_key?: string;\n  readonly prefix?: string;\n  readonly [k: string]: unknown;\n}\n\nconst valueMapToRows = (\n  sourceId: string,\n  scope: string,\n  values: Record<string, ConfiguredMcpCredentialValue> | undefined,\n): readonly ConfiguredCredentialRow[] => {\n  if (!values) return [];\n  return Object.entries(values).map(([name, value]) => {\n    const id = JSON.stringify([sourceId, name]);\n    if (typeof value === \"string\") {\n      return {\n        id,\n        scope_id: scope,\n        source_id: sourceId,\n        name,\n        kind: \"text\",\n        text_value: value,\n      };\n    }\n    return {\n      id,\n      scope_id: scope,\n      source_id: sourceId,\n      name,\n      kind: \"binding\",\n      slot_key: value.slot,\n      prefix: value.prefix,\n    };\n  });\n};\n\nconst rowsToValueMap = (\n  rows: readonly Record<string, unknown>[],\n): Record<string, ConfiguredMcpCredentialValue> => {\n  const out: Record<string, ConfiguredMcpCredentialValue> = {};\n  for (const row of rows) {\n    if (typeof row.name !== \"string\") continue;\n    const name = row.name;\n    if (row.kind === \"binding\" && typeof row.slot_key === \"string\") {\n      const prefix = row.prefix as string | undefined | null;\n      out[name] = prefix\n        ? ConfiguredCredentialBinding.make({ kind: \"binding\", slot: row.slot_key, prefix })\n        : ConfiguredCredentialBinding.make({ kind: \"binding\", slot: row.slot_key });\n    } else if (row.kind === \"text\" && typeof row.text_value === \"string\") {\n      out[name] = row.text_value;\n    }\n  }\n  return out;\n};\n\n// ---------------------------------------------------------------------------\n// Stored source (decoded) — what callers see\n// ---------------------------------------------------------------------------\n\nexport interface McpStoredSource {\n  readonly namespace: string;\n  /** Executor scope id this source row lives in. Writes stamp this on\n   *  `scope_id`; reads return whichever scope's row the adapter's\n   *  fall-through walk surfaced first. */\n  readonly scope: string;\n  readonly name: string;\n  readonly config: McpStoredSourceData;\n}\n\n// ---------------------------------------------------------------------------\n// Store interface\n// ---------------------------------------------------------------------------\n\n// Every method routes through the typed adapter (`ctx.storage.adapter`)\n// so the typed error channel is `StorageFailure`. Schema-decode failures\n// inside `Effect.gen` land as defects, not typed errors, and are caught\n// by the HTTP edge's observability middleware.\n//\n// Every read/write that targets a single row pins BOTH the natural id\n// (namespace, toolId, sessionId) AND the owning `scope_id`. The store\n// runs behind the scoped adapter (which auto-injects `scope_id IN\n// (stack)`), so a bare `{id}` filter resolves to any matching row in\n// the stack in adapter-iteration order. For shadowed rows (same id at\n// multiple scopes — e.g. an org-level MCP source with a per-user\n// override), that's a scope-isolation bug: updates and deletes can\n// land on the wrong scope's row. Callers thread the resolved scope in\n// (typically `path.scopeId` for HTTP, `toolRow.scope_id` /\n// `input.scope` for invokeTool/lifecycle) so every keyed mutation\n// targets exactly one row.\nexport interface McpBindingStore {\n  readonly listBindingsBySource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<\n    ReadonlyArray<{\n      readonly toolId: string;\n      readonly binding: McpToolBinding;\n    }>,\n    StorageFailure\n  >;\n\n  readonly getBinding: (\n    toolId: string,\n    scope: string,\n  ) => Effect.Effect<\n    { readonly binding: McpToolBinding; readonly namespace: string } | null,\n    StorageFailure\n  >;\n\n  readonly putBindings: (\n    namespace: string,\n    scope: string,\n    entries: ReadonlyArray<{\n      readonly toolId: string;\n      readonly binding: McpToolBinding;\n    }>,\n  ) => Effect.Effect<void, StorageFailure>;\n\n  readonly removeBindingsByNamespace: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<void, StorageFailure>;\n\n  readonly getSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSource | null, StorageFailure>;\n  readonly getSourceConfig: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSourceData | null, StorageFailure>;\n  readonly putSource: (source: McpStoredSource) => Effect.Effect<void, StorageFailure>;\n  readonly removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure>;\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\nexport const makeMcpStore = ({ adapter: db }: StorageDeps<McpSchema>): McpBindingStore => {\n  return {\n    listBindingsBySource: (namespace, scope) =>\n      Effect.gen(function* () {\n        const rows = yield* db.findMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        return rows.map((row) => ({\n          toolId: row.id,\n          binding: decodeBinding(coerceJson(row.binding)),\n        }));\n      }),\n\n    getBinding: (toolId, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"id\", value: toolId },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        const binding = decodeBinding(coerceJson(row.binding));\n        return { binding, namespace: row.source_id };\n      }),\n\n    putBindings: (namespace, scope, entries) =>\n      Effect.gen(function* () {\n        if (entries.length === 0) return;\n        const now = new Date();\n        yield* db.createMany({\n          model: \"mcp_binding\",\n          data: entries.map((e) => ({\n            id: e.toolId,\n            scope_id: scope,\n            source_id: namespace,\n            binding: encodeBinding(e.binding),\n            created_at: now,\n          })),\n          forceAllowId: true,\n        });\n      }),\n\n    removeBindingsByNamespace: (namespace, scope) =>\n      db\n        .deleteMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        })\n        .pipe(Effect.asVoid),\n\n    getSource: (namespace, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        return {\n          namespace: row.id,\n          scope: row.scope_id,\n          name: row.name,\n          config: yield* hydrateSourceData(row, namespace, scope),\n        };\n      }),\n\n    getSourceConfig: (namespace, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        return yield* hydrateSourceData(row, namespace, scope);\n      }),\n\n    putSource: (source) =>\n      Effect.gen(function* () {\n        const now = new Date();\n        // Drop the source row and its child rows; recreate. Two-step\n        // matches the existing put-overwrites-existing semantic.\n        yield* db.delete({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: source.namespace },\n            { field: \"scope_id\", value: source.scope },\n          ],\n        });\n        yield* deleteSourceChildren(source.namespace, source.scope);\n\n        const auth: McpConnectionAuth =\n          source.config.transport === \"remote\" ? source.config.auth : { kind: \"none\" };\n        const authCols = authToColumns(auth);\n        const headers = source.config.transport === \"remote\" ? source.config.headers : undefined;\n        const queryParams =\n          source.config.transport === \"remote\" ? source.config.queryParams : undefined;\n\n        // The encoded config keeps every plugin-private field but\n        // strips auth/headers/queryParams — those moved to columns/\n        // child tables. We round-trip through encodeSourceData so the\n        // remaining fields stay in the same JSON shape decode expects.\n        const encodedConfig = stripExtractedFields(\n          encodeSourceData(source.config) as Record<string, unknown>,\n        );\n\n        yield* db.create({\n          model: \"mcp_source\",\n          data: {\n            id: source.namespace,\n            scope_id: source.scope,\n            name: source.name,\n            config: encodedConfig,\n            created_at: now,\n            ...authCols,\n          },\n          forceAllowId: true,\n        });\n\n        const headerRows = valueMapToRows(source.namespace, source.scope, headers);\n        if (headerRows.length > 0) {\n          yield* db.createMany({\n            model: \"mcp_source_header\",\n            data: headerRows,\n            forceAllowId: true,\n          });\n        }\n        const paramRows = valueMapToRows(source.namespace, source.scope, queryParams);\n        if (paramRows.length > 0) {\n          yield* db.createMany({\n            model: \"mcp_source_query_param\",\n            data: paramRows,\n            forceAllowId: true,\n          });\n        }\n      }),\n\n    removeSource: (namespace, scope) =>\n      Effect.gen(function* () {\n        yield* db.deleteMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        yield* deleteSourceChildren(namespace, scope);\n        yield* db.delete({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n      }),\n  };\n\n  // ---------------------------------------------------------------------\n  // Private helpers — depend on `db` so they live inside the closure.\n  // ---------------------------------------------------------------------\n\n  function deleteSourceChildren(namespace: string, scope: string) {\n    return Effect.gen(function* () {\n      for (const model of [\"mcp_source_header\", \"mcp_source_query_param\"] as const) {\n        yield* db.deleteMany({\n          model,\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n      }\n    });\n  }\n\n  function hydrateSourceData(\n    row: Record<string, unknown>,\n    namespace: string,\n    scope: string,\n  ): Effect.Effect<McpStoredSourceData, StorageFailure> {\n    return Effect.gen(function* () {\n      // The stored JSON has auth/headers/queryParams stripped (those\n      // moved to columns / child tables). We must rehydrate the full\n      // shape BEFORE handing it to the schema decoder, because\n      // `McpRemoteSourceData.auth` is required.\n      const partial = coerceJson(row.config) as Record<string, unknown>;\n      if (partial.transport !== \"remote\") {\n        // stdio sources have no extracted fields — decode as-is.\n        return decodeSourceData(partial);\n      }\n      const headerRows = yield* db.findMany({\n        model: \"mcp_source_header\",\n        where: [\n          { field: \"source_id\", value: namespace },\n          { field: \"scope_id\", value: scope },\n        ],\n      });\n      const paramRows = yield* db.findMany({\n        model: \"mcp_source_query_param\",\n        where: [\n          { field: \"source_id\", value: namespace },\n          { field: \"scope_id\", value: scope },\n        ],\n      });\n      const headers = rowsToValueMap(headerRows);\n      const queryParams = rowsToValueMap(paramRows);\n      const reassembled = {\n        ...partial,\n        ...(Object.keys(headers).length > 0 ? { headers } : {}),\n        ...(Object.keys(queryParams).length > 0 ? { queryParams } : {}),\n        auth: columnsToAuth(row),\n      };\n      return decodeSourceData(reassembled);\n    });\n  }\n};\n\n// Strip auth/headers/queryParams from the encoded source-data shape.\n// Keeps the remaining structural fields (transport, endpoint, etc.) in\n// the JSON config column. Per-transport: only the remote variant has\n// these fields, so this is a no-op for stdio.\nconst stripExtractedFields = (encoded: Record<string, unknown>): Record<string, unknown> => {\n  if (encoded.transport !== \"remote\") return encoded;\n  const { auth, headers, queryParams, ...rest } = encoded;\n  void auth;\n  void headers;\n  void queryParams;\n  return rest;\n};\n","import {\n  Duration,\n  Effect,\n  Exit,\n  Layer,\n  Match,\n  Option,\n  Predicate,\n  Result,\n  Scope,\n  ScopedCache,\n} from \"effect\";\nimport type { HttpClient } from \"effect/unstable/http\";\n\nimport type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\n\nimport {\n  ConfiguredCredentialBinding,\n  ConnectionId,\n  type CredentialBindingRef,\n  type CredentialBindingValue,\n  ScopeId,\n  SecretId,\n  SourceDetectionResult,\n  definePlugin,\n  resolveSecretBackedMap as resolveSharedSecretBackedMap,\n  type PluginCtx,\n  type StorageFailure,\n  StorageError,\n  type ToolAnnotations,\n} from \"@executor-js/sdk/core\";\n\nimport {\n  makeMcpStore,\n  mcpSchema,\n  type McpBindingStore,\n  type McpStoredSource,\n} from \"./binding-store\";\nimport { createMcpConnector, type ConnectorInput, type McpConnection } from \"./connection\";\nimport { discoverTools } from \"./discover\";\nimport { McpConnectionError, McpInvocationError, McpToolDiscoveryError } from \"./errors\";\nimport { invokeMcpTool } from \"./invoke\";\nimport { deriveMcpNamespace, type McpToolManifest, type McpToolManifestEntry } from \"./manifest\";\nimport { probeMcpEndpointShape, type McpShapeProbeResult } from \"./probe-shape\";\nimport {\n  MCP_HEADER_AUTH_SLOT,\n  MCP_OAUTH_CLIENT_ID_SLOT,\n  MCP_OAUTH_CLIENT_SECRET_SLOT,\n  MCP_OAUTH_CONNECTION_SLOT,\n  McpToolBinding,\n  McpSourceBindingInput,\n  McpSourceBindingRef,\n  mcpHeaderSlot,\n  mcpQueryParamSlot,\n  type McpConnectionAuth,\n  type McpConnectionAuthInput,\n  type McpCredentialInput,\n  type McpSourceBindingValue,\n  type SecretBackedValue,\n  type McpStoredSourceData,\n  type ConfiguredMcpCredentialValue,\n} from \"./types\";\n\nimport {\n  SECRET_REF_PREFIX,\n  type ConfigFileSink,\n  type McpAuthConfig,\n  type McpRemoteSourceConfig as McpRemoteConfigEntry,\n  type McpStdioSourceConfig as McpStdioConfigEntry,\n  type SourceConfig,\n} from \"@executor-js/config\";\n\n// ---------------------------------------------------------------------------\n// Plugin config — discriminated union on transport\n// ---------------------------------------------------------------------------\n\n/**\n * Executor scope id that owns a newly-added MCP source row. Must be one\n * of the executor's configured scopes. Admins adding a shared server at\n * org scope pin here; per-user stdio sources can pin at the inner\n * scope.\n */\ntype McpSourceScopeField = { readonly scope: string };\n\nexport interface McpRemoteSourceConfig extends McpSourceScopeField {\n  readonly transport: \"remote\";\n  readonly name: string;\n  readonly endpoint: string;\n  readonly remoteTransport?: \"streamable-http\" | \"sse\" | \"auto\";\n  readonly queryParams?: Record<string, McpCredentialInput>;\n  readonly headers?: Record<string, McpCredentialInput>;\n  readonly namespace?: string;\n  readonly auth?: McpConnectionAuthInput;\n  /**\n   * Scope that owns any direct credentials supplied on this call. Required\n   * whenever headers/queryParams/auth carry direct secret or connection ids.\n   */\n  readonly credentialTargetScope?: string;\n}\n\nexport interface McpStdioSourceConfig extends McpSourceScopeField {\n  readonly transport: \"stdio\";\n  readonly name: string;\n  readonly command: string;\n  readonly args?: string[];\n  readonly env?: Record<string, string>;\n  readonly cwd?: string;\n  readonly namespace?: string;\n}\n\nexport type McpSourceConfig = McpRemoteSourceConfig | McpStdioSourceConfig;\n\n// ---------------------------------------------------------------------------\n// Extension types\n// ---------------------------------------------------------------------------\n\n// OAuth start/complete/callback moved to the shared\n// `/scopes/:scopeId/oauth/*` surface in `@executor-js/api` — no\n// plugin-specific types needed here.\n\nexport interface McpProbeResult {\n  readonly connected: boolean;\n  readonly requiresOAuth: boolean;\n  readonly supportsDynamicRegistration: boolean;\n  readonly name: string;\n  readonly namespace: string;\n  readonly toolCount: number | null;\n  readonly serverName: string | null;\n}\n\nexport interface McpUpdateSourceInput {\n  readonly name?: string;\n  readonly endpoint?: string;\n  readonly headers?: Record<string, McpCredentialInput>;\n  readonly queryParams?: Record<string, McpCredentialInput>;\n  readonly credentialTargetScope?: string;\n  readonly auth?: McpConnectionAuthInput;\n}\n\nexport interface McpProbeEndpointInput {\n  readonly endpoint: string;\n  readonly headers?: Record<string, SecretBackedValue>;\n  readonly queryParams?: Record<string, SecretBackedValue>;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst toStoredSourceData = (\n  config: McpSourceConfig,\n  remoteCredentials?: {\n    readonly headers: Record<string, ConfiguredMcpCredentialValue>;\n    readonly queryParams: Record<string, ConfiguredMcpCredentialValue>;\n    readonly auth: McpConnectionAuth;\n  },\n): McpStoredSourceData => {\n  if (config.transport === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: config.command,\n      args: config.args,\n      env: config.env,\n      cwd: config.cwd,\n    };\n  }\n  return {\n    transport: \"remote\",\n    endpoint: config.endpoint,\n    remoteTransport: config.remoteTransport ?? \"auto\",\n    queryParams: remoteCredentials?.queryParams,\n    headers: remoteCredentials?.headers,\n    auth: remoteCredentials?.auth ?? { kind: \"none\" },\n  };\n};\n\nconst normalizeNamespace = (config: McpSourceConfig): string =>\n  config.namespace ??\n  deriveMcpNamespace({\n    name: config.name,\n    endpoint: config.transport === \"remote\" ? config.endpoint : undefined,\n    command: config.transport === \"stdio\" ? config.command : undefined,\n  });\n\nconst toBinding = (entry: McpToolManifestEntry): McpToolBinding =>\n  McpToolBinding.make({\n    toolId: entry.toolId,\n    toolName: entry.toolName,\n    description: entry.description,\n    inputSchema: entry.inputSchema,\n    outputSchema: entry.outputSchema,\n    annotations: entry.annotations,\n  });\n\nconst MCP_PLUGIN_ID = \"mcp\";\n\n/** Match `token` as a separator-bounded run inside a URL hostname or path,\n *  used as a low-confidence detection hint when wire-shape detection fails.\n *  Boundary chars are everything non-alphanumeric, so `/api/mcp`,\n *  `mcp.example.com`, `mcp-server`, and `mcp_v1` all match while\n *  `mcphost.com` and `/mcpstore` do not. */\nconst urlMatchesToken = (url: URL, token: string): boolean => {\n  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, \"i\");\n  return re.test(url.hostname) || re.test(url.pathname);\n};\n\n/** Translate a non-MCP probe outcome into a message a user can act on.\n *  The technical `reason` (`401 without Bearer WWW-Authenticate — not an\n *  MCP auth challenge`, etc.) stays in telemetry via the probe span; the\n *  user gets a sentence pointing at their next step. Exported for tests. */\nexport const userFacingProbeMessage = (\n  shape: Extract<McpShapeProbeResult, { kind: \"not-mcp\" } | { kind: \"unreachable\" }>,\n): string => {\n  if (shape.kind === \"unreachable\") {\n    return \"Couldn't reach this URL. Check the address, your network, and that the server is running.\";\n  }\n  return Match.value(shape.category).pipe(\n    Match.when(\n      \"auth-required\",\n      () =>\n        \"This server requires authentication. Add credentials (Authorization header, query parameter, or API key) below and retry.\",\n    ),\n    Match.when(\n      \"wrong-shape\",\n      () =>\n        \"This URL doesn't appear to host an MCP server. Double-check the address, including the path.\",\n    ),\n    Match.exhaustive,\n  );\n};\n\nconst scopeRanks = (ctx: PluginCtx<McpBindingStore>): ReadonlyMap<string, number> =>\n  new Map(ctx.scopes.map((scope, index) => [String(scope.id), index]));\n\nconst scopeRank = (ranks: ReadonlyMap<string, number>, scopeId: string): number =>\n  ranks.get(scopeId) ?? Infinity;\n\nconst coreBindingToMcpBinding = (binding: CredentialBindingRef): McpSourceBindingRef =>\n  McpSourceBindingRef.make({\n    sourceId: binding.sourceId,\n    sourceScopeId: binding.sourceScopeId,\n    scopeId: binding.scopeId,\n    slot: binding.slotKey,\n    value: binding.value,\n    createdAt: binding.createdAt,\n    updatedAt: binding.updatedAt,\n  });\n\nconst listMcpSourceBindings = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n): Effect.Effect<readonly McpSourceBindingRef[], StorageFailure> =>\n  Effect.gen(function* () {\n    const ranks = scopeRanks(ctx);\n    const sourceSourceRank = scopeRank(ranks, sourceScope);\n    if (sourceSourceRank === Infinity) return [];\n    const bindings = yield* ctx.credentialBindings.listForSource({\n      pluginId: MCP_PLUGIN_ID,\n      sourceId,\n      sourceScope: ScopeId.make(sourceScope),\n    });\n    return bindings\n      .filter((binding) => scopeRank(ranks, binding.scopeId) <= sourceSourceRank)\n      .map(coreBindingToMcpBinding);\n  });\n\nconst resolveMcpSourceBinding = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n  slot: string,\n): Effect.Effect<McpSourceBindingRef | null, StorageFailure> =>\n  Effect.gen(function* () {\n    const ranks = scopeRanks(ctx);\n    const sourceSourceRank = scopeRank(ranks, sourceScope);\n    if (sourceSourceRank === Infinity) return null;\n    const bindings = yield* ctx.credentialBindings.listForSource({\n      pluginId: MCP_PLUGIN_ID,\n      sourceId,\n      sourceScope: ScopeId.make(sourceScope),\n    });\n    const binding = bindings\n      .filter(\n        (candidate) =>\n          candidate.slotKey === slot && scopeRank(ranks, candidate.scopeId) <= sourceSourceRank,\n      )\n      .sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0];\n    return binding ? coreBindingToMcpBinding(binding) : null;\n  });\n\nconst validateMcpBindingTarget = (\n  ctx: PluginCtx<McpBindingStore>,\n  input: {\n    readonly sourceScope: string;\n    readonly targetScope: string;\n    readonly sourceId: string;\n  },\n): Effect.Effect<void, StorageFailure> =>\n  Effect.gen(function* () {\n    const ranks = scopeRanks(ctx);\n    const sourceSourceRank = scopeRank(ranks, input.sourceScope);\n    const targetRank = scopeRank(ranks, input.targetScope);\n    const scopeList = `[${ctx.scopes.map((s) => s.id).join(\", \")}]`;\n    if (sourceSourceRank === Infinity) {\n      return yield* new StorageError({\n        message:\n          `MCP source binding references source scope \"${input.sourceScope}\" ` +\n          `which is not in the executor's scope stack ${scopeList}.`,\n        cause: undefined,\n      });\n    }\n    if (targetRank === Infinity) {\n      return yield* new StorageError({\n        message:\n          `MCP source binding targets scope \"${input.targetScope}\" which is not ` +\n          `in the executor's scope stack ${scopeList}.`,\n        cause: undefined,\n      });\n    }\n    if (targetRank > sourceSourceRank) {\n      return yield* new StorageError({\n        message:\n          `MCP source bindings for \"${input.sourceId}\" cannot be written at ` +\n          `outer scope \"${input.targetScope}\" because the base source lives at ` +\n          `\"${input.sourceScope}\"`,\n        cause: undefined,\n      });\n    }\n  });\n\nconst bindingTargetScope = (\n  targetScope: string | undefined,\n  bindings: readonly unknown[],\n): Effect.Effect<string | undefined, McpConnectionError> => {\n  if (bindings.length === 0) return Effect.succeed(undefined);\n  if (targetScope) return Effect.succeed(targetScope);\n  return Effect.fail(\n    new McpConnectionError({\n      transport: \"remote\",\n      message: \"credentialTargetScope is required when adding direct MCP credentials\",\n    }),\n  );\n};\n\nconst targetScopeForBinding = (\n  fallbackTargetScope: string | undefined,\n  binding: { readonly targetScope?: string },\n): Effect.Effect<string, McpConnectionError> => {\n  const targetScope = binding.targetScope ?? fallbackTargetScope;\n  if (targetScope) return Effect.succeed(targetScope);\n  return Effect.fail(\n    new McpConnectionError({\n      transport: \"remote\",\n      message: \"credentialTargetScope is required when adding direct MCP credentials\",\n    }),\n  );\n};\n\nconst canonicalizeCredentialMap = (\n  values: Record<string, McpCredentialInput> | undefined,\n  slotForName: (name: string) => string,\n): {\n  readonly values: Record<string, ConfiguredMcpCredentialValue>;\n  readonly bindings: ReadonlyArray<{\n    readonly slot: string;\n    readonly value: McpSourceBindingValue;\n    readonly targetScope?: string;\n  }>;\n} => {\n  const nextValues: Record<string, ConfiguredMcpCredentialValue> = {};\n  const bindings: Array<{ slot: string; value: McpSourceBindingValue; targetScope?: string }> = [];\n  for (const [name, value] of Object.entries(values ?? {})) {\n    if (typeof value === \"string\") {\n      nextValues[name] = value;\n      continue;\n    }\n    if (\"kind\" in value) {\n      nextValues[name] = value;\n      continue;\n    }\n    const slot = slotForName(name);\n    nextValues[name] = ConfiguredCredentialBinding.make({\n      kind: \"binding\",\n      slot,\n      prefix: value.prefix,\n    });\n    bindings.push({\n      slot,\n      targetScope: \"targetScope\" in value ? value.targetScope : undefined,\n      value: {\n        kind: \"secret\",\n        secretId: SecretId.make(value.secretId),\n        ...(\"secretScopeId\" in value && value.secretScopeId\n          ? { secretScopeId: value.secretScopeId }\n          : {}),\n      },\n    });\n  }\n  return { values: nextValues, bindings };\n};\n\nconst canonicalizeAuth = (\n  auth: McpConnectionAuthInput | undefined,\n): {\n  readonly auth: McpConnectionAuth;\n  readonly bindings: ReadonlyArray<{\n    readonly slot: string;\n    readonly value: McpSourceBindingValue;\n    readonly targetScope?: string;\n  }>;\n} => {\n  if (!auth || auth.kind === \"none\") return { auth: { kind: \"none\" }, bindings: [] };\n  if (auth.kind === \"header\") {\n    if (\"secretSlot\" in auth) return { auth, bindings: [] };\n    return {\n      auth: {\n        kind: \"header\",\n        headerName: auth.headerName,\n        secretSlot: MCP_HEADER_AUTH_SLOT,\n        prefix: auth.prefix,\n      },\n      bindings: [\n        {\n          slot: MCP_HEADER_AUTH_SLOT,\n          targetScope: auth.targetScope,\n          value: {\n            kind: \"secret\",\n            secretId: SecretId.make(auth.secretId),\n            ...(auth.secretScopeId ? { secretScopeId: auth.secretScopeId } : {}),\n          },\n        },\n      ],\n    };\n  }\n  if (\"connectionSlot\" in auth) return { auth, bindings: [] };\n  const bindings: Array<{ slot: string; value: McpSourceBindingValue; targetScope?: string }> = [\n    {\n      slot: MCP_OAUTH_CONNECTION_SLOT,\n      value: {\n        kind: \"connection\",\n        connectionId: ConnectionId.make(auth.connectionId),\n      },\n    },\n  ];\n  if (auth.clientIdSecretId) {\n    bindings.push({\n      slot: MCP_OAUTH_CLIENT_ID_SLOT,\n      value: { kind: \"secret\", secretId: SecretId.make(auth.clientIdSecretId) },\n    });\n  }\n  if (auth.clientSecretSecretId) {\n    bindings.push({\n      slot: MCP_OAUTH_CLIENT_SECRET_SLOT,\n      value: { kind: \"secret\", secretId: SecretId.make(auth.clientSecretSecretId) },\n    });\n  }\n  return {\n    auth: {\n      kind: \"oauth2\",\n      connectionSlot: MCP_OAUTH_CONNECTION_SLOT,\n      ...(auth.clientIdSecretId ? { clientIdSlot: MCP_OAUTH_CLIENT_ID_SLOT } : {}),\n      ...(auth.clientSecretSecretId ? { clientSecretSlot: MCP_OAUTH_CLIENT_SECRET_SLOT } : {}),\n    },\n    bindings,\n  };\n};\n\n// ---------------------------------------------------------------------------\n// MCP-SDK OAuth provider adapter — builds the `OAuthClientProvider` the\n// MCP SDK's StreamableHTTP/SSE transports want, wrapping a pre-resolved\n// access token.\n//\n// Refresh is NOT driven through this provider — `ctx.connections.access\n// Token` owns that lifecycle at the core level via the canonical\n// \"oauth2\" ConnectionProvider. This adapter only injects the current\n// token into the transport's Authorization header and fails loudly if\n// the SDK ever tries to initiate a new OAuth flow (which would bypass\n// our refresh machinery).\n// ---------------------------------------------------------------------------\nconst makeOAuthProvider = (accessToken: string): OAuthClientProvider => ({\n  get redirectUrl() {\n    return \"http://localhost/oauth/callback\";\n  },\n  get clientMetadata() {\n    return {\n      redirect_uris: [\"http://localhost/oauth/callback\"],\n      grant_types: [\"authorization_code\", \"refresh_token\"] as string[],\n      response_types: [\"code\"] as string[],\n      token_endpoint_auth_method: \"none\" as const,\n      client_name: \"Executor\",\n    };\n  },\n  clientInformation: () => undefined,\n  saveClientInformation: () => undefined,\n  tokens: () => ({ access_token: accessToken, token_type: \"Bearer\" }),\n  saveTokens: () => undefined,\n  redirectToAuthorization: async () => {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: MCP SDK OAuthClientProvider callback can only signal reauthorization by throwing\n    throw new Error(\"MCP OAuth re-authorization required\");\n  },\n  saveCodeVerifier: () => undefined,\n  codeVerifier: () => {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: MCP SDK OAuthClientProvider callback requires a thrown verifier failure\n    throw new Error(\"No active PKCE verifier\");\n  },\n  saveDiscoveryState: () => undefined,\n  discoveryState: () => undefined,\n});\n\nconst resolveSecretBackedMap = (\n  values: Record<string, SecretBackedValue> | undefined,\n  ctx: PluginCtx<McpBindingStore>,\n): Effect.Effect<Record<string, string> | undefined, McpConnectionError | StorageFailure> =>\n  resolveSharedSecretBackedMap({\n    values,\n    getSecret: ctx.secrets.get,\n    onMissing: (_name, value) =>\n      new McpConnectionError({\n        transport: \"remote\",\n        message: `Failed to resolve secret \"${value.secretId}\"`,\n      }),\n    onError: (err, _name, value) =>\n      Predicate.isTagged(\"SecretOwnedByConnectionError\")(err)\n        ? new McpConnectionError({\n            transport: \"remote\",\n            message: `Failed to resolve secret \"${value.secretId}\"`,\n          })\n        : err,\n  }).pipe(\n    Effect.mapError((err) =>\n      Predicate.isTagged(\"SecretOwnedByConnectionError\")(err)\n        ? new McpConnectionError({ transport: \"remote\", message: \"Failed to resolve secret\" })\n        : err,\n    ),\n  );\n\nconst plainStringMap = (\n  values: Record<string, McpCredentialInput> | undefined,\n): Record<string, string> | undefined => {\n  if (!values) return undefined;\n  const entries = Object.entries(values).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst resolveMcpBindingValueMap = (\n  ctx: PluginCtx<McpBindingStore>,\n  values: Record<string, ConfiguredMcpCredentialValue> | undefined,\n  params: {\n    readonly sourceId: string;\n    readonly sourceScope: string;\n    readonly targetScope?: string;\n    readonly missingLabel: string;\n  },\n): Effect.Effect<Record<string, string> | undefined, McpConnectionError | StorageFailure> =>\n  Effect.gen(function* () {\n    if (!values) return undefined;\n    const resolved: Record<string, string> = {};\n    for (const [name, value] of Object.entries(values)) {\n      if (typeof value === \"string\") {\n        resolved[name] = value;\n        continue;\n      }\n      const binding = yield* resolveMcpSourceBinding(\n        ctx,\n        params.sourceId,\n        params.sourceScope,\n        value.slot,\n      );\n      if (binding?.value.kind === \"secret\") {\n        const secret = yield* ctx.secrets.getAtScope(binding.value.secretId, binding.scopeId).pipe(\n          Effect.catchTag(\"SecretOwnedByConnectionError\", () =>\n            Effect.fail(\n              new McpConnectionError({\n                transport: \"remote\",\n                message: `Failed to resolve secret for ${params.missingLabel} \"${name}\"`,\n              }),\n            ),\n          ),\n        );\n        if (secret === null) {\n          return yield* new McpConnectionError({\n            transport: \"remote\",\n            message: `Missing secret \"${binding.value.secretId}\" for ${params.missingLabel} \"${name}\"`,\n          });\n        }\n        resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;\n        continue;\n      }\n      if (binding?.value.kind === \"text\") {\n        resolved[name] = value.prefix ? `${value.prefix}${binding.value.text}` : binding.value.text;\n        continue;\n      }\n      return yield* new McpConnectionError({\n        transport: \"remote\",\n        message: `Missing binding for ${params.missingLabel} \"${name}\"`,\n      });\n    }\n    return Object.keys(resolved).length > 0 ? resolved : undefined;\n  });\n\nconst resolveMcpCredentialInputMap = (\n  ctx: PluginCtx<McpBindingStore>,\n  values: Record<string, McpCredentialInput> | undefined,\n  params: {\n    readonly sourceId: string;\n    readonly sourceScope: string;\n    readonly targetScope?: string;\n    readonly missingLabel: string;\n  },\n): Effect.Effect<Record<string, string> | undefined, McpConnectionError | StorageFailure> =>\n  Effect.gen(function* () {\n    if (!values) return undefined;\n    const resolved: Record<string, string> = {};\n    for (const [name, value] of Object.entries(values)) {\n      if (typeof value === \"string\") {\n        resolved[name] = value;\n        continue;\n      }\n      if (\"kind\" in value) {\n        const slotResolved = yield* resolveMcpBindingValueMap(\n          ctx,\n          { [name]: value },\n          {\n            sourceId: params.sourceId,\n            sourceScope: params.sourceScope,\n            missingLabel: params.missingLabel,\n          },\n        );\n        if (slotResolved?.[name] !== undefined) resolved[name] = slotResolved[name];\n        continue;\n      }\n      const secretScope =\n        \"secretScopeId\" in value\n          ? (value.secretScopeId ?? value.targetScope)\n          : (params.targetScope ?? params.sourceScope);\n      const secret = yield* ctx.secrets.getAtScope(SecretId.make(value.secretId), secretScope).pipe(\n        Effect.catchTag(\"SecretOwnedByConnectionError\", () =>\n          Effect.fail(\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve secret for ${params.missingLabel} \"${name}\"`,\n            }),\n          ),\n        ),\n      );\n      if (secret === null) {\n        return yield* new McpConnectionError({\n          transport: \"remote\",\n          message: `Missing secret \"${value.secretId}\" for ${params.missingLabel} \"${name}\"`,\n        });\n      }\n      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;\n    }\n    return Object.keys(resolved).length > 0 ? resolved : undefined;\n  });\n\nconst resolveMcpHeaderAuth = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n  auth: McpConnectionAuth,\n): Effect.Effect<Record<string, string>, McpConnectionError | StorageFailure> =>\n  Effect.gen(function* () {\n    if (auth.kind !== \"header\") return {};\n    const binding = yield* resolveMcpSourceBinding(ctx, sourceId, sourceScope, auth.secretSlot);\n    if (binding?.value.kind === \"secret\") {\n      const secret = yield* ctx.secrets.getAtScope(binding.value.secretId, binding.scopeId).pipe(\n        Effect.catchTag(\"SecretOwnedByConnectionError\", () =>\n          Effect.fail(\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve header auth binding \"${auth.secretSlot}\"`,\n            }),\n          ),\n        ),\n      );\n      if (secret === null) {\n        return yield* new McpConnectionError({\n          transport: \"remote\",\n          message: `Missing secret for header auth binding \"${auth.secretSlot}\"`,\n        });\n      }\n      return { [auth.headerName]: auth.prefix ? `${auth.prefix}${secret}` : secret };\n    }\n    if (binding?.value.kind === \"text\") {\n      return {\n        [auth.headerName]: auth.prefix ? `${auth.prefix}${binding.value.text}` : binding.value.text,\n      };\n    }\n    return yield* new McpConnectionError({\n      transport: \"remote\",\n      message: `Missing header auth binding \"${auth.secretSlot}\"`,\n    });\n  });\n\nconst resolveMcpStoredOauthProvider = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n  auth: McpConnectionAuth,\n): Effect.Effect<OAuthClientProvider | undefined, McpConnectionError | StorageFailure> =>\n  Effect.gen(function* () {\n    if (auth.kind !== \"oauth2\") return undefined;\n    const binding = yield* resolveMcpSourceBinding(ctx, sourceId, sourceScope, auth.connectionSlot);\n    if (binding?.value.kind !== \"connection\") {\n      return yield* new McpConnectionError({\n        transport: \"remote\",\n        message: `Missing OAuth connection binding for MCP source \"${sourceId}\"`,\n      });\n    }\n    const connectionId = binding.value.connectionId;\n    const accessToken = yield* ctx.connections\n      .accessTokenAtScope(connectionId, binding.scopeId)\n      .pipe(\n        Effect.mapError(\n          ({ message }) =>\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve OAuth connection \"${connectionId}\": ${message}`,\n            }),\n        ),\n      );\n    return makeOAuthProvider(accessToken);\n  });\n\nconst resolveMcpInputAuth = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n  targetScope: string | undefined,\n  auth: McpConnectionAuthInput | undefined,\n): Effect.Effect<\n  { readonly headers: Record<string, string>; readonly authProvider?: OAuthClientProvider },\n  McpConnectionError | StorageFailure\n> =>\n  Effect.gen(function* () {\n    if (!auth || auth.kind === \"none\") return { headers: {} };\n    if (auth.kind === \"header\") {\n      if (\"secretSlot\" in auth) {\n        const headers = yield* resolveMcpHeaderAuth(ctx, sourceId, sourceScope, auth);\n        return { headers };\n      }\n      const secretScope = auth.secretScopeId ?? auth.targetScope ?? targetScope ?? sourceScope;\n      const secret = yield* ctx.secrets.getAtScope(SecretId.make(auth.secretId), secretScope).pipe(\n        Effect.catchTag(\"SecretOwnedByConnectionError\", () =>\n          Effect.fail(\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve secret \"${auth.secretId}\"`,\n            }),\n          ),\n        ),\n      );\n      if (secret === null) {\n        return yield* new McpConnectionError({\n          transport: \"remote\",\n          message: `Failed to resolve secret \"${auth.secretId}\"`,\n        });\n      }\n      return {\n        headers: { [auth.headerName]: auth.prefix ? `${auth.prefix}${secret}` : secret },\n      };\n    }\n    const connection =\n      \"connectionId\" in auth\n        ? { id: ConnectionId.make(auth.connectionId), scope: targetScope ?? sourceScope }\n        : yield* Effect.gen(function* () {\n            const binding = yield* resolveMcpSourceBinding(\n              ctx,\n              sourceId,\n              sourceScope,\n              auth.connectionSlot,\n            );\n            return binding?.value.kind === \"connection\"\n              ? { id: binding.value.connectionId, scope: binding.scopeId }\n              : null;\n          });\n    if (connection === null) {\n      return yield* new McpConnectionError({\n        transport: \"remote\",\n        message: `Missing OAuth connection binding for MCP source \"${sourceId}\"`,\n      });\n    }\n    const accessToken = yield* ctx.connections\n      .accessTokenAtScope(connection.id, connection.scope)\n      .pipe(\n        Effect.mapError(\n          ({ message }) =>\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve OAuth connection \"${connection.id}\": ${message}`,\n            }),\n        ),\n      );\n    return { headers: {}, authProvider: makeOAuthProvider(accessToken) };\n  });\n\n// ---------------------------------------------------------------------------\n// Shared connector resolution — reads secrets, builds stdio/remote input\n// ---------------------------------------------------------------------------\n\nconst resolveConnectorInput = (\n  sourceId: string,\n  sourceScope: string,\n  sd: McpStoredSourceData,\n  ctx: PluginCtx<McpBindingStore>,\n  allowStdio: boolean,\n): Effect.Effect<ConnectorInput, McpConnectionError | StorageFailure> => {\n  if (sd.transport === \"stdio\") {\n    if (!allowStdio) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message:\n            \"MCP stdio transport is disabled. Enable it by passing `dangerouslyAllowStdioMCP: true` to mcpPlugin() — only safe for trusted local contexts.\",\n        }),\n      );\n    }\n    return Effect.succeed({\n      transport: \"stdio\" as const,\n      command: sd.command,\n      args: sd.args,\n      env: sd.env,\n      cwd: sd.cwd,\n    });\n  }\n\n  return Effect.gen(function* () {\n    const resolvedHeaders = yield* resolveMcpBindingValueMap(ctx, sd.headers, {\n      sourceId,\n      sourceScope,\n      missingLabel: \"header\",\n    });\n    const resolvedQueryParams = yield* resolveMcpBindingValueMap(ctx, sd.queryParams, {\n      sourceId,\n      sourceScope,\n      missingLabel: \"query parameter\",\n    });\n    const headers: Record<string, string> = { ...(resolvedHeaders ?? {}) };\n\n    const auth = sd.auth;\n    if (auth.kind === \"header\") {\n      Object.assign(headers, yield* resolveMcpHeaderAuth(ctx, sourceId, sourceScope, auth));\n    }\n    const authProvider = yield* resolveMcpStoredOauthProvider(ctx, sourceId, sourceScope, auth);\n\n    return {\n      transport: \"remote\" as const,\n      endpoint: sd.endpoint,\n      remoteTransport: sd.remoteTransport,\n      queryParams: resolvedQueryParams,\n      headers: Object.keys(headers).length > 0 ? headers : undefined,\n      authProvider,\n    };\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Connection cache — kept as plugin-module state so both invokeTool and\n// the close hook see the same ScopedCache instance. The ScopedCache's\n// lookup key is the stringified stored source data identity.\n// ---------------------------------------------------------------------------\n\ninterface McpRuntime {\n  readonly connectionCache: ScopedCache.ScopedCache<string, McpConnection, McpConnectionError>;\n  readonly pendingConnectors: Map<string, Effect.Effect<McpConnection, McpConnectionError>>;\n  readonly cacheScope: Scope.Closeable;\n}\n\nconst makeRuntime = (): Effect.Effect<McpRuntime, never> =>\n  Effect.gen(function* () {\n    const cacheScope = yield* Scope.make();\n    const pendingConnectors = new Map<string, Effect.Effect<McpConnection, McpConnectionError>>();\n    const connectionCache = yield* ScopedCache.make({\n      lookup: (key: string) =>\n        Effect.acquireRelease(\n          Effect.suspend(() => {\n            const connector = pendingConnectors.get(key);\n            if (!connector) {\n              return Effect.fail(\n                new McpConnectionError({\n                  transport: \"auto\",\n                  message: `No pending connector for key: ${key}`,\n                }),\n              );\n            }\n            return connector;\n          }),\n          (connection) =>\n            Effect.ignore(\n              Effect.tryPromise({\n                try: () => connection.close(),\n                catch: () =>\n                  new McpConnectionError({\n                    transport: \"auto\",\n                    message: \"Failed to close MCP connection\",\n                  }),\n              }),\n            ),\n        ),\n      capacity: 64,\n      timeToLive: Duration.minutes(5),\n    }).pipe(Scope.provide(cacheScope));\n\n    return { connectionCache, pendingConnectors, cacheScope };\n  });\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\nexport interface McpPluginOptions {\n  /**\n   * Allow configuring stdio-transport MCP sources. Off by default.\n   *\n   * Stdio sources spawn a local subprocess that inherits the parent\n   * `process.env`. Only enable for trusted single-user contexts.\n   */\n  readonly dangerouslyAllowStdioMCP?: boolean;\n  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;\n  /** If provided, source add/remove is mirrored to executor.jsonc\n   *  (best-effort — file errors are logged, not raised). */\n  readonly configFile?: ConfigFileSink;\n}\n\nconst secretRef = (id: string): string => `${SECRET_REF_PREFIX}${id}`;\n\nconst authToConfig = (auth: McpConnectionAuthInput | undefined): McpAuthConfig | undefined => {\n  if (!auth) return undefined;\n  if (auth.kind === \"none\") return { kind: \"none\" };\n  if (auth.kind === \"header\") {\n    if (!(\"secretId\" in auth)) return undefined;\n    return {\n      kind: \"header\",\n      headerName: auth.headerName,\n      secret: secretRef(auth.secretId),\n      prefix: auth.prefix,\n    };\n  }\n  if (!(\"connectionId\" in auth)) return undefined;\n  return {\n    kind: \"oauth2\",\n    connectionId: auth.connectionId,\n  };\n};\n\n// ---------------------------------------------------------------------------\n// Storage-form → input-form reconstruction\n//\n// `toMcpConfigEntry` consumes the `McpSourceConfig` *input* shape — the\n// legacy form with `secretId` / `connectionId`, which `authToConfig` and\n// `plainStringMap` know how to render into the file. Stored remote data\n// is in slot form (`secretSlot`, `{kind: \"binding\", slot}`), so writing\n// the file from a stored row needs the slot → secret/connection lookups\n// realized first. Walk the source's `credential_binding` rows and rebuild\n// the input shape; any slot whose binding is missing is dropped.\n// ---------------------------------------------------------------------------\n\nconst toCredentialInput = (\n  bySlot: Map<string, CredentialBindingValue>,\n  configured: ConfiguredMcpCredentialValue,\n): McpCredentialInput | undefined => {\n  if (typeof configured === \"string\") return configured;\n  const value = bySlot.get(configured.slot);\n  if (!value) return undefined;\n  if (value.kind === \"secret\") {\n    return {\n      secretId: value.secretId,\n      ...(configured.prefix ? { prefix: configured.prefix } : {}),\n    };\n  }\n  if (value.kind === \"text\") return value.text;\n  // headers / queryParams cannot reference connections — only auth can.\n  return undefined;\n};\n\nconst toCredentialInputMap = (\n  bySlot: Map<string, CredentialBindingValue>,\n  values: Record<string, ConfiguredMcpCredentialValue> | undefined,\n): Record<string, McpCredentialInput> | undefined => {\n  if (!values) return undefined;\n  const out: Record<string, McpCredentialInput> = {};\n  for (const [name, configured] of Object.entries(values)) {\n    const input = toCredentialInput(bySlot, configured);\n    if (input !== undefined) out[name] = input;\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n};\n\nconst toAuthInput = (\n  bySlot: Map<string, CredentialBindingValue>,\n  auth: McpConnectionAuth,\n): McpConnectionAuthInput | undefined => {\n  if (auth.kind === \"none\") return { kind: \"none\" };\n  if (auth.kind === \"header\") {\n    const value = bySlot.get(auth.secretSlot);\n    if (value?.kind !== \"secret\") return undefined;\n    return {\n      kind: \"header\",\n      headerName: auth.headerName,\n      secretId: value.secretId,\n      prefix: auth.prefix,\n    };\n  }\n  const connection = bySlot.get(auth.connectionSlot);\n  if (connection?.kind !== \"connection\") return undefined;\n  return { kind: \"oauth2\", connectionId: connection.connectionId };\n};\n\nconst inputFormFromStored = (\n  bindings: ReadonlyArray<CredentialBindingRef>,\n  stored: McpStoredSourceData,\n  scope: string,\n  sourceName: string,\n  namespace: string,\n): McpSourceConfig => {\n  if (stored.transport === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      scope,\n      name: sourceName,\n      namespace,\n      command: stored.command,\n      args: stored.args ? [...stored.args] : undefined,\n      env: stored.env,\n      cwd: stored.cwd,\n    };\n  }\n  const bySlot = new Map(bindings.map((b) => [b.slotKey, b.value] as const));\n  return {\n    transport: \"remote\",\n    scope,\n    name: sourceName,\n    namespace,\n    endpoint: stored.endpoint,\n    remoteTransport: stored.remoteTransport,\n    headers: toCredentialInputMap(bySlot, stored.headers),\n    queryParams: toCredentialInputMap(bySlot, stored.queryParams),\n    auth: toAuthInput(bySlot, stored.auth),\n  };\n};\n\nconst toMcpConfigEntry = (\n  namespace: string,\n  sourceName: string,\n  config: McpSourceConfig,\n): SourceConfig => {\n  if (config.transport === \"stdio\") {\n    const entry: McpStdioConfigEntry = {\n      kind: \"mcp\",\n      transport: \"stdio\",\n      name: sourceName,\n      command: config.command,\n      args: config.args,\n      env: config.env,\n      cwd: config.cwd,\n      namespace,\n    };\n    return entry;\n  }\n  const entry: McpRemoteConfigEntry = {\n    kind: \"mcp\",\n    transport: \"remote\",\n    name: sourceName,\n    endpoint: config.endpoint,\n    remoteTransport: config.remoteTransport,\n    queryParams: plainStringMap(config.queryParams),\n    headers: plainStringMap(config.headers),\n    namespace,\n    auth: authToConfig(config.auth),\n  };\n  return entry;\n};\n\nexport const mcpPlugin = definePlugin((options?: McpPluginOptions) => {\n  const allowStdio = options?.dangerouslyAllowStdioMCP ?? false;\n  // Per-plugin-instance runtime holder. Captured by closures in\n  // `extension`, `invokeTool`, and `close`, so all three see the same\n  // connection cache across a single createExecutor lifecycle.\n  const runtimeRef: { current: McpRuntime | null } = { current: null };\n\n  const ensureRuntime = (): Effect.Effect<McpRuntime, never> =>\n    runtimeRef.current\n      ? Effect.succeed(runtimeRef.current)\n      : makeRuntime().pipe(\n          Effect.tap((rt) =>\n            Effect.sync(() => {\n              runtimeRef.current = rt;\n            }),\n          ),\n        );\n\n  return {\n    id: \"mcp\" as const,\n    packageName: \"@executor-js/plugin-mcp\",\n    // Surfaced to the client bundle via the Vite plugin (see\n    // `@executor-js/vite-plugin`). The MCP `./client` factory reads\n    // `allowStdio` and gates the stdio tab + presets in AddMcpSource —\n    // so the server's `dangerouslyAllowStdioMCP` flag is the single\n    // source of truth for both runtime and UI.\n    clientConfig: { allowStdio },\n    schema: mcpSchema,\n    storage: (deps): McpBindingStore => makeMcpStore(deps),\n\n    extension: (ctx) => {\n      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;\n      const probeEndpoint = (input: string | McpProbeEndpointInput) =>\n        Effect.gen(function* () {\n          const endpoint = typeof input === \"string\" ? input : input.endpoint;\n          const trimmed = endpoint.trim();\n          if (!trimmed) {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: \"Endpoint URL is required\",\n            });\n          }\n\n          const name = yield* Effect.try({\n            try: () => new URL(trimmed).hostname,\n            catch: () => \"mcp\",\n          }).pipe(Effect.orElseSucceed(() => \"mcp\"));\n          const namespace = deriveMcpNamespace({ endpoint: trimmed });\n\n          const probeHeaders =\n            typeof input === \"string\"\n              ? undefined\n              : yield* resolveSecretBackedMap(input.headers, ctx);\n          const probeQueryParams =\n            typeof input === \"string\"\n              ? undefined\n              : yield* resolveSecretBackedMap(input.queryParams, ctx);\n\n          const connector = createMcpConnector({\n            transport: \"remote\",\n            endpoint: trimmed,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n\n          const result = yield* discoverTools(connector).pipe(\n            Effect.map((m) => ({ ok: true as const, manifest: m })),\n            Effect.catch(() => Effect.succeed({ ok: false as const, manifest: null })),\n            Effect.withSpan(\"mcp.plugin.discover_tools\"),\n          );\n\n          if (result.ok && result.manifest) {\n            return {\n              connected: true,\n              requiresOAuth: false,\n              supportsDynamicRegistration: false,\n              name: result.manifest.server?.name ?? name,\n              namespace,\n              toolCount: result.manifest.tools.length,\n              serverName: result.manifest.server?.name ?? null,\n            } satisfies McpProbeResult;\n          }\n\n          // Before asking the core OAuth service to look for metadata,\n          // confirm the endpoint actually speaks MCP. An OAuth-protected\n          // non-MCP service (e.g. a GraphQL API whose host publishes\n          // RFC 9728 + 8414 metadata) would otherwise pass the OAuth\n          // probe and be misclassified as MCP. The shape probe rejects\n          // anything whose initialize response isn't 2xx or 401+Bearer.\n          const shape = yield* probeMcpEndpointShape(trimmed, {\n            httpClientLayer,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n          if (shape.kind !== \"mcp\") {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: userFacingProbeMessage(shape),\n            });\n          }\n\n          const probeResult = yield* ctx.oauth\n            .probe({\n              endpoint: trimmed,\n              headers: probeHeaders,\n              queryParams: probeQueryParams,\n            })\n            .pipe(\n              Effect.map((oauth) => ({ ok: true as const, oauth })),\n              Effect.catch(() => Effect.succeed({ ok: false as const, oauth: null })),\n              Effect.withSpan(\"mcp.plugin.probe_oauth\"),\n            );\n\n          if (probeResult.ok) {\n            return {\n              connected: false,\n              requiresOAuth: true,\n              supportsDynamicRegistration: probeResult.oauth.supportsDynamicRegistration,\n              name,\n              namespace,\n              toolCount: null,\n              serverName: null,\n            } satisfies McpProbeResult;\n          }\n\n          return yield* new McpConnectionError({\n            transport: \"remote\",\n            message:\n              \"This server requires authentication, but OAuth metadata wasn't found. Add credentials (Authorization header, query parameter, or API key) below and retry.\",\n          });\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.probe_endpoint\", {\n            attributes: { \"mcp.endpoint\": typeof input === \"string\" ? input : input.endpoint },\n          }),\n        );\n\n      const configFile = options?.configFile;\n\n      const addSource = (config: McpSourceConfig) =>\n        Effect.gen(function* () {\n          const namespace = normalizeNamespace(config);\n          const canonicalRemote =\n            config.transport === \"remote\"\n              ? {\n                  headers: canonicalizeCredentialMap(config.headers, mcpHeaderSlot),\n                  queryParams: canonicalizeCredentialMap(config.queryParams, mcpQueryParamSlot),\n                  auth: canonicalizeAuth(config.auth),\n                }\n              : null;\n          const directBindings = canonicalRemote\n            ? [\n                ...canonicalRemote.headers.bindings,\n                ...canonicalRemote.queryParams.bindings,\n                ...canonicalRemote.auth.bindings,\n              ]\n            : [];\n          for (const binding of directBindings) {\n            const bindingTargetScope = yield* targetScopeForBinding(\n              config.transport === \"remote\" ? config.credentialTargetScope : undefined,\n              binding,\n            );\n            yield* validateMcpBindingTarget(ctx, {\n              sourceId: namespace,\n              sourceScope: config.scope,\n              targetScope: bindingTargetScope,\n            });\n          }\n          const targetScope =\n            config.transport === \"remote\" && directBindings[0]\n              ? yield* targetScopeForBinding(config.credentialTargetScope, directBindings[0])\n              : undefined;\n          const sd = toStoredSourceData(\n            config,\n            canonicalRemote\n              ? {\n                  headers: canonicalRemote.headers.values,\n                  queryParams: canonicalRemote.queryParams.values,\n                  auth: canonicalRemote.auth.auth,\n                }\n              : undefined,\n          );\n\n          // Stdio sources are gated — a resolver failure there is a\n          // config error the admin must fix before the source makes\n          // sense to persist at all. For remote sources we defer the\n          // resolver failure: auth might not be ready yet (oauth2\n          // connection awaiting per-user sign-in, header secret\n          // awaiting upload) but the source row should still land so\n          // it shows up in the list and exposes a Sign-in affordance.\n          const resolved = yield* (\n            config.transport === \"remote\"\n              ? Effect.gen(function* () {\n                  const resolvedHeaders = yield* resolveMcpCredentialInputMap(ctx, config.headers, {\n                    sourceId: namespace,\n                    sourceScope: config.scope,\n                    targetScope,\n                    missingLabel: \"header\",\n                  });\n                  const resolvedQueryParams = yield* resolveMcpCredentialInputMap(\n                    ctx,\n                    config.queryParams,\n                    {\n                      sourceId: namespace,\n                      sourceScope: config.scope,\n                      targetScope,\n                      missingLabel: \"query parameter\",\n                    },\n                  );\n                  const resolvedAuth = yield* resolveMcpInputAuth(\n                    ctx,\n                    namespace,\n                    config.scope,\n                    targetScope,\n                    config.auth,\n                  );\n                  const headers = {\n                    ...(resolvedHeaders ?? {}),\n                    ...resolvedAuth.headers,\n                  };\n                  return {\n                    transport: \"remote\" as const,\n                    endpoint: config.endpoint,\n                    remoteTransport: config.remoteTransport ?? \"auto\",\n                    queryParams: resolvedQueryParams,\n                    headers: Object.keys(headers).length > 0 ? headers : undefined,\n                    authProvider: resolvedAuth.authProvider,\n                  };\n                })\n              : resolveConnectorInput(namespace, config.scope, sd, ctx, allowStdio)\n          ).pipe(\n            Effect.result,\n            Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n              attributes: {\n                \"mcp.source.namespace\": namespace,\n                \"mcp.source.transport\": sd.transport,\n              },\n            }),\n          );\n\n          if (Result.isFailure(resolved) && sd.transport === \"stdio\") {\n            return yield* Effect.fail(resolved.failure);\n          }\n\n          // Try discovery only if we have a live connector input.\n          // Otherwise fall straight through to the persist step with\n          // an empty manifest and surface the resolver failure to\n          // the caller at the end.\n          const discovery: Result.Result<\n            McpToolManifest,\n            McpToolDiscoveryError | McpConnectionError | StorageFailure\n          > = Result.isSuccess(resolved)\n            ? yield* discoverTools(createMcpConnector(resolved.success)).pipe(\n                Effect.mapError(\n                  ({ message }) =>\n                    new McpToolDiscoveryError({\n                      stage: \"list_tools\",\n                      message: `MCP discovery failed: ${message}`,\n                    }),\n                ),\n                Effect.result,\n                Effect.withSpan(\"mcp.plugin.discover_tools\", {\n                  attributes: { \"mcp.source.namespace\": namespace },\n                }),\n              )\n            : Result.fail(resolved.failure);\n          const manifest = Result.isSuccess(discovery)\n            ? discovery.success\n            : { server: undefined, tools: [] as const };\n\n          const sourceName = config.name ?? manifest.server?.name ?? namespace;\n\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                // Remove stale rows at the target scope (plugin-owned).\n                // Pinning scope keeps a shadowed outer-scope row intact\n                // when a per-user addSource re-uses the same namespace.\n                yield* ctx.storage.removeBindingsByNamespace(namespace, config.scope);\n                yield* ctx.storage.removeSource(namespace, config.scope);\n\n                yield* ctx.storage.putSource({\n                  namespace,\n                  scope: config.scope,\n                  name: sourceName,\n                  config: sd,\n                });\n\n                yield* ctx.storage.putBindings(\n                  namespace,\n                  config.scope,\n                  manifest.tools.map((e) => ({\n                    toolId: `${namespace}.${e.toolId}`,\n                    binding: toBinding(e),\n                  })),\n                );\n\n                yield* ctx.core.sources.register({\n                  id: namespace,\n                  scope: config.scope,\n                  kind: \"mcp\",\n                  name: sourceName,\n                  url: sd.transport === \"remote\" ? sd.endpoint : undefined,\n                  canRemove: true,\n                  canRefresh: true,\n                  canEdit: sd.transport === \"remote\",\n                  tools: manifest.tools.map((e) => ({\n                    name: e.toolId,\n                    description: e.description ?? `MCP tool: ${e.toolName}`,\n                    inputSchema: e.inputSchema,\n                    outputSchema: e.outputSchema,\n                  })),\n                });\n\n                if (directBindings.length > 0) {\n                  for (const binding of directBindings) {\n                    const bindingTargetScope = yield* targetScopeForBinding(\n                      config.transport === \"remote\" ? config.credentialTargetScope : undefined,\n                      binding,\n                    );\n                    yield* ctx.credentialBindings.set({\n                      targetScope: ScopeId.make(bindingTargetScope),\n                      pluginId: MCP_PLUGIN_ID,\n                      sourceId: namespace,\n                      sourceScope: ScopeId.make(config.scope),\n                      slotKey: binding.slot,\n                      value: binding.value,\n                    });\n                  }\n                }\n              }),\n            )\n            .pipe(\n              Effect.withSpan(\"mcp.plugin.persist_source\", {\n                attributes: {\n                  \"mcp.source.namespace\": namespace,\n                  \"mcp.source.tool_count\": manifest.tools.length,\n                },\n              }),\n            );\n\n          if (configFile) {\n            yield* configFile\n              .upsertSource(toMcpConfigEntry(namespace, sourceName, config))\n              .pipe(Effect.withSpan(\"mcp.plugin.config_file.upsert\"));\n          }\n\n          if (Result.isFailure(discovery)) {\n            return yield* Effect.fail(discovery.failure);\n          }\n          return { toolCount: manifest.tools.length, namespace };\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.add_source\", {\n            attributes: {\n              \"mcp.source.transport\": config.transport,\n              \"mcp.source.name\": config.name,\n            },\n          }),\n        );\n\n      const removeSource = (namespace: string, scope: string) =>\n        Effect.gen(function* () {\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                yield* ctx.credentialBindings.removeForSource({\n                  pluginId: MCP_PLUGIN_ID,\n                  sourceId: namespace,\n                  sourceScope: ScopeId.make(scope),\n                });\n                yield* ctx.storage.removeBindingsByNamespace(namespace, scope);\n                yield* ctx.storage.removeSource(namespace, scope);\n                yield* ctx.core.sources.unregister({ id: namespace, targetScope: scope });\n              }),\n            )\n            .pipe(Effect.withSpan(\"mcp.plugin.persist_remove\"));\n          if (configFile) {\n            yield* configFile\n              .removeSource(namespace)\n              .pipe(Effect.withSpan(\"mcp.plugin.config_file.remove\"));\n          }\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.remove_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const refreshSource = (namespace: string, scope: string) =>\n        Effect.gen(function* () {\n          const sd = yield* ctx.storage.getSourceConfig(namespace, scope).pipe(\n            Effect.withSpan(\"mcp.plugin.load_source_config\", {\n              attributes: { \"mcp.source.namespace\": namespace },\n            }),\n          );\n          if (!sd) {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: `No stored config for MCP source \"${namespace}\"`,\n            });\n          }\n\n          const ci = yield* resolveConnectorInput(namespace, scope, sd, ctx, allowStdio).pipe(\n            Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n              attributes: {\n                \"mcp.source.namespace\": namespace,\n                \"mcp.source.transport\": sd.transport,\n              },\n            }),\n          );\n          const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(\n            Effect.mapError(\n              ({ message }) =>\n                new McpToolDiscoveryError({\n                  stage: \"list_tools\",\n                  message: `MCP refresh failed: ${message}`,\n                }),\n            ),\n            Effect.withSpan(\"mcp.plugin.discover_tools\", {\n              attributes: { \"mcp.source.namespace\": namespace },\n            }),\n          );\n\n          const existing = yield* ctx.storage.getSource(namespace, scope);\n          const sourceName = manifest.server?.name ?? existing?.name ?? namespace;\n\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                yield* ctx.storage.removeBindingsByNamespace(namespace, scope);\n                yield* ctx.core.sources.unregister({ id: namespace, targetScope: scope });\n\n                yield* ctx.storage.putBindings(\n                  namespace,\n                  scope,\n                  manifest.tools.map((e) => ({\n                    toolId: `${namespace}.${e.toolId}`,\n                    binding: toBinding(e),\n                  })),\n                );\n                yield* ctx.core.sources.register({\n                  id: namespace,\n                  scope,\n                  kind: \"mcp\",\n                  name: sourceName,\n                  url: sd.transport === \"remote\" ? sd.endpoint : undefined,\n                  canRemove: true,\n                  canRefresh: true,\n                  canEdit: sd.transport === \"remote\",\n                  tools: manifest.tools.map((e) => ({\n                    name: e.toolId,\n                    description: e.description ?? `MCP tool: ${e.toolName}`,\n                    inputSchema: e.inputSchema,\n                    outputSchema: e.outputSchema,\n                  })),\n                });\n              }),\n            )\n            .pipe(\n              Effect.withSpan(\"mcp.plugin.persist_source\", {\n                attributes: {\n                  \"mcp.source.namespace\": namespace,\n                  \"mcp.source.tool_count\": manifest.tools.length,\n                },\n              }),\n            );\n\n          return { toolCount: manifest.tools.length };\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.refresh_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const updateSource = (namespace: string, scope: string, input: McpUpdateSourceInput) =>\n        Effect.gen(function* () {\n          const existing = yield* ctx.storage.getSource(namespace, scope);\n          if (!existing || existing.config.transport !== \"remote\") return;\n\n          const canonicalHeaders =\n            input.headers !== undefined\n              ? canonicalizeCredentialMap(input.headers, mcpHeaderSlot)\n              : null;\n          const canonicalQueryParams =\n            input.queryParams !== undefined\n              ? canonicalizeCredentialMap(input.queryParams, mcpQueryParamSlot)\n              : null;\n          const canonicalAuth = input.auth !== undefined ? canonicalizeAuth(input.auth) : null;\n          const directBindings = [\n            ...(canonicalHeaders?.bindings ?? []),\n            ...(canonicalQueryParams?.bindings ?? []),\n            ...(canonicalAuth?.bindings ?? []),\n          ];\n          const targetScope = yield* bindingTargetScope(\n            input.credentialTargetScope,\n            directBindings,\n          );\n          if (targetScope) {\n            yield* validateMcpBindingTarget(ctx, {\n              sourceId: namespace,\n              sourceScope: scope,\n              targetScope,\n            });\n          }\n\n          const remote = existing.config;\n          const updatedConfig: McpStoredSourceData = {\n            ...remote,\n            ...(input.endpoint !== undefined ? { endpoint: input.endpoint } : {}),\n            ...(canonicalHeaders ? { headers: canonicalHeaders.values } : {}),\n            ...(canonicalAuth ? { auth: canonicalAuth.auth } : {}),\n            ...(canonicalQueryParams ? { queryParams: canonicalQueryParams.values } : {}),\n          };\n          const sourceName = input.name?.trim() || existing.name;\n\n          const affectedPrefixes = [\n            ...(input.headers !== undefined ? [\"header:\"] : []),\n            ...(input.queryParams !== undefined ? [\"query_param:\"] : []),\n            ...(input.auth !== undefined ? [\"auth:\"] : []),\n          ];\n          const replacementTargetScope = targetScope ?? input.credentialTargetScope ?? scope;\n          yield* ctx.transaction(\n            Effect.gen(function* () {\n              yield* ctx.storage.putSource({\n                namespace,\n                scope,\n                name: sourceName,\n                config: updatedConfig,\n              });\n              if (affectedPrefixes.length > 0 || directBindings.length > 0) {\n                yield* ctx.credentialBindings.replaceForSource({\n                  targetScope: ScopeId.make(replacementTargetScope),\n                  pluginId: MCP_PLUGIN_ID,\n                  sourceId: namespace,\n                  sourceScope: ScopeId.make(scope),\n                  slotPrefixes: affectedPrefixes,\n                  bindings: directBindings.map((binding) => ({\n                    slotKey: binding.slot,\n                    value: binding.value,\n                  })),\n                });\n              }\n            }),\n          );\n\n          if (configFile) {\n            const bindings = yield* ctx.credentialBindings.listForSource({\n              pluginId: MCP_PLUGIN_ID,\n              sourceId: namespace,\n              sourceScope: ScopeId.make(scope),\n            });\n            const inputForm = inputFormFromStored(\n              bindings,\n              updatedConfig,\n              scope,\n              sourceName,\n              namespace,\n            );\n            yield* configFile\n              .upsertSource(toMcpConfigEntry(namespace, sourceName, inputForm))\n              .pipe(Effect.withSpan(\"mcp.plugin.config_file.upsert\"));\n          }\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.update_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const getSource = (namespace: string, scope: string) =>\n        ctx.storage.getSource(namespace, scope).pipe(\n          Effect.withSpan(\"mcp.plugin.get_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      return {\n        probeEndpoint,\n        addSource,\n        removeSource,\n        refreshSource,\n        getSource,\n        updateSource,\n        listSourceBindings: (sourceId: string, sourceScope: string) =>\n          listMcpSourceBindings(ctx, sourceId, sourceScope),\n        setSourceBinding: (input: McpSourceBindingInput) =>\n          Effect.gen(function* () {\n            yield* validateMcpBindingTarget(ctx, {\n              sourceId: input.sourceId,\n              sourceScope: input.sourceScope,\n              targetScope: input.scope,\n            });\n            const binding = yield* ctx.credentialBindings.set({\n              targetScope: input.scope,\n              pluginId: MCP_PLUGIN_ID,\n              sourceId: input.sourceId,\n              sourceScope: input.sourceScope,\n              slotKey: input.slot,\n              value: input.value,\n            });\n            return coreBindingToMcpBinding(binding);\n          }),\n        removeSourceBinding: (sourceId: string, sourceScope: string, slot: string, scope: string) =>\n          Effect.gen(function* () {\n            yield* validateMcpBindingTarget(ctx, {\n              sourceId,\n              sourceScope,\n              targetScope: scope,\n            });\n            yield* ctx.credentialBindings.remove({\n              targetScope: ScopeId.make(scope),\n              pluginId: MCP_PLUGIN_ID,\n              sourceId,\n              sourceScope: ScopeId.make(sourceScope),\n              slotKey: slot,\n            });\n          }),\n      };\n    },\n\n    invokeTool: ({ ctx, toolRow, args, elicit }) =>\n      Effect.gen(function* () {\n        const runtime = yield* ensureRuntime();\n\n        // toolRow.scope_id is the resolved owning scope of the tool\n        // (innermost-wins from the executor's stack). The matching\n        // mcp_binding + mcp_source rows live at the same scope, so\n        // pin every store lookup to it instead of relying on the\n        // scoped adapter's stack-wide fall-through.\n        const toolScope = toolRow.scope_id;\n        const entry = yield* ctx.storage.getBinding(toolRow.id, toolScope).pipe(\n          Effect.withSpan(\"mcp.plugin.load_binding\", {\n            attributes: { \"mcp.tool.name\": toolRow.id },\n          }),\n        );\n        if (!entry) {\n          return yield* new McpInvocationError({\n            toolName: toolRow.id,\n            message: `No MCP binding found for tool \"${toolRow.id}\"`,\n          });\n        }\n\n        const sd = yield* ctx.storage.getSourceConfig(entry.namespace, toolScope).pipe(\n          Effect.withSpan(\"mcp.plugin.load_source_config\", {\n            attributes: { \"mcp.source.namespace\": entry.namespace },\n          }),\n        );\n        if (!sd) {\n          return yield* new McpConnectionError({\n            transport: \"auto\",\n            message: `No MCP source config for namespace \"${entry.namespace}\"`,\n          });\n        }\n\n        return yield* invokeMcpTool({\n          toolId: toolRow.id,\n          toolName: entry.binding.toolName,\n          args,\n          sourceData: sd,\n          sourceId: entry.namespace,\n          sourceScope: toolScope,\n          invokerScope: ctx.scopes[0]!.id,\n          resolveConnector: () =>\n            resolveConnectorInput(entry.namespace, toolScope, sd, ctx, allowStdio).pipe(\n              Effect.catchTags({\n                StorageError: () =>\n                  Effect.fail(\n                    new McpConnectionError({\n                      transport: sd.transport,\n                      message: \"Failed to resolve MCP connector storage state\",\n                    }),\n                  ),\n                UniqueViolationError: () =>\n                  Effect.fail(\n                    new McpConnectionError({\n                      transport: sd.transport,\n                      message: \"Failed to resolve MCP connector storage state\",\n                    }),\n                  ),\n              }),\n              Effect.flatMap((ci) => createMcpConnector(ci)),\n              Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n                attributes: {\n                  \"mcp.source.namespace\": entry.namespace,\n                  \"mcp.source.transport\": sd.transport,\n                },\n              }),\n            ),\n          connectionCache: runtime.connectionCache,\n          pendingConnectors: runtime.pendingConnectors,\n          elicit,\n        });\n      }).pipe(\n        Effect.withSpan(\"mcp.plugin.invoke_tool\", {\n          attributes: {\n            \"mcp.tool.name\": toolRow.id,\n            \"mcp.tool.source_id\": toolRow.source_id,\n          },\n        }),\n      ),\n\n    detect: ({ ctx, url }) =>\n      Effect.gen(function* () {\n        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;\n        const trimmed = url.trim();\n        if (!trimmed) return null;\n\n        const parsed = yield* Effect.try({\n          try: () => new URL(trimmed),\n          catch: (cause) => cause,\n        }).pipe(Effect.option);\n        if (Option.isNone(parsed)) return null;\n\n        const name = parsed.value.hostname || \"mcp\";\n        const namespace = deriveMcpNamespace({ endpoint: trimmed });\n\n        const connector = createMcpConnector({\n          transport: \"remote\",\n          endpoint: trimmed,\n        });\n\n        const connected = yield* discoverTools(connector).pipe(\n          Effect.map(() => true),\n          Effect.catch(() => Effect.succeed(false)),\n          Effect.withSpan(\"mcp.plugin.discover_tools\"),\n        );\n\n        if (connected) {\n          return SourceDetectionResult.make({\n            kind: \"mcp\",\n            confidence: \"high\",\n            endpoint: trimmed,\n            name,\n            namespace,\n          });\n        }\n\n        // The shape probe inspects the JSON-RPC `initialize` response\n        // and only classifies as MCP when the wire shape is\n        // unambiguous (2xx + JSON-RPC body, 2xx SSE, or 401 + Bearer +\n        // JSON-RPC error envelope). That body-shape gate is what\n        // separates real MCP servers — including those that\n        // authenticate with static API keys and publish no OAuth\n        // metadata — from unrelated OAuth-protected services whose\n        // host happens to expose RFC 9728/8414 documents.\n        const shape = yield* probeMcpEndpointShape(trimmed, { httpClientLayer });\n        if (shape.kind === \"mcp\") {\n          return SourceDetectionResult.make({\n            kind: \"mcp\",\n            confidence: \"high\",\n            endpoint: trimmed,\n            name,\n            namespace,\n          });\n        }\n\n        // Low-confidence URL-token fallback. When wire-shape detection\n        // can't confirm MCP (server unreachable, behind unusual auth,\n        // returns a non-canonical body, etc.) but the URL itself is a\n        // strong hint, surface a candidate so the user can still pick\n        // it from the detect dropdown rather than getting nothing.\n        if (urlMatchesToken(parsed.value, \"mcp\")) {\n          return SourceDetectionResult.make({\n            kind: \"mcp\",\n            confidence: \"low\",\n            endpoint: trimmed,\n            name,\n            namespace,\n          });\n        }\n\n        return null;\n      }).pipe(\n        Effect.catch(() => Effect.succeed(null)),\n        Effect.withSpan(\"mcp.plugin.detect\", {\n          attributes: { \"mcp.endpoint\": url },\n        }),\n      ),\n\n    // Honor upstream destructiveHint from MCP ToolAnnotations.\n    // Bindings are fetched per scope so shadowed sources (e.g. an org-level\n    // source overridden per-user) each resolve against their own scope's\n    // row rather than collapsing onto whichever row the scoped adapter\n    // sees first.\n    resolveAnnotations: ({ ctx, sourceId, toolRows }) =>\n      Effect.gen(function* () {\n        const scopes = new Set(toolRows.map((row) => row.scope_id));\n        const entries = yield* Effect.forEach(\n          [...scopes],\n          (scope) =>\n            Effect.gen(function* () {\n              const list = yield* ctx.storage.listBindingsBySource(sourceId, scope);\n              const byId = new Map(list.map((e) => [e.toolId, e.binding]));\n              return [scope, byId] as const;\n            }),\n          { concurrency: \"unbounded\" },\n        );\n        const byScope = new Map(entries);\n\n        const out: Record<string, ToolAnnotations> = {};\n        for (const row of toolRows) {\n          const binding = byScope.get(row.scope_id)?.get(row.id);\n          const ann = binding?.annotations;\n          if (ann?.destructiveHint === true) {\n            out[row.id] = {\n              requiresApproval: true,\n              approvalDescription: ann.title ?? binding?.toolName ?? row.id,\n            };\n          } else {\n            out[row.id] = { requiresApproval: false };\n          }\n        }\n        return out;\n      }),\n\n    removeSource: ({ ctx, sourceId, scope }) =>\n      Effect.gen(function* () {\n        yield* ctx.transaction(\n          Effect.gen(function* () {\n            yield* ctx.credentialBindings.removeForSource({\n              pluginId: MCP_PLUGIN_ID,\n              sourceId,\n              sourceScope: ScopeId.make(scope),\n            });\n            yield* ctx.storage.removeBindingsByNamespace(sourceId, scope);\n            yield* ctx.storage.removeSource(sourceId, scope);\n          }),\n        );\n        if (options?.configFile) {\n          yield* options.configFile.removeSource(sourceId);\n        }\n      }),\n\n    usagesForSecret: () => Effect.succeed([]),\n\n    usagesForConnection: () => Effect.succeed([]),\n\n    refreshSource: () => Effect.void,\n\n    // Connection refresh for oauth2-minted sources is owned by the\n    // canonical `\"oauth2\"` ConnectionProvider that core registers via\n    // `makeOAuth2Service`. No MCP-specific provider needed.\n\n    close: () =>\n      Effect.gen(function* () {\n        const runtime = runtimeRef.current;\n        if (runtime) {\n          runtime.pendingConnectors.clear();\n          yield* ScopedCache.invalidateAll(runtime.connectionCache);\n          yield* Scope.close(runtime.cacheScope, Exit.void);\n          runtimeRef.current = null;\n        }\n      }).pipe(Effect.withSpan(\"mcp.plugin.close\")),\n  };\n  // HTTP transport (routes/handlers/extensionService) is layered on by\n  // the api-aware factory in `@executor-js/plugin-mcp/api`. Hosts that\n  // want the HTTP surface import the plugin from there; SDK-only\n  // consumers stay on this entry and avoid the server-only deps.\n});\n\n// ---------------------------------------------------------------------------\n// McpPluginExtension — shape of `executor.mcp` for consumers that want\n// to type against it directly (api/, react/). Mirrors what `extension`\n// returns above.\n// ---------------------------------------------------------------------------\n\n/**\n * Errors any MCP extension method may surface. The first four are\n * plugin-domain tagged errors that flow directly to clients (4xx, each\n * carrying its own `HttpApiSchema` status). `StorageFailure` covers\n * raw backend failures (`StorageError`) plus `UniqueViolationError`;\n * the HTTP edge (`@executor-js/api`'s `withCapture`) translates\n * `StorageError` to the opaque `InternalError({ traceId })` at Layer\n * composition. `UniqueViolationError` passes through — plugins can\n * `Effect.catchTag` it if they want a friendlier user-facing error.\n */\nexport type McpExtensionFailure = McpConnectionError | McpToolDiscoveryError | StorageFailure;\n\nexport interface McpPluginExtension {\n  readonly probeEndpoint: (\n    input: string | McpProbeEndpointInput,\n  ) => Effect.Effect<McpProbeResult, McpExtensionFailure>;\n  readonly addSource: (\n    config: McpSourceConfig,\n  ) => Effect.Effect<\n    { readonly toolCount: number; readonly namespace: string },\n    McpExtensionFailure\n  >;\n  readonly removeSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<void, McpExtensionFailure>;\n  readonly refreshSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<{ readonly toolCount: number }, McpExtensionFailure>;\n  readonly getSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSource | null, McpExtensionFailure>;\n  readonly updateSource: (\n    namespace: string,\n    scope: string,\n    input: McpUpdateSourceInput,\n  ) => Effect.Effect<void, McpExtensionFailure>;\n  readonly listSourceBindings: (\n    sourceId: string,\n    sourceScope: string,\n  ) => Effect.Effect<readonly McpSourceBindingRef[], StorageFailure>;\n  readonly setSourceBinding: (\n    input: McpSourceBindingInput,\n  ) => Effect.Effect<McpSourceBindingRef, StorageFailure>;\n  readonly removeSourceBinding: (\n    sourceId: string,\n    sourceScope: string,\n    slot: string,\n    scope: string,\n  ) => Effect.Effect<void, StorageFailure>;\n}\n","import type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { SSEClientTransport } from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { CfWorkerJsonSchemaValidator } from \"@modelcontextprotocol/sdk/validation/cfworker\";\nimport { Effect } from \"effect\";\n\n// NOTE: `StdioClientTransport` is NOT imported eagerly. The upstream module\n// (`@modelcontextprotocol/sdk/client/stdio.js`) touches `node:child_process`\n// at evaluation time, which crashes workerd (incl. vitest-pool-workers) at\n// SIGSEGV on module instantiation. Cloud callers set\n// `dangerouslyAllowStdioMCP: false` and never reach the stdio branch below;\n// prod bundles that DO use stdio load it via a dynamic import inside the\n// stdio branch of `createMcpConnector`.\n\nimport type { McpRemoteSourceData, McpStdioSourceData } from \"./types\";\nimport { McpConnectionError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Connection type\n// ---------------------------------------------------------------------------\n\nexport type McpConnection = {\n  readonly client: Client;\n  readonly close: () => Promise<void>;\n};\n\nexport type McpConnector = Effect.Effect<McpConnection, McpConnectionError>;\n\n// ---------------------------------------------------------------------------\n// Connector input — extends stored source data with resolved auth\n// ---------------------------------------------------------------------------\n\nexport type RemoteConnectorInput = Omit<\n  McpRemoteSourceData,\n  \"auth\" | \"remoteTransport\" | \"headers\" | \"queryParams\"\n> & {\n  readonly remoteTransport?: McpRemoteSourceData[\"remoteTransport\"];\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n  readonly authProvider?: OAuthClientProvider;\n};\n\nexport type StdioConnectorInput = McpStdioSourceData;\n\nexport type ConnectorInput = RemoteConnectorInput | StdioConnectorInput;\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst buildEndpointUrl = (endpoint: string, queryParams: Record<string, string>): URL => {\n  const url = new URL(endpoint);\n  for (const [key, value] of Object.entries(queryParams)) {\n    url.searchParams.set(key, value);\n  }\n  return url;\n};\n\n// Use the cfworker JSON Schema validator instead of the SDK's default\n// (Ajv). Ajv compiles schemas via `new Function(...)`, which throws\n// `Code generation from strings disallowed for this context` when the\n// MCP plugin runs inside a Cloudflare Worker (executor.sh). The\n// cfworker validator does not use code generation and works in every\n// runtime we ship to.\nconst createClient = (): Client =>\n  new Client(\n    { name: \"executor-mcp\", version: \"0.1.0\" },\n    {\n      capabilities: { elicitation: { form: {}, url: {} } },\n      jsonSchemaValidator: new CfWorkerJsonSchemaValidator(),\n    },\n  );\n\nconst connectionFromClient = (client: Client): McpConnection => ({\n  client,\n  close: () => client.close(),\n});\n\nconst connectClient = (input: {\n  transport: string;\n  createTransport: () => Parameters<Client[\"connect\"]>[0];\n}): Effect.Effect<McpConnection, McpConnectionError> =>\n  Effect.gen(function* () {\n    const client = createClient();\n    const transportInstance = input.createTransport();\n\n    yield* Effect.tryPromise({\n      try: () => client.connect(transportInstance),\n      catch: () =>\n        new McpConnectionError({\n          transport: input.transport,\n          message: `Failed connecting via ${input.transport}`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.connection.handshake\", {\n        attributes: { \"plugin.mcp.transport\": input.transport },\n      }),\n    );\n\n    return connectionFromClient(client);\n  });\n\n// ---------------------------------------------------------------------------\n// Public factory\n// ---------------------------------------------------------------------------\n\nexport const createMcpConnector = (input: ConnectorInput): McpConnector => {\n  if (input.transport === \"stdio\") {\n    const command = input.command.trim();\n    if (!command) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message: \"MCP stdio transport requires a command\",\n        }),\n      );\n    }\n\n    return Effect.gen(function* () {\n      // Dynamic import so the underlying module (which evaluates\n      // `node:child_process`) is only loaded when stdio is actually used.\n      const { createStdioTransport } = yield* Effect.tryPromise({\n        try: () => import(\"./stdio-connector\"),\n        catch: () =>\n          new McpConnectionError({\n            transport: \"stdio\",\n            message: \"Failed to load stdio transport module\",\n          }),\n      });\n\n      return yield* connectClient({\n        transport: \"stdio\",\n        createTransport: () =>\n          createStdioTransport({\n            command,\n            args: input.args,\n            env: input.env,\n            cwd: input.cwd?.trim().length ? input.cwd.trim() : undefined,\n          }),\n      });\n    });\n  }\n\n  // Remote transport\n  const headers = input.headers ?? {};\n  const remoteTransport = input.remoteTransport ?? \"auto\";\n  const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;\n\n  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});\n\n  const connectStreamableHttp = connectClient({\n    transport: \"streamable-http\",\n    createTransport: () =>\n      new StreamableHTTPClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  const connectSse = connectClient({\n    transport: \"sse\",\n    createTransport: () =>\n      new SSEClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  if (remoteTransport === \"streamable-http\") return connectStreamableHttp;\n  if (remoteTransport === \"sse\") return connectSse;\n\n  // auto — try streamable-http first, fall back to SSE\n  return connectStreamableHttp.pipe(Effect.catch(() => connectSse));\n};\n","// ---------------------------------------------------------------------------\n// MCP tool discovery — connect to an MCP server and list its tools\n// ---------------------------------------------------------------------------\n\nimport { Effect } from \"effect\";\n\nimport type { McpConnector } from \"./connection\";\nimport { McpToolDiscoveryError } from \"./errors\";\nimport {\n  extractManifestFromListToolsResult,\n  isListToolsResult,\n  type McpToolManifest,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Connect to an MCP server and discover all available tools.\n * Returns the parsed manifest containing server metadata and tool entries.\n */\nexport const discoverTools = (\n  connector: McpConnector,\n): Effect.Effect<McpToolManifest, McpToolDiscoveryError> =>\n  Effect.gen(function* () {\n    // Acquire connection\n    const connection = yield* connector.pipe(\n      Effect.mapError(\n        ({ message }) =>\n          new McpToolDiscoveryError({\n            stage: \"connect\",\n            message: `Failed connecting to MCP server: ${message}`,\n          }),\n      ),\n    );\n\n    // List tools\n    const listResult = yield* Effect.tryPromise({\n      try: () => connection.client.listTools(),\n      catch: () =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"Failed listing MCP tools\",\n        }),\n    });\n\n    if (!isListToolsResult(listResult)) {\n      yield* closeConnection(connection);\n      return yield* new McpToolDiscoveryError({\n        stage: \"list_tools\",\n        message: \"MCP listTools response did not match the expected schema\",\n      });\n    }\n\n    const manifest = extractManifestFromListToolsResult(listResult, {\n      serverInfo: connection.client.getServerVersion?.(),\n    });\n\n    // Close the connection after discovery\n    yield* closeConnection(connection);\n\n    return manifest;\n  });\n\nconst closeConnection = (connection: {\n  readonly close: () => Promise<void>;\n}): Effect.Effect<void, never> =>\n  Effect.ignore(\n    Effect.tryPromise({\n      try: () => connection.close(),\n      catch: () =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"Failed closing MCP connection\",\n        }),\n    }),\n  );\n","import { Option, Schema } from \"effect\";\n\nimport { McpToolAnnotations } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Output types\n// ---------------------------------------------------------------------------\n\nexport interface McpToolManifestEntry {\n  readonly toolId: string;\n  readonly toolName: string;\n  readonly description: string | null;\n  readonly inputSchema?: unknown;\n  readonly outputSchema?: unknown;\n  readonly annotations?: McpToolAnnotations;\n}\n\nexport interface McpServerMetadata {\n  readonly name: string | null;\n  readonly version: string | null;\n}\n\nexport interface McpToolManifest {\n  readonly server: McpServerMetadata | null;\n  readonly tools: readonly McpToolManifestEntry[];\n}\n\n// ---------------------------------------------------------------------------\n// Schemas\n// ---------------------------------------------------------------------------\n\nconst ListedTool = Schema.Struct({\n  name: Schema.String,\n  description: Schema.optional(Schema.NullOr(Schema.String)),\n  inputSchema: Schema.optional(Schema.Unknown),\n  parameters: Schema.optional(Schema.Unknown),\n  outputSchema: Schema.optional(Schema.Unknown),\n  annotations: Schema.optional(McpToolAnnotations),\n});\n\nconst ListToolsResult = Schema.Struct({\n  tools: Schema.Array(ListedTool),\n});\n\nconst ServerInfo = Schema.Struct({\n  name: Schema.optional(Schema.String),\n  version: Schema.optional(Schema.String),\n});\n\nconst decodeListToolsResult = Schema.decodeUnknownOption(ListToolsResult);\nconst decodeServerInfo = Schema.decodeUnknownOption(ServerInfo);\n\nexport const isListToolsResult = (value: unknown): boolean =>\n  Option.isSome(decodeListToolsResult(value));\n\n// ---------------------------------------------------------------------------\n// Tool ID sanitization\n// ---------------------------------------------------------------------------\n\nconst sanitize = (value: string): string => {\n  const s = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return s || \"tool\";\n};\n\nconst uniqueId = (value: string, seen: Map<string, number>): string => {\n  const base = sanitize(value);\n  const n = (seen.get(base) ?? 0) + 1;\n  seen.set(base, n);\n  return n === 1 ? base : `${base}_${n}`;\n};\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport const joinToolPath = (namespace: string | undefined, toolId: string): string =>\n  namespace?.trim() ? `${namespace}.${toolId}` : toolId;\n\nexport const extractManifestFromListToolsResult = (\n  listToolsResult: unknown,\n  metadata?: { serverInfo?: unknown },\n): McpToolManifest => {\n  const seen = new Map<string, number>();\n\n  const listed = decodeListToolsResult(listToolsResult).pipe(\n    Option.map((result) => result.tools),\n    Option.getOrElse(() => []),\n  );\n\n  const server = decodeServerInfo(metadata?.serverInfo).pipe(\n    Option.map(\n      (info): McpServerMetadata => ({\n        name: info.name ?? null,\n        version: info.version ?? null,\n      }),\n    ),\n    Option.getOrNull,\n  );\n\n  const tools = listed.flatMap((tool): McpToolManifestEntry[] => {\n    const toolName = tool.name.trim();\n    if (!toolName) return [];\n\n    return [\n      {\n        toolId: uniqueId(toolName, seen),\n        toolName,\n        description: tool.description ?? null,\n        inputSchema: tool.inputSchema ?? tool.parameters,\n        outputSchema: tool.outputSchema,\n        annotations: tool.annotations,\n      },\n    ];\n  });\n\n  return { server, tools };\n};\n\n// ---------------------------------------------------------------------------\n// Namespace derivation\n// ---------------------------------------------------------------------------\n\nconst slugify = (value: string): string =>\n  value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n\nconst hostnameOf = (url: string): string | null => {\n  if (!URL.canParse(url)) return null;\n  return new URL(url).hostname;\n};\n\nconst basenameOf = (path: string): string => path.trim().split(/[\\\\/]/).pop() ?? path.trim();\n\nexport const deriveMcpNamespace = (input: {\n  name?: string | null;\n  endpoint?: string | null;\n  command?: string | null;\n}): string => {\n  if (input.name?.trim()) return slugify(input.name) || \"mcp\";\n\n  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;\n  if (fromEndpoint) return slugify(fromEndpoint) || \"mcp\";\n\n  if (input.command?.trim()) return slugify(basenameOf(input.command)) || \"mcp\";\n\n  return \"mcp\";\n};\n","// ---------------------------------------------------------------------------\n// MCP tool invocation — shared helper called from plugin.invokeTool.\n//\n// Responsible for:\n//   1. Finding/creating a cached MCP client connection for the source.\n//   2. Installing a per-invocation `ElicitRequestSchema` handler that\n//      bridges MCP's elicit capability into the host's elicit function\n//      threaded via `InvokeToolInput.elicit`.\n//   3. Calling `client.callTool({ name, arguments })`.\n//   4. Retrying once on connection failure (invalidate + reconnect).\n// ---------------------------------------------------------------------------\n\nimport { Cause, Effect, Exit, Option, Predicate, Schema, ScopedCache } from \"effect\";\n\nimport { ElicitRequestSchema } from \"@modelcontextprotocol/sdk/types.js\";\n\nimport {\n  FormElicitation,\n  UrlElicitation,\n  type Elicit,\n  type ElicitationRequest,\n} from \"@executor-js/sdk/core\";\n\nimport { McpConnectionError, McpInvocationError } from \"./errors\";\nimport type { McpConnection } from \"./connection\";\nimport type { McpStoredSourceData } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst ArgsRecord = Schema.Record(Schema.String, Schema.Unknown);\nconst decodeArgsRecord = Schema.decodeUnknownOption(ArgsRecord);\n\nconst argsRecord = (value: unknown): Record<string, unknown> =>\n  Option.getOrElse(decodeArgsRecord(value), () => ({}));\n\nconst stableJson = (value: unknown): string => {\n  if (Array.isArray(value)) return `[${value.map(stableJson).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value as Record<string, unknown>)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value);\n};\n\nconst fingerprint = (value: unknown): string => {\n  const input = stableJson(value);\n  let hash = 0x811c9dc5;\n  for (let i = 0; i < input.length; i++) {\n    hash ^= input.charCodeAt(i);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0).toString(16).padStart(8, \"0\");\n};\n\nconst connectionCacheKey = (input: {\n  readonly sourceData: McpStoredSourceData;\n  readonly invokerScope: string;\n  readonly sourceId: string;\n  readonly sourceScope: string;\n}): string => {\n  const sd = input.sourceData;\n  return sd.transport === \"stdio\"\n    ? `stdio:${fingerprint({\n        sourceId: input.sourceId,\n        sourceScope: input.sourceScope,\n        command: sd.command,\n        args: sd.args ?? [],\n        env: sd.env ?? {},\n        cwd: sd.cwd ?? null,\n      })}`\n    : `remote:${fingerprint({\n        sourceId: input.sourceId,\n        sourceScope: input.sourceScope,\n        invokerScope: input.invokerScope,\n        endpoint: sd.endpoint,\n        remoteTransport: sd.remoteTransport ?? \"auto\",\n        headers: sd.headers ?? {},\n        queryParams: sd.queryParams ?? {},\n        auth: sd.auth,\n      })}`;\n};\n\n// ---------------------------------------------------------------------------\n// Elicitation bridge — decode incoming MCP ElicitRequest, route through\n// the host's elicit function, marshal the response back to MCP shape.\n// ---------------------------------------------------------------------------\n\nconst McpElicitParams = Schema.Union([\n  Schema.Struct({\n    mode: Schema.Literal(\"url\"),\n    message: Schema.String,\n    url: Schema.String,\n    elicitationId: Schema.optional(Schema.String),\n    id: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    mode: Schema.optional(Schema.Literal(\"form\")),\n    message: Schema.String,\n    requestedSchema: Schema.Record(Schema.String, Schema.Unknown),\n  }),\n]);\ntype McpElicitParams = typeof McpElicitParams.Type;\n\nconst decodeElicitParams = Schema.decodeUnknownSync(McpElicitParams);\n\nconst toElicitationRequest = (params: McpElicitParams): ElicitationRequest =>\n  params.mode === \"url\"\n    ? UrlElicitation.make({\n        message: params.message,\n        url: params.url,\n        elicitationId: params.elicitationId ?? params.id ?? \"\",\n      })\n    : FormElicitation.make({\n        message: params.message,\n        requestedSchema: params.requestedSchema,\n      });\n\nconst installElicitationHandler = (client: McpConnection[\"client\"], elicit: Elicit): void => {\n  client.setRequestHandler(ElicitRequestSchema, async (request: { params: unknown }) => {\n    const params = decodeElicitParams(request.params);\n    const req = toElicitationRequest(params);\n    // Use runPromiseExit so we can inspect typed failures — `elicit`\n    // fails with `ElicitationDeclinedError` on decline/cancel, which\n    // we translate into the equivalent MCP elicit response instead of\n    // surfacing as a JSON-RPC error.\n    const exit = await Effect.runPromiseExit(elicit(req));\n    if (Exit.isSuccess(exit)) {\n      const response = exit.value;\n      return {\n        action: response.action,\n        ...(response.action === \"accept\" && response.content ? { content: response.content } : {}),\n      };\n    }\n    const failure = exit.cause.reasons.find(Cause.isFailReason);\n    if (failure) {\n      const err = failure.error;\n      if (Predicate.isTagged(err, \"ElicitationDeclinedError\")) {\n        const action =\n          Predicate.hasProperty(err, \"action\") && err.action === \"cancel\" ? \"cancel\" : \"decline\";\n        return { action };\n      }\n    }\n    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: MCP SDK async request handlers signal unexpected failures by rejecting\n    throw Cause.squash(exit.cause);\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Single tool call — install handler, callTool, return raw result\n// ---------------------------------------------------------------------------\n\nconst useConnection = (\n  connection: McpConnection,\n  toolName: string,\n  args: Record<string, unknown>,\n  elicit: Elicit,\n): Effect.Effect<unknown, McpInvocationError> =>\n  Effect.gen(function* () {\n    installElicitationHandler(connection.client, elicit);\n    return yield* Effect.tryPromise({\n      try: () => connection.client.callTool({ name: toolName, arguments: args }),\n      catch: () =>\n        new McpInvocationError({\n          toolName,\n          message: `MCP tool call failed for ${toolName}`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.client.call_tool\", {\n        attributes: { \"mcp.tool.name\": toolName },\n      }),\n    );\n  });\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport interface InvokeMcpToolInput {\n  readonly toolId: string;\n  readonly toolName: string;\n  readonly args: unknown;\n  readonly sourceData: McpStoredSourceData;\n  readonly sourceId: string;\n  readonly sourceScope: string;\n  /** Innermost executor scope id at invoke time. Mixed into the\n   *  connection cache key so per-user OAuth/secret resolution doesn't\n   *  collapse multiple users onto one shared connection. */\n  readonly invokerScope: string;\n  readonly resolveConnector: () => Effect.Effect<McpConnection, McpConnectionError>;\n  readonly connectionCache: ScopedCache.ScopedCache<string, McpConnection, McpConnectionError>;\n  readonly pendingConnectors: Map<string, Effect.Effect<McpConnection, McpConnectionError>>;\n  readonly elicit: Elicit;\n}\n\nexport const invokeMcpTool = (\n  input: InvokeMcpToolInput,\n): Effect.Effect<unknown, McpConnectionError | McpInvocationError> => {\n  const transport: string =\n    input.sourceData.transport === \"stdio\" ? \"stdio\" : (input.sourceData.remoteTransport ?? \"auto\");\n  return Effect.gen(function* () {\n    const cacheKey = connectionCacheKey(input);\n    const args = argsRecord(input.args);\n\n    // Register the connector for the cache lookup (side-channel pattern\n    // — the ScopedCache lookup closure reads from `pendingConnectors`).\n    const connector = input.resolveConnector();\n    input.pendingConnectors.set(cacheKey, connector);\n\n    // Check cache state BEFORE acquire so the span clearly attributes\n    // tail latency to either a cold handshake (miss) or warm reuse (hit).\n    // Without this every `plugin.mcp.connection.acquire` span looks the\n    // same in Axiom and you have to cross-reference the\n    // `plugin.mcp.connection.handshake` count to back out the hit rate.\n    const cacheHit = yield* ScopedCache.has(input.connectionCache, cacheKey);\n\n    const firstConnection = yield* ScopedCache.get(input.connectionCache, cacheKey).pipe(\n      Effect.withSpan(\"plugin.mcp.connection.acquire\", {\n        attributes: {\n          \"plugin.mcp.transport\": transport,\n          \"plugin.mcp.cache_key\": cacheKey,\n          \"plugin.mcp.attempt\": 1,\n          \"plugin.mcp.cache_hit\": cacheHit,\n        },\n      }),\n    );\n\n    return yield* useConnection(firstConnection, input.toolName, args, input.elicit).pipe(\n      // On failure, invalidate the cache and retry once with a fresh\n      // connection. Matches the old invoker's retry-once semantics.\n      Effect.catch(() =>\n        Effect.gen(function* () {\n          yield* ScopedCache.invalidate(input.connectionCache, cacheKey);\n          input.pendingConnectors.set(cacheKey, connector);\n          const fresh = yield* ScopedCache.get(input.connectionCache, cacheKey);\n          return yield* useConnection(fresh, input.toolName, args, input.elicit);\n        }).pipe(\n          Effect.withSpan(\"plugin.mcp.invoke.retry\", {\n            attributes: {\n              \"plugin.mcp.transport\": transport,\n              \"plugin.mcp.cache_key\": cacheKey,\n              \"mcp.tool.name\": input.toolName,\n            },\n          }),\n        ),\n      ),\n    );\n  }).pipe(\n    Effect.scoped,\n    Effect.withSpan(\"plugin.mcp.invoke\", {\n      attributes: {\n        \"mcp.tool.name\": input.toolName,\n        \"plugin.mcp.tool_id\": input.toolId,\n        \"plugin.mcp.transport\": transport,\n      },\n    }),\n  );\n};\n","// ---------------------------------------------------------------------------\n// MCP endpoint shape probe — decide whether an unknown HTTP endpoint is\n// actually speaking MCP before we try to classify it as such.\n//\n// Background:\n//\n//   `discoverTools` (via the MCP SDK's StreamableHTTP / SSE transport)\n//   fails for every non-MCP endpoint too — 200-with-HTML, 400-GraphQL,\n//   404, etc. all surface as the same opaque transport error. We need\n//   our own classifier that distinguishes \"real MCP\" from\n//   \"OAuth-protected non-MCP service\" without relying on RFC 9728/8414\n//   metadata, since (a) plenty of non-MCP APIs publish that metadata,\n//   and (b) plenty of real MCP servers authenticate with static API\n//   keys and publish no OAuth metadata at all (e.g. cubic.dev).\n//\n// The probe issues an unauth JSON-RPC `initialize` POST and accepts\n// only the wire shapes a real MCP server can return:\n//\n//   - 2xx with `Content-Type: text/event-stream` — streamable HTTP\n//     transport, body is an SSE stream we don't consume.\n//   - 2xx with `Content-Type: application/json` whose body parses as a\n//     JSON-RPC 2.0 envelope (`{jsonrpc:\"2.0\", result|error|method,...}`).\n//   - 401 with `WWW-Authenticate: Bearer` AND a JSON-RPC error envelope\n//     in the body. The body shape is what separates a real MCP server\n//     from an unrelated OAuth-protected API: GraphQL/REST/HTML 401s\n//     don't shape themselves as JSON-RPC.\n//\n// When POST returns 404/405/406/415 we retry with GET + `Accept:\n// text/event-stream` to support legacy SSE-only servers; that path\n// only accepts 2xx with `text/event-stream` or the same 401+Bearer\n// shape.\n//\n// One `fetch` (occasionally two), no MCP-SDK session state, no OAuth\n// round-trip, no DCR — every non-MCP endpoint exits here.\n// ---------------------------------------------------------------------------\n\nimport { Data, Duration, Effect, Layer, Option, Schema } from \"effect\";\nimport { FetchHttpClient, HttpClient, HttpClientRequest } from \"effect/unstable/http\";\n\n/** MCP initialize request body used as the shape probe. Any real MCP\n *  server either answers it (unauth-OK server) or returns the spec-\n *  mandated 401 + WWW-Authenticate pair. A non-MCP endpoint hit with\n *  this body will respond with whatever it does for unknown JSON\n *  payloads — 400, 404, HTML, a GraphQL error envelope, etc. — none of\n *  which match the gate below. */\nconst INITIALIZE_BODY = JSON.stringify({\n  jsonrpc: \"2.0\",\n  id: 1,\n  method: \"initialize\",\n  params: {\n    protocolVersion: \"2025-06-18\",\n    capabilities: {},\n    clientInfo: { name: \"executor-probe\", version: \"0\" },\n  },\n});\n\n/** Header-name lookup is case-insensitive per RFC 7230. `fetch`'s\n *  `Response.headers` already lower-cases, but we normalise explicitly\n *  to stay robust against test mocks that construct `Headers` loosely. */\nconst readHeader = (headers: Readonly<Record<string, string>>, name: string): string | null => {\n  const direct = headers[name];\n  if (direct !== undefined) return direct;\n  const lower = name.toLowerCase();\n  for (const [k, v] of Object.entries(headers)) {\n    if (k.toLowerCase() === lower) return v;\n  }\n  return null;\n};\n\nclass ProbeTransportError extends Data.TaggedError(\"ProbeTransportError\")<{\n  readonly reason: string;\n  readonly cause: unknown;\n}> {}\n\nconst decodeJsonString = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown));\n\nconst asObject = (body: string): Record<string, unknown> | null => {\n  if (!body) return null;\n  const parsed = decodeJsonString(body);\n  if (Option.isNone(parsed)) return null;\n  const value = parsed.value;\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return null;\n  return value as Record<string, unknown>;\n};\n\n/** Quick check that a body parses as a JSON-RPC 2.0 envelope. The MCP wire\n *  protocol is JSON-RPC 2.0, so a real MCP server's response to `initialize`\n *  (whether 2xx with the result, or a 401 error envelope) carries this\n *  shape. Non-MCP services don't — GraphQL APIs return `{errors:[...]}`,\n *  REST APIs return their own envelope, marketing pages return HTML. */\nconst isJsonRpcEnvelope = (body: string): boolean => {\n  const obj = asObject(body);\n  if (!obj) return false;\n  if (obj.jsonrpc !== \"2.0\") return false;\n  return \"result\" in obj || \"error\" in obj || \"method\" in obj;\n};\n\n/** Quick check that a body parses as an RFC 6750 OAuth Bearer error\n *  envelope (`{error: \"invalid_token\", error_description?: ..., ...}`).\n *  Real MCP servers like Atlassian return this shape on unauth requests\n *  even when their WWW-Authenticate omits `resource_metadata=`. The\n *  GraphQL `{errors: [...]}` envelope, which a non-MCP OAuth-protected\n *  GraphQL API would return, is explicitly excluded. */\nconst isOAuthErrorBody = (body: string): boolean => {\n  const obj = asObject(body);\n  if (!obj) return false;\n  if (Array.isArray(obj.errors)) return false;\n  return typeof obj.error === \"string\";\n};\n\nconst ErrorMessageShape = Schema.Struct({ message: Schema.String });\nconst decodeErrorMessageShape = Schema.decodeUnknownOption(ErrorMessageShape);\n\nconst reasonFromBoundaryCause = (cause: unknown): string => {\n  const messageShape = decodeErrorMessageShape(cause);\n  if (Option.isSome(messageShape)) return messageShape.value.message;\n  if (typeof cause === \"string\") return cause;\n  if (typeof cause === \"number\" || typeof cause === \"boolean\" || typeof cause === \"bigint\") {\n    return `${cause}`;\n  }\n  if (typeof cause === \"symbol\") return cause.description ?? \"symbol\";\n  if (cause === null) return \"null\";\n  if (typeof cause === \"undefined\") return \"undefined\";\n  return \"fetch failed\";\n};\n\n/** Why the probe rejected an endpoint as not-MCP.\n *\n *  - `auth-required` — server returned 401. We don't know for sure it's\n *    an MCP server (no spec-compliant Bearer challenge or the body\n *    isn't JSON-RPC), but the right next step for the user is the same\n *    either way: provide credentials and retry. This is what\n *    misclassifies real MCP servers like cubic.dev (no\n *    resource_metadata) or ref.tools (no WWW-Authenticate at all)\n *    without the URL-token fallback at the detect layer.\n *  - `wrong-shape` — endpoint responded but with a body or status that\n *    doesn't match any MCP shape (200 HTML, 400 GraphQL, 404 from a\n *    static host, etc.). User action: this URL probably isn't MCP. */\nexport type McpProbeRejectCategory = \"auth-required\" | \"wrong-shape\";\n\nexport type McpShapeProbeResult =\n  /** Server answered initialize successfully — either a 2xx with a\n   *  JSON-RPC payload, or a 401 + WWW-Authenticate: Bearer (RFC 6750\n   *  challenge) that the MCP auth spec requires. */\n  | { readonly kind: \"mcp\"; readonly requiresAuth: boolean }\n  /** Endpoint is reachable but the response does not look like MCP. */\n  | {\n      readonly kind: \"not-mcp\";\n      readonly reason: string;\n      readonly category: McpProbeRejectCategory;\n    }\n  /** Transport-level failure (DNS, TLS, timeout, abort, ...). */\n  | { readonly kind: \"unreachable\"; readonly reason: string };\n\nexport interface ProbeOptions {\n  /** Abort the request after this many ms. Default 8000. */\n  readonly timeoutMs?: number;\n  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n}\n\n/**\n * Hit `endpoint` with a JSON-RPC `initialize` POST and classify the\n * response according to the MCP authorization spec.\n *\n * Returns `{kind: \"mcp\"}` only when the endpoint either:\n *   - answers with 2xx (unauth-OK MCP server), or\n *   - responds 401 with a `Bearer` WWW-Authenticate challenge.\n *\n * Anything else (400, 404, 200-with-HTML, 200-with-GraphQL-errors, ...)\n * is classified `not-mcp`. Transport errors surface as `unreachable`.\n */\nexport const probeMcpEndpointShape = (\n  endpoint: string,\n  options: ProbeOptions = {},\n): Effect.Effect<McpShapeProbeResult> =>\n  Effect.gen(function* () {\n    const timeoutMs = options.timeoutMs ?? 8_000;\n    const outcome = yield* Effect.gen(function* () {\n      const client = yield* HttpClient.HttpClient;\n\n      const readBody = (response: {\n        readonly text: Effect.Effect<string, unknown>;\n      }): Effect.Effect<string> =>\n        response.text.pipe(\n          Effect.timeout(Duration.millis(timeoutMs)),\n          Effect.catch(() => Effect.succeed(\"\")),\n        );\n\n      const classify = (\n        response: {\n          readonly status: number;\n          readonly headers: Readonly<Record<string, string>>;\n          readonly text: Effect.Effect<string, unknown>;\n        },\n        method: \"GET\" | \"POST\",\n      ): Effect.Effect<McpShapeProbeResult | null> =>\n        Effect.gen(function* () {\n          const contentType = readHeader(response.headers, \"content-type\") ?? \"\";\n          const isSse = /^\\s*text\\/event-stream\\b/i.test(contentType);\n\n          if (response.status === 401) {\n            const wwwAuth = readHeader(response.headers, \"www-authenticate\");\n            if (!wwwAuth || !/^\\s*bearer\\b/i.test(wwwAuth)) {\n              return {\n                kind: \"not-mcp\",\n                category: \"auth-required\",\n                reason: \"401 without Bearer WWW-Authenticate — not an MCP auth challenge\",\n              } as const;\n            }\n            // Spec-compliant MCP signal: the auth spec mandates a\n            // `resource_metadata=` attribute pointing at the server's\n            // RFC 9728 document. Real OAuth-protected MCP servers\n            // (sentry.dev, etc.) include it. This attribute is rare on\n            // unrelated OAuth services and is the cleanest accept signal\n            // we have when the 401 body is RFC 6750 OAuth-shape rather\n            // than JSON-RPC.\n            if (/(?:^|[\\s,])resource_metadata\\s*=/i.test(wwwAuth)) {\n              return { kind: \"mcp\", requiresAuth: true } as const;\n            }\n            // Looser RFC 6750 §3.1 signal: the Bearer challenge carries\n            // `error=` / `error_description=` auth-params. Real MCP\n            // servers (Supabase, GitHub Copilot, Vercel, Neon, Tavily,\n            // Replicate, ...) include this even when they omit\n            // `resource_metadata=`. The body alone isn't enough for\n            // those — Supabase, e.g., returns `{\"message\":\"Unauthorized\"}`\n            // which is neither JSON-RPC nor RFC 6750. The `error=`\n            // auth-param is the tiebreaker.\n            if (/(?:^|[\\s,])error\\s*=/i.test(wwwAuth)) {\n              return { kind: \"mcp\", requiresAuth: true } as const;\n            }\n            // SSE responses can't carry a JSON-RPC error envelope; accept the\n            // Bearer challenge alone in that case (rare but spec-permissible).\n            if (isSse) return { kind: \"mcp\", requiresAuth: true } as const;\n            // Fallback for MCP servers whose 401 omits\n            // `resource_metadata=`. Two body shapes count:\n            //   - JSON-RPC error (cubic.dev: API-key auth, JSON-RPC\n            //     errors end-to-end).\n            //   - RFC 6750 OAuth Bearer error envelope `{error:\n            //     \"invalid_token\", ...}` without GraphQL `{errors:[...]}`\n            //     (Atlassian).\n            // Non-MCP OAuth-protected services that issue bare Bearer\n            // challenges (Railway-style GraphQL, etc.) return `errors`\n            // arrays or other shapes that fail both checks.\n            const body = yield* readBody(response);\n            if (!isJsonRpcEnvelope(body) && !isOAuthErrorBody(body)) {\n              return {\n                kind: \"not-mcp\",\n                category: \"auth-required\",\n                reason:\n                  \"401 + Bearer without resource_metadata, JSON-RPC body, or OAuth error body\",\n              } as const;\n            }\n            return { kind: \"mcp\", requiresAuth: true } as const;\n          }\n\n          if (response.status >= 200 && response.status < 300) {\n            if (method === \"GET\") {\n              if (!isSse) {\n                return {\n                  kind: \"not-mcp\",\n                  category: \"wrong-shape\",\n                  reason: \"GET response is not an SSE stream\",\n                } as const;\n              }\n              return { kind: \"mcp\", requiresAuth: false } as const;\n            }\n            // POST 2xx: SSE body is opaque to us; otherwise require a\n            // JSON-RPC envelope so we don't accept HTML/REST 200 responses.\n            if (isSse) return { kind: \"mcp\", requiresAuth: false } as const;\n            const body = yield* readBody(response);\n            if (!isJsonRpcEnvelope(body)) {\n              return {\n                kind: \"not-mcp\",\n                category: \"wrong-shape\",\n                reason: \"2xx POST body is not a JSON-RPC envelope\",\n              } as const;\n            }\n            return { kind: \"mcp\", requiresAuth: false } as const;\n          }\n\n          return null;\n        });\n\n      const url = new URL(endpoint);\n      for (const [key, value] of Object.entries(options.queryParams ?? {})) {\n        url.searchParams.set(key, value);\n      }\n\n      let postRequest = HttpClientRequest.post(url.toString()).pipe(\n        HttpClientRequest.setHeader(\"content-type\", \"application/json\"),\n        HttpClientRequest.setHeader(\"accept\", \"application/json, text/event-stream\"),\n        HttpClientRequest.bodyText(INITIALIZE_BODY, \"application/json\"),\n      );\n      for (const [name, value] of Object.entries(options.headers ?? {})) {\n        postRequest = HttpClientRequest.setHeader(postRequest, name, value);\n      }\n\n      const postResponse = yield* client\n        .execute(postRequest)\n        .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n\n      const postResult = yield* classify(postResponse, \"POST\");\n      if (postResult) return postResult;\n\n      if ([404, 405, 406, 415].includes(postResponse.status)) {\n        let getRequest = HttpClientRequest.get(url.toString()).pipe(\n          HttpClientRequest.setHeader(\"accept\", \"text/event-stream\"),\n        );\n        for (const [name, value] of Object.entries(options.headers ?? {})) {\n          getRequest = HttpClientRequest.setHeader(getRequest, name, value);\n        }\n        const getResponse = yield* client\n          .execute(getRequest)\n          .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n        const getResult = yield* classify(getResponse, \"GET\");\n        if (getResult) return getResult;\n      }\n\n      return {\n        kind: \"not-mcp\",\n        category: \"wrong-shape\",\n        reason: `unexpected status ${postResponse.status} for initialize`,\n      } as const;\n    }).pipe(\n      Effect.provide(options.httpClientLayer ?? FetchHttpClient.layer),\n      Effect.mapError(\n        (cause) =>\n          new ProbeTransportError({\n            reason: reasonFromBoundaryCause(cause),\n            cause,\n          }),\n      ),\n      Effect.catch((cause) =>\n        Effect.succeed<McpShapeProbeResult>({\n          kind: \"unreachable\",\n          reason: cause.reason,\n        }),\n      ),\n    );\n\n    return outcome;\n  }).pipe(Effect.withSpan(\"mcp.plugin.probe_shape\"));\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,SAAS,QAAQ,QAAQ,cAAc;AAEvC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAaA,IAAM,YAAY,aAAa;AAAA,EACpC,YAAY;AAAA,IACV,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,MAAM,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKvC,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA;AAAA;AAAA,MAGvC,WAAW;AAAA,QACT,MAAM,CAAC,QAAQ,UAAU,QAAQ;AAAA,QACjC,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA;AAAA,MAEA,kBAAkB,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MACpD,kBAAkB,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MACpD,oBAAoB,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA;AAAA,MAEtD,sBAAsB,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MACxD,qBAAqB;AAAA,QACnB,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,MACA,yBAAyB;AAAA,QACvB,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,MACA,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C;AAAA,EACF;AAAA,EACA,mBAAmB;AAAA,IACjB,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,WAAW,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACzD,MAAM,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACvC,MAAM,EAAE,MAAM,CAAC,QAAQ,SAAS,GAAG,UAAU,KAAK;AAAA,MAClD,YAAY,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MAC9C,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MAC5C,QAAQ,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,IAC5C;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,WAAW,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACzD,MAAM,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACvC,MAAM,EAAE,MAAM,CAAC,QAAQ,SAAS,GAAG,UAAU,KAAK;AAAA,MAClD,YAAY,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MAC9C,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MAC5C,QAAQ,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,IAC5C;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,WAAW,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACzD,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,MACxC,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C;AAAA,EACF;AACF,CAAC;AASD,IAAM,mBAAmB,OAAO,kBAAkB,mBAAmB;AACrE,IAAM,mBAAmB,OAAO,WAAW,mBAAmB;AAE9D,IAAM,gBAAgB,OAAO,kBAAkB,cAAc;AAC7D,IAAM,gBAAgB,OAAO,WAAW,cAAc;AACtD,IAAM,aAAa,OAAO,oBAAoB,OAAO,eAAe,OAAO,OAAO,CAAC;AAEnF,IAAM,aAAa,CAAC,UAA4B;AAC9C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,SAAO,OAAO,UAAU,WAAW,KAAK,GAAG,MAAM,KAAK;AACxD;AAcA,IAAM,gBAAgB,CAAC,SAAyC;AAC9D,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,WAAW;AAAA,MACX,kBAAkB,KAAK;AAAA,MACvB,kBAAkB,KAAK;AAAA,MACvB,oBAAoB,KAAK;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,WAAW;AAAA,MACX,sBAAsB,KAAK;AAAA,MAC3B,qBAAqB,KAAK;AAAA,MAC1B,yBAAyB,KAAK;AAAA,IAChC;AAAA,EACF;AACA,SAAO,EAAE,WAAW,OAAO;AAC7B;AAEA,IAAM,gBAAgB,CAAC,QAAoD;AACzE,QAAM,OAAO,IAAI;AACjB,MAAI,SAAS,YAAY,OAAO,IAAI,qBAAqB,UAAU;AACjE,UAAM,SAAS,IAAI;AACnB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAa,IAAI,oBAAsC;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,SAAS,YAAY,OAAO,IAAI,yBAAyB,UAAU;AACrE,UAAM,MAAM,IAAI;AAChB,UAAM,OAAO,IAAI;AACjB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,gBAAgB,IAAI;AAAA,MACpB,GAAI,MAAM,EAAE,cAAc,IAAI,IAAI,CAAC;AAAA,MACnC,GAAI,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;AAgBA,IAAM,iBAAiB,CACrB,UACA,OACA,WACuC;AACvC,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,SAAO,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AACnD,UAAM,KAAK,KAAK,UAAU,CAAC,UAAU,IAAI,CAAC;AAC1C,QAAI,OAAO,UAAU,UAAU;AAC7B,aAAO;AAAA,QACL;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,MAAM;AAAA,QACN,YAAY;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,IAChB;AAAA,EACF,CAAC;AACH;AAEA,IAAM,iBAAiB,CACrB,SACiD;AACjD,QAAM,MAAoD,CAAC;AAC3D,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,IAAI,SAAS,SAAU;AAClC,UAAM,OAAO,IAAI;AACjB,QAAI,IAAI,SAAS,aAAa,OAAO,IAAI,aAAa,UAAU;AAC9D,YAAM,SAAS,IAAI;AACnB,UAAI,IAAI,IAAI,SACR,4BAA4B,KAAK,EAAE,MAAM,WAAW,MAAM,IAAI,UAAU,OAAO,CAAC,IAChF,4BAA4B,KAAK,EAAE,MAAM,WAAW,MAAM,IAAI,SAAS,CAAC;AAAA,IAC9E,WAAW,IAAI,SAAS,UAAU,OAAO,IAAI,eAAe,UAAU;AACpE,UAAI,IAAI,IAAI,IAAI;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAsFO,IAAM,eAAe,CAAC,EAAE,SAAS,GAAG,MAA+C;AACxF,SAAO;AAAA,IACL,sBAAsB,CAAC,WAAW,UAChC,OAAO,IAAI,aAAa;AACtB,YAAM,OAAO,OAAO,GAAG,SAAS;AAAA,QAC9B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,aAAO,KAAK,IAAI,CAAC,SAAS;AAAA,QACxB,QAAQ,IAAI;AAAA,QACZ,SAAS,cAAc,WAAW,IAAI,OAAO,CAAC;AAAA,MAChD,EAAE;AAAA,IACJ,CAAC;AAAA,IAEH,YAAY,CAAC,QAAQ,UACnB,OAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,OAAO;AAAA,UAC7B,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,UAAU,cAAc,WAAW,IAAI,OAAO,CAAC;AACrD,aAAO,EAAE,SAAS,WAAW,IAAI,UAAU;AAAA,IAC7C,CAAC;AAAA,IAEH,aAAa,CAAC,WAAW,OAAO,YAC9B,OAAO,IAAI,aAAa;AACtB,UAAI,QAAQ,WAAW,EAAG;AAC1B,YAAM,MAAM,oBAAI,KAAK;AACrB,aAAO,GAAG,WAAW;AAAA,QACnB,OAAO;AAAA,QACP,MAAM,QAAQ,IAAI,CAAC,OAAO;AAAA,UACxB,IAAI,EAAE;AAAA,UACN,UAAU;AAAA,UACV,WAAW;AAAA,UACX,SAAS,cAAc,EAAE,OAAO;AAAA,UAChC,YAAY;AAAA,QACd,EAAE;AAAA,QACF,cAAc;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,IAEH,2BAA2B,CAAC,WAAW,UACrC,GACG,WAAW;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,QACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,QACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,MACpC;AAAA,IACF,CAAC,EACA,KAAK,OAAO,MAAM;AAAA,IAEvB,WAAW,CAAC,WAAW,UACrB,OAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO;AAAA,QACL,WAAW,IAAI;AAAA,QACf,OAAO,IAAI;AAAA,QACX,MAAM,IAAI;AAAA,QACV,QAAQ,OAAO,kBAAkB,KAAK,WAAW,KAAK;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,IAEH,iBAAiB,CAAC,WAAW,UAC3B,OAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO,OAAO,kBAAkB,KAAK,WAAW,KAAK;AAAA,IACvD,CAAC;AAAA,IAEH,WAAW,CAAC,WACV,OAAO,IAAI,aAAa;AACtB,YAAM,MAAM,oBAAI,KAAK;AAGrB,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,OAAO,MAAM;AAAA,QAC3C;AAAA,MACF,CAAC;AACD,aAAO,qBAAqB,OAAO,WAAW,OAAO,KAAK;AAE1D,YAAM,OACJ,OAAO,OAAO,cAAc,WAAW,OAAO,OAAO,OAAO,EAAE,MAAM,OAAO;AAC7E,YAAM,WAAW,cAAc,IAAI;AACnC,YAAM,UAAU,OAAO,OAAO,cAAc,WAAW,OAAO,OAAO,UAAU;AAC/E,YAAM,cACJ,OAAO,OAAO,cAAc,WAAW,OAAO,OAAO,cAAc;AAMrE,YAAM,gBAAgB;AAAA,QACpB,iBAAiB,OAAO,MAAM;AAAA,MAChC;AAEA,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,MAAM;AAAA,UACJ,IAAI,OAAO;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,MAAM,OAAO;AAAA,UACb,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ,GAAG;AAAA,QACL;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AAED,YAAM,aAAa,eAAe,OAAO,WAAW,OAAO,OAAO,OAAO;AACzE,UAAI,WAAW,SAAS,GAAG;AACzB,eAAO,GAAG,WAAW;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,cAAc;AAAA,QAChB,CAAC;AAAA,MACH;AACA,YAAM,YAAY,eAAe,OAAO,WAAW,OAAO,OAAO,WAAW;AAC5E,UAAI,UAAU,SAAS,GAAG;AACxB,eAAO,GAAG,WAAW;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,cAAc;AAAA,QAChB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,IAEH,cAAc,CAAC,WAAW,UACxB,OAAO,IAAI,aAAa;AACtB,aAAO,GAAG,WAAW;AAAA,QACnB,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,aAAO,qBAAqB,WAAW,KAAK;AAC5C,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACL;AAMA,WAAS,qBAAqB,WAAmB,OAAe;AAC9D,WAAO,OAAO,IAAI,aAAa;AAC7B,iBAAW,SAAS,CAAC,qBAAqB,wBAAwB,GAAY;AAC5E,eAAO,GAAG,WAAW;AAAA,UACnB;AAAA,UACA,OAAO;AAAA,YACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,YACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,UACpC;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,kBACP,KACA,WACA,OACoD;AACpD,WAAO,OAAO,IAAI,aAAa;AAK7B,YAAM,UAAU,WAAW,IAAI,MAAM;AACrC,UAAI,QAAQ,cAAc,UAAU;AAElC,eAAO,iBAAiB,OAAO;AAAA,MACjC;AACA,YAAM,aAAa,OAAO,GAAG,SAAS;AAAA,QACpC,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,YAAM,YAAY,OAAO,GAAG,SAAS;AAAA,QACnC,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,YAAM,UAAU,eAAe,UAAU;AACzC,YAAM,cAAc,eAAe,SAAS;AAC5C,YAAM,cAAc;AAAA,QAClB,GAAG;AAAA,QACH,GAAI,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,QACrD,GAAI,OAAO,KAAK,WAAW,EAAE,SAAS,IAAI,EAAE,YAAY,IAAI,CAAC;AAAA,QAC7D,MAAM,cAAc,GAAG;AAAA,MACzB;AACA,aAAO,iBAAiB,WAAW;AAAA,IACrC,CAAC;AAAA,EACH;AACF;AAMA,IAAM,uBAAuB,CAAC,YAA8D;AAC1F,MAAI,QAAQ,cAAc,SAAU,QAAO;AAC3C,QAAM,EAAE,MAAM,SAAS,aAAa,GAAG,KAAK,IAAI;AAChD,OAAK;AACL,OAAK;AACL,OAAK;AACL,SAAO;AACT;;;AC3jBA;AAAA,EACE,YAAAA;AAAA,EACA,UAAAC;AAAA,EACA,QAAAC;AAAA,EAEA;AAAA,EACA,UAAAC;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAAC;AAAA,OACK;AAKP;AAAA,EACE,+BAAAC;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAG1B;AAAA,OAEK;;;AC7BP,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAC9C,SAAS,mCAAmC;AAC5C,SAAS,UAAAC,eAAc;AA8CvB,IAAM,mBAAmB,CAAC,UAAkB,gBAA6C;AACvF,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,SAAO;AACT;AAQA,IAAM,eAAe,MACnB,IAAI;AAAA,EACF,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,EACzC;AAAA,IACE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE;AAAA,IACnD,qBAAqB,IAAI,4BAA4B;AAAA,EACvD;AACF;AAEF,IAAM,uBAAuB,CAAC,YAAmC;AAAA,EAC/D;AAAA,EACA,OAAO,MAAM,OAAO,MAAM;AAC5B;AAEA,IAAM,gBAAgB,CAAC,UAIrBC,QAAO,IAAI,aAAa;AACtB,QAAM,SAAS,aAAa;AAC5B,QAAM,oBAAoB,MAAM,gBAAgB;AAEhD,SAAOA,QAAO,WAAW;AAAA,IACvB,KAAK,MAAM,OAAO,QAAQ,iBAAiB;AAAA,IAC3C,OAAO,MACL,IAAI,mBAAmB;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,SAAS,yBAAyB,MAAM,SAAS;AAAA,IACnD,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACDA,QAAO,SAAS,mCAAmC;AAAA,MACjD,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,IACxD,CAAC;AAAA,EACH;AAEA,SAAO,qBAAqB,MAAM;AACpC,CAAC;AAMI,IAAM,qBAAqB,CAAC,UAAwC;AACzE,MAAI,MAAM,cAAc,SAAS;AAC/B,UAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAI,CAAC,SAAS;AACZ,aAAOA,QAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAOA,QAAO,IAAI,aAAa;AAG7B,YAAM,EAAE,qBAAqB,IAAI,OAAOA,QAAO,WAAW;AAAA,QACxD,KAAK,MAAM,OAAO,+BAAmB;AAAA,QACrC,OAAO,MACL,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACL,CAAC;AAED,aAAO,OAAO,cAAc;AAAA,QAC1B,WAAW;AAAA,QACX,iBAAiB,MACf,qBAAqB;AAAA,UACnB;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,KAAK,MAAM;AAAA,UACX,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,MAAM,IAAI,KAAK,IAAI;AAAA,QACrD,CAAC;AAAA,MACL,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAGA,QAAM,UAAU,MAAM,WAAW,CAAC;AAClC,QAAM,kBAAkB,MAAM,mBAAmB;AACjD,QAAM,cAAc,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI;AAEpE,QAAM,WAAW,iBAAiB,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC;AAEzE,QAAM,wBAAwB,cAAc;AAAA,IAC1C,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,8BAA8B,UAAU;AAAA,MAC1C;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,QAAM,aAAa,cAAc;AAAA,IAC/B,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,mBAAmB,UAAU;AAAA,MAC/B;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,MAAI,oBAAoB,kBAAmB,QAAO;AAClD,MAAI,oBAAoB,MAAO,QAAO;AAGtC,SAAO,sBAAsB,KAAKA,QAAO,MAAM,MAAM,UAAU,CAAC;AAClE;;;AC1KA,SAAS,UAAAC,eAAc;;;ACJvB,SAAS,UAAAC,SAAQ,UAAAC,eAAc;AA+B/B,IAAM,aAAaC,QAAO,OAAO;AAAA,EAC/B,MAAMA,QAAO;AAAA,EACb,aAAaA,QAAO,SAASA,QAAO,OAAOA,QAAO,MAAM,CAAC;AAAA,EACzD,aAAaA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC3C,YAAYA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC1C,cAAcA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC5C,aAAaA,QAAO,SAAS,kBAAkB;AACjD,CAAC;AAED,IAAM,kBAAkBA,QAAO,OAAO;AAAA,EACpC,OAAOA,QAAO,MAAM,UAAU;AAChC,CAAC;AAED,IAAM,aAAaA,QAAO,OAAO;AAAA,EAC/B,MAAMA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,SAASA,QAAO,SAASA,QAAO,MAAM;AACxC,CAAC;AAED,IAAM,wBAAwBA,QAAO,oBAAoB,eAAe;AACxE,IAAM,mBAAmBA,QAAO,oBAAoB,UAAU;AAEvD,IAAM,oBAAoB,CAAC,UAChCC,QAAO,OAAO,sBAAsB,KAAK,CAAC;AAM5C,IAAM,WAAW,CAAC,UAA0B;AAC1C,QAAM,IAAI,MACP,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK;AACd;AAEA,IAAM,WAAW,CAAC,OAAe,SAAsC;AACrE,QAAM,OAAO,SAAS,KAAK;AAC3B,QAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK;AAClC,OAAK,IAAI,MAAM,CAAC;AAChB,SAAO,MAAM,IAAI,OAAO,GAAG,IAAI,IAAI,CAAC;AACtC;AASO,IAAM,qCAAqC,CAChD,iBACA,aACoB;AACpB,QAAM,OAAO,oBAAI,IAAoB;AAErC,QAAM,SAAS,sBAAsB,eAAe,EAAE;AAAA,IACpDC,QAAO,IAAI,CAAC,WAAW,OAAO,KAAK;AAAA,IACnCA,QAAO,UAAU,MAAM,CAAC,CAAC;AAAA,EAC3B;AAEA,QAAM,SAAS,iBAAiB,UAAU,UAAU,EAAE;AAAA,IACpDA,QAAO;AAAA,MACL,CAAC,UAA6B;AAAA,QAC5B,MAAM,KAAK,QAAQ;AAAA,QACnB,SAAS,KAAK,WAAW;AAAA,MAC3B;AAAA,IACF;AAAA,IACAA,QAAO;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,QAAQ,CAAC,SAAiC;AAC7D,UAAM,WAAW,KAAK,KAAK,KAAK;AAChC,QAAI,CAAC,SAAU,QAAO,CAAC;AAEvB,WAAO;AAAA,MACL;AAAA,QACE,QAAQ,SAAS,UAAU,IAAI;AAAA,QAC/B;AAAA,QACA,aAAa,KAAK,eAAe;AAAA,QACjC,aAAa,KAAK,eAAe,KAAK;AAAA,QACtC,cAAc,KAAK;AAAA,QACnB,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,MAAM;AACzB;AAMA,IAAM,UAAU,CAAC,UACf,MACG,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAE3B,IAAM,aAAa,CAAC,QAA+B;AACjD,MAAI,CAAC,IAAI,SAAS,GAAG,EAAG,QAAO;AAC/B,SAAO,IAAI,IAAI,GAAG,EAAE;AACtB;AAEA,IAAM,aAAa,CAAC,SAAyB,KAAK,KAAK,EAAE,MAAM,OAAO,EAAE,IAAI,KAAK,KAAK,KAAK;AAEpF,IAAM,qBAAqB,CAAC,UAIrB;AACZ,MAAI,MAAM,MAAM,KAAK,EAAG,QAAO,QAAQ,MAAM,IAAI,KAAK;AAEtD,QAAM,eAAe,MAAM,UAAU,KAAK,IAAI,WAAW,MAAM,QAAQ,IAAI;AAC3E,MAAI,aAAc,QAAO,QAAQ,YAAY,KAAK;AAElD,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO,QAAQ,WAAW,MAAM,OAAO,CAAC,KAAK;AAExE,SAAO;AACT;;;ADlIO,IAAM,gBAAgB,CAC3B,cAEAC,QAAO,IAAI,aAAa;AAEtB,QAAM,aAAa,OAAO,UAAU;AAAA,IAClCA,QAAO;AAAA,MACL,CAAC,EAAE,QAAQ,MACT,IAAI,sBAAsB;AAAA,QACxB,OAAO;AAAA,QACP,SAAS,oCAAoC,OAAO;AAAA,MACtD,CAAC;AAAA,IACL;AAAA,EACF;AAGA,QAAM,aAAa,OAAOA,QAAO,WAAW;AAAA,IAC1C,KAAK,MAAM,WAAW,OAAO,UAAU;AAAA,IACvC,OAAO,MACL,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC;AAED,MAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,WAAO,gBAAgB,UAAU;AACjC,WAAO,OAAO,IAAI,sBAAsB;AAAA,MACtC,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,mCAAmC,YAAY;AAAA,IAC9D,YAAY,WAAW,OAAO,mBAAmB;AAAA,EACnD,CAAC;AAGD,SAAO,gBAAgB,UAAU;AAEjC,SAAO;AACT,CAAC;AAEH,IAAM,kBAAkB,CAAC,eAGvBA,QAAO;AAAA,EACLA,QAAO,WAAW;AAAA,IAChB,KAAK,MAAM,WAAW,MAAM;AAAA,IAC5B,OAAO,MACL,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC;AACH;;;AEjEF,SAAS,OAAO,UAAAC,SAAQ,MAAM,UAAAC,SAAQ,WAAW,UAAAC,SAAQ,mBAAmB;AAE5E,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAUP,IAAM,aAAaC,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAC9D,IAAM,mBAAmBA,QAAO,oBAAoB,UAAU;AAE9D,IAAM,aAAa,CAAC,UAClBC,QAAO,UAAU,iBAAiB,KAAK,GAAG,OAAO,CAAC,EAAE;AAEtD,IAAM,aAAa,CAAC,UAA2B;AAC7C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,UAAU,EAAE,KAAK,GAAG,CAAC;AACpE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,IAAI,OAAO,QAAQ,KAAgC,EACvD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,WAAW,KAAK,CAAC,EAAE,EACnE,KAAK,GAAG,CAAC;AAAA,EACd;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,IAAM,cAAc,CAAC,UAA2B;AAC9C,QAAM,QAAQ,WAAW,KAAK;AAC9B,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAQ,MAAM,WAAW,CAAC;AAC1B,WAAO,KAAK,KAAK,MAAM,QAAU;AAAA,EACnC;AACA,UAAQ,SAAS,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAClD;AAEA,IAAM,qBAAqB,CAAC,UAKd;AACZ,QAAM,KAAK,MAAM;AACjB,SAAO,GAAG,cAAc,UACpB,SAAS,YAAY;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,aAAa,MAAM;AAAA,IACnB,SAAS,GAAG;AAAA,IACZ,MAAM,GAAG,QAAQ,CAAC;AAAA,IAClB,KAAK,GAAG,OAAO,CAAC;AAAA,IAChB,KAAK,GAAG,OAAO;AAAA,EACjB,CAAC,CAAC,KACF,UAAU,YAAY;AAAA,IACpB,UAAU,MAAM;AAAA,IAChB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,UAAU,GAAG;AAAA,IACb,iBAAiB,GAAG,mBAAmB;AAAA,IACvC,SAAS,GAAG,WAAW,CAAC;AAAA,IACxB,aAAa,GAAG,eAAe,CAAC;AAAA,IAChC,MAAM,GAAG;AAAA,EACX,CAAC,CAAC;AACR;AAOA,IAAM,kBAAkBD,QAAO,MAAM;AAAA,EACnCA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,QAAQ,KAAK;AAAA,IAC1B,SAASA,QAAO;AAAA,IAChB,KAAKA,QAAO;AAAA,IACZ,eAAeA,QAAO,SAASA,QAAO,MAAM;AAAA,IAC5C,IAAIA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,CAAC;AAAA,EACDA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,SAASA,QAAO,QAAQ,MAAM,CAAC;AAAA,IAC5C,SAASA,QAAO;AAAA,IAChB,iBAAiBA,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAAA,EAC9D,CAAC;AACH,CAAC;AAGD,IAAM,qBAAqBA,QAAO,kBAAkB,eAAe;AAEnE,IAAM,uBAAuB,CAAC,WAC5B,OAAO,SAAS,QACZ,eAAe,KAAK;AAAA,EAClB,SAAS,OAAO;AAAA,EAChB,KAAK,OAAO;AAAA,EACZ,eAAe,OAAO,iBAAiB,OAAO,MAAM;AACtD,CAAC,IACD,gBAAgB,KAAK;AAAA,EACnB,SAAS,OAAO;AAAA,EAChB,iBAAiB,OAAO;AAC1B,CAAC;AAEP,IAAM,4BAA4B,CAAC,QAAiC,WAAyB;AAC3F,SAAO,kBAAkB,qBAAqB,OAAO,YAAiC;AACpF,UAAM,SAAS,mBAAmB,QAAQ,MAAM;AAChD,UAAM,MAAM,qBAAqB,MAAM;AAKvC,UAAM,OAAO,MAAME,QAAO,eAAe,OAAO,GAAG,CAAC;AACpD,QAAI,KAAK,UAAU,IAAI,GAAG;AACxB,YAAM,WAAW,KAAK;AACtB,aAAO;AAAA,QACL,QAAQ,SAAS;AAAA,QACjB,GAAI,SAAS,WAAW,YAAY,SAAS,UAAU,EAAE,SAAS,SAAS,QAAQ,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,YAAY;AAC1D,QAAI,SAAS;AACX,YAAM,MAAM,QAAQ;AACpB,UAAI,UAAU,SAAS,KAAK,0BAA0B,GAAG;AACvD,cAAM,SACJ,UAAU,YAAY,KAAK,QAAQ,KAAK,IAAI,WAAW,WAAW,WAAW;AAC/E,eAAO,EAAE,OAAO;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,MAAM,OAAO,KAAK,KAAK;AAAA,EAC/B,CAAC;AACH;AAMA,IAAM,gBAAgB,CACpB,YACA,UACA,MACA,WAEAA,QAAO,IAAI,aAAa;AACtB,4BAA0B,WAAW,QAAQ,MAAM;AACnD,SAAO,OAAOA,QAAO,WAAW;AAAA,IAC9B,KAAK,MAAM,WAAW,OAAO,SAAS,EAAE,MAAM,UAAU,WAAW,KAAK,CAAC;AAAA,IACzE,OAAO,MACL,IAAI,mBAAmB;AAAA,MACrB;AAAA,MACA,SAAS,4BAA4B,QAAQ;AAAA,IAC/C,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACDA,QAAO,SAAS,+BAA+B;AAAA,MAC7C,YAAY,EAAE,iBAAiB,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AACF,CAAC;AAuBI,IAAM,gBAAgB,CAC3B,UACoE;AACpE,QAAM,YACJ,MAAM,WAAW,cAAc,UAAU,UAAW,MAAM,WAAW,mBAAmB;AAC1F,SAAOA,QAAO,IAAI,aAAa;AAC7B,UAAM,WAAW,mBAAmB,KAAK;AACzC,UAAM,OAAO,WAAW,MAAM,IAAI;AAIlC,UAAM,YAAY,MAAM,iBAAiB;AACzC,UAAM,kBAAkB,IAAI,UAAU,SAAS;AAO/C,UAAM,WAAW,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ;AAEvE,UAAM,kBAAkB,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ,EAAE;AAAA,MAC9EA,QAAO,SAAS,iCAAiC;AAAA,QAC/C,YAAY;AAAA,UACV,wBAAwB;AAAA,UACxB,wBAAwB;AAAA,UACxB,sBAAsB;AAAA,UACtB,wBAAwB;AAAA,QAC1B;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,OAAO,cAAc,iBAAiB,MAAM,UAAU,MAAM,MAAM,MAAM,EAAE;AAAA;AAAA;AAAA,MAG/EA,QAAO;AAAA,QAAM,MACXA,QAAO,IAAI,aAAa;AACtB,iBAAO,YAAY,WAAW,MAAM,iBAAiB,QAAQ;AAC7D,gBAAM,kBAAkB,IAAI,UAAU,SAAS;AAC/C,gBAAM,QAAQ,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ;AACpE,iBAAO,OAAO,cAAc,OAAO,MAAM,UAAU,MAAM,MAAM,MAAM;AAAA,QACvE,CAAC,EAAE;AAAA,UACDA,QAAO,SAAS,2BAA2B;AAAA,YACzC,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB;AAAA,cACxB,iBAAiB,MAAM;AAAA,YACzB;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC,EAAE;AAAA,IACDA,QAAO;AAAA,IACPA,QAAO,SAAS,qBAAqB;AAAA,MACnC,YAAY;AAAA,QACV,iBAAiB,MAAM;AAAA,QACvB,sBAAsB,MAAM;AAAA,QAC5B,wBAAwB;AAAA,MAC1B;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;AChOA,SAAS,MAAM,UAAU,UAAAC,SAAe,UAAAC,SAAQ,UAAAC,eAAc;AAC9D,SAAS,iBAAiB,YAAY,yBAAyB;AAQ/D,IAAM,kBAAkB,KAAK,UAAU;AAAA,EACrC,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,QAAQ;AAAA,EACR,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,MAAM,kBAAkB,SAAS,IAAI;AAAA,EACrD;AACF,CAAC;AAKD,IAAM,aAAa,CAAC,SAA2C,SAAgC;AAC7F,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,QAAQ,KAAK,YAAY;AAC/B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,QAAI,EAAE,YAAY,MAAM,MAAO,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,sBAAN,cAAkC,KAAK,YAAY,qBAAqB,EAGrE;AAAC;AAEJ,IAAM,mBAAmBA,QAAO,oBAAoBA,QAAO,eAAeA,QAAO,OAAO,CAAC;AAEzF,IAAM,WAAW,CAAC,SAAiD;AACjE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,iBAAiB,IAAI;AACpC,MAAID,QAAO,OAAO,MAAM,EAAG,QAAO;AAClC,QAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,SAAO;AACT;AAOA,IAAM,oBAAoB,CAAC,SAA0B;AACnD,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,YAAY,MAAO,QAAO;AAClC,SAAO,YAAY,OAAO,WAAW,OAAO,YAAY;AAC1D;AAQA,IAAM,mBAAmB,CAAC,SAA0B;AAClD,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAG,QAAO;AACtC,SAAO,OAAO,IAAI,UAAU;AAC9B;AAEA,IAAM,oBAAoBC,QAAO,OAAO,EAAE,SAASA,QAAO,OAAO,CAAC;AAClE,IAAM,0BAA0BA,QAAO,oBAAoB,iBAAiB;AAE5E,IAAM,0BAA0B,CAAC,UAA2B;AAC1D,QAAM,eAAe,wBAAwB,KAAK;AAClD,MAAID,QAAO,OAAO,YAAY,EAAG,QAAO,aAAa,MAAM;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,GAAG,KAAK;AAAA,EACjB;AACA,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,eAAe;AAC3D,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,YAAa,QAAO;AACzC,SAAO;AACT;AAiDO,IAAM,wBAAwB,CACnC,UACA,UAAwB,CAAC,MAEzBD,QAAO,IAAI,aAAa;AACtB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,UAAU,OAAOA,QAAO,IAAI,aAAa;AAC7C,UAAM,SAAS,OAAO,WAAW;AAEjC,UAAM,WAAW,CAAC,aAGhB,SAAS,KAAK;AAAA,MACZA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC;AAAA,MACzCA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,CAAC;AAAA,IACvC;AAEF,UAAM,WAAW,CACf,UAKA,WAEAA,QAAO,IAAI,aAAa;AACtB,YAAM,cAAc,WAAW,SAAS,SAAS,cAAc,KAAK;AACpE,YAAM,QAAQ,4BAA4B,KAAK,WAAW;AAE1D,UAAI,SAAS,WAAW,KAAK;AAC3B,cAAM,UAAU,WAAW,SAAS,SAAS,kBAAkB;AAC/D,YAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAC9C,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,UACV;AAAA,QACF;AAQA,YAAI,oCAAoC,KAAK,OAAO,GAAG;AACrD,iBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,QAC3C;AASA,YAAI,wBAAwB,KAAK,OAAO,GAAG;AACzC,iBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,QAC3C;AAGA,YAAI,MAAO,QAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAWpD,cAAM,OAAO,OAAO,SAAS,QAAQ;AACrC,YAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC,iBAAiB,IAAI,GAAG;AACvD,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QACE;AAAA,UACJ;AAAA,QACF;AACA,eAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,MAC3C;AAEA,UAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,YAAI,WAAW,OAAO;AACpB,cAAI,CAAC,OAAO;AACV,mBAAO;AAAA,cACL,MAAM;AAAA,cACN,UAAU;AAAA,cACV,QAAQ;AAAA,YACV;AAAA,UACF;AACA,iBAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,QAC5C;AAGA,YAAI,MAAO,QAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AACrD,cAAM,OAAO,OAAO,SAAS,QAAQ;AACrC,YAAI,CAAC,kBAAkB,IAAI,GAAG;AAC5B,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,UACV;AAAA,QACF;AACA,eAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,MAC5C;AAEA,aAAO;AAAA,IACT,CAAC;AAEH,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,eAAe,CAAC,CAAC,GAAG;AACpE,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,cAAc,kBAAkB,KAAK,IAAI,SAAS,CAAC,EAAE;AAAA,MACvD,kBAAkB,UAAU,gBAAgB,kBAAkB;AAAA,MAC9D,kBAAkB,UAAU,UAAU,qCAAqC;AAAA,MAC3E,kBAAkB,SAAS,iBAAiB,kBAAkB;AAAA,IAChE;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AACjE,oBAAc,kBAAkB,UAAU,aAAa,MAAM,KAAK;AAAA,IACpE;AAEA,UAAM,eAAe,OAAO,OACzB,QAAQ,WAAW,EACnB,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAElD,UAAM,aAAa,OAAO,SAAS,cAAc,MAAM;AACvD,QAAI,WAAY,QAAO;AAEvB,QAAI,CAAC,KAAK,KAAK,KAAK,GAAG,EAAE,SAAS,aAAa,MAAM,GAAG;AACtD,UAAI,aAAa,kBAAkB,IAAI,IAAI,SAAS,CAAC,EAAE;AAAA,QACrD,kBAAkB,UAAU,UAAU,mBAAmB;AAAA,MAC3D;AACA,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AACjE,qBAAa,kBAAkB,UAAU,YAAY,MAAM,KAAK;AAAA,MAClE;AACA,YAAM,cAAc,OAAO,OACxB,QAAQ,UAAU,EAClB,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAClD,YAAM,YAAY,OAAO,SAAS,aAAa,KAAK;AACpD,UAAI,UAAW,QAAO;AAAA,IACxB;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,qBAAqB,aAAa,MAAM;AAAA,IAClD;AAAA,EACF,CAAC,EAAE;AAAA,IACDA,QAAO,QAAQ,QAAQ,mBAAmB,gBAAgB,KAAK;AAAA,IAC/DA,QAAO;AAAA,MACL,CAAC,UACC,IAAI,oBAAoB;AAAA,QACtB,QAAQ,wBAAwB,KAAK;AAAA,QACrC;AAAA,MACF,CAAC;AAAA,IACL;AAAA,IACAA,QAAO;AAAA,MAAM,CAAC,UACZA,QAAO,QAA6B;AAAA,QAClC,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT,CAAC,EAAE,KAAKA,QAAO,SAAS,wBAAwB,CAAC;;;ALxRnD;AAAA,EACE;AAAA,OAMK;AA+EP,IAAM,qBAAqB,CACzB,QACA,sBAKwB;AACxB,MAAI,OAAO,cAAc,SAAS;AAChC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C,aAAa,mBAAmB;AAAA,IAChC,SAAS,mBAAmB;AAAA,IAC5B,MAAM,mBAAmB,QAAQ,EAAE,MAAM,OAAO;AAAA,EAClD;AACF;AAEA,IAAM,qBAAqB,CAAC,WAC1B,OAAO,aACP,mBAAmB;AAAA,EACjB,MAAM,OAAO;AAAA,EACb,UAAU,OAAO,cAAc,WAAW,OAAO,WAAW;AAAA,EAC5D,SAAS,OAAO,cAAc,UAAU,OAAO,UAAU;AAC3D,CAAC;AAEH,IAAM,YAAY,CAAC,UACjB,eAAe,KAAK;AAAA,EAClB,QAAQ,MAAM;AAAA,EACd,UAAU,MAAM;AAAA,EAChB,aAAa,MAAM;AAAA,EACnB,aAAa,MAAM;AAAA,EACnB,cAAc,MAAM;AAAA,EACpB,aAAa,MAAM;AACrB,CAAC;AAEH,IAAM,gBAAgB;AAOtB,IAAM,kBAAkB,CAAC,KAAU,UAA2B;AAC5D,QAAM,KAAK,IAAI,OAAO,kBAAkB,KAAK,mBAAmB,GAAG;AACnE,SAAO,GAAG,KAAK,IAAI,QAAQ,KAAK,GAAG,KAAK,IAAI,QAAQ;AACtD;AAMO,IAAM,yBAAyB,CACpC,UACW;AACX,MAAI,MAAM,SAAS,eAAe;AAChC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,MAAM,MAAM,QAAQ,EAAE;AAAA,IACjC,MAAM;AAAA,MACJ;AAAA,MACA,MACE;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,MACE;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,EACR;AACF;AAEA,IAAM,aAAa,CAAC,QAClB,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;AAErE,IAAM,YAAY,CAAC,OAAoC,YACrD,MAAM,IAAI,OAAO,KAAK;AAExB,IAAM,0BAA0B,CAAC,YAC/B,oBAAoB,KAAK;AAAA,EACvB,UAAU,QAAQ;AAAA,EAClB,eAAe,QAAQ;AAAA,EACvB,SAAS,QAAQ;AAAA,EACjB,MAAM,QAAQ;AAAA,EACd,OAAO,QAAQ;AAAA,EACf,WAAW,QAAQ;AAAA,EACnB,WAAW,QAAQ;AACrB,CAAC;AAEH,IAAM,wBAAwB,CAC5B,KACA,UACA,gBAEAG,QAAO,IAAI,aAAa;AACtB,QAAM,QAAQ,WAAW,GAAG;AAC5B,QAAM,mBAAmB,UAAU,OAAO,WAAW;AACrD,MAAI,qBAAqB,SAAU,QAAO,CAAC;AAC3C,QAAM,WAAW,OAAO,IAAI,mBAAmB,cAAc;AAAA,IAC3D,UAAU;AAAA,IACV;AAAA,IACA,aAAa,QAAQ,KAAK,WAAW;AAAA,EACvC,CAAC;AACD,SAAO,SACJ,OAAO,CAAC,YAAY,UAAU,OAAO,QAAQ,OAAO,KAAK,gBAAgB,EACzE,IAAI,uBAAuB;AAChC,CAAC;AAEH,IAAM,0BAA0B,CAC9B,KACA,UACA,aACA,SAEAA,QAAO,IAAI,aAAa;AACtB,QAAM,QAAQ,WAAW,GAAG;AAC5B,QAAM,mBAAmB,UAAU,OAAO,WAAW;AACrD,MAAI,qBAAqB,SAAU,QAAO;AAC1C,QAAM,WAAW,OAAO,IAAI,mBAAmB,cAAc;AAAA,IAC3D,UAAU;AAAA,IACV;AAAA,IACA,aAAa,QAAQ,KAAK,WAAW;AAAA,EACvC,CAAC;AACD,QAAM,UAAU,SACb;AAAA,IACC,CAAC,cACC,UAAU,YAAY,QAAQ,UAAU,OAAO,UAAU,OAAO,KAAK;AAAA,EACzE,EACC,KAAK,CAAC,GAAG,MAAM,UAAU,OAAO,EAAE,OAAO,IAAI,UAAU,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;AAC9E,SAAO,UAAU,wBAAwB,OAAO,IAAI;AACtD,CAAC;AAEH,IAAM,2BAA2B,CAC/B,KACA,UAMAA,QAAO,IAAI,aAAa;AACtB,QAAM,QAAQ,WAAW,GAAG;AAC5B,QAAM,mBAAmB,UAAU,OAAO,MAAM,WAAW;AAC3D,QAAM,aAAa,UAAU,OAAO,MAAM,WAAW;AACrD,QAAM,YAAY,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,IAAI,CAAC;AAC5D,MAAI,qBAAqB,UAAU;AACjC,WAAO,OAAO,IAAI,aAAa;AAAA,MAC7B,SACE,+CAA+C,MAAM,WAAW,gDAClB,SAAS;AAAA,MACzD,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,eAAe,UAAU;AAC3B,WAAO,OAAO,IAAI,aAAa;AAAA,MAC7B,SACE,qCAAqC,MAAM,WAAW,gDACrB,SAAS;AAAA,MAC5C,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,aAAa,kBAAkB;AACjC,WAAO,OAAO,IAAI,aAAa;AAAA,MAC7B,SACE,4BAA4B,MAAM,QAAQ,uCAC1B,MAAM,WAAW,uCAC7B,MAAM,WAAW;AAAA,MACvB,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF,CAAC;AAEH,IAAM,qBAAqB,CACzB,aACA,aAC0D;AAC1D,MAAI,SAAS,WAAW,EAAG,QAAOA,QAAO,QAAQ,MAAS;AAC1D,MAAI,YAAa,QAAOA,QAAO,QAAQ,WAAW;AAClD,SAAOA,QAAO;AAAA,IACZ,IAAI,mBAAmB;AAAA,MACrB,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,IAAM,wBAAwB,CAC5B,qBACA,YAC8C;AAC9C,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,YAAa,QAAOA,QAAO,QAAQ,WAAW;AAClD,SAAOA,QAAO;AAAA,IACZ,IAAI,mBAAmB;AAAA,MACrB,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,IAAM,4BAA4B,CAChC,QACA,gBAQG;AACH,QAAM,aAA2D,CAAC;AAClE,QAAM,WAAwF,CAAC;AAC/F,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC,GAAG;AACxD,QAAI,OAAO,UAAU,UAAU;AAC7B,iBAAW,IAAI,IAAI;AACnB;AAAA,IACF;AACA,QAAI,UAAU,OAAO;AACnB,iBAAW,IAAI,IAAI;AACnB;AAAA,IACF;AACA,UAAM,OAAO,YAAY,IAAI;AAC7B,eAAW,IAAI,IAAIC,6BAA4B,KAAK;AAAA,MAClD,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,MAAM;AAAA,IAChB,CAAC;AACD,aAAS,KAAK;AAAA,MACZ;AAAA,MACA,aAAa,iBAAiB,QAAQ,MAAM,cAAc;AAAA,MAC1D,OAAO;AAAA,QACL,MAAM;AAAA,QACN,UAAU,SAAS,KAAK,MAAM,QAAQ;AAAA,QACtC,GAAI,mBAAmB,SAAS,MAAM,gBAClC,EAAE,eAAe,MAAM,cAAc,IACrC,CAAC;AAAA,MACP;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,QAAQ,YAAY,SAAS;AACxC;AAEA,IAAM,mBAAmB,CACvB,SAQG;AACH,MAAI,CAAC,QAAQ,KAAK,SAAS,OAAQ,QAAO,EAAE,MAAM,EAAE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE;AACjF,MAAI,KAAK,SAAS,UAAU;AAC1B,QAAI,gBAAgB,KAAM,QAAO,EAAE,MAAM,UAAU,CAAC,EAAE;AACtD,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,YAAY,KAAK;AAAA,QACjB,YAAY;AAAA,QACZ,QAAQ,KAAK;AAAA,MACf;AAAA,MACA,UAAU;AAAA,QACR;AAAA,UACE,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,UAClB,OAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU,SAAS,KAAK,KAAK,QAAQ;AAAA,YACrC,GAAI,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,UACpE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,oBAAoB,KAAM,QAAO,EAAE,MAAM,UAAU,CAAC,EAAE;AAC1D,QAAM,WAAwF;AAAA,IAC5F;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,QACL,MAAM;AAAA,QACN,cAAc,aAAa,KAAK,KAAK,YAAY;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,kBAAkB;AACzB,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,UAAU,UAAU,SAAS,KAAK,KAAK,gBAAgB,EAAE;AAAA,IAC1E,CAAC;AAAA,EACH;AACA,MAAI,KAAK,sBAAsB;AAC7B,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,UAAU,UAAU,SAAS,KAAK,KAAK,oBAAoB,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,GAAI,KAAK,mBAAmB,EAAE,cAAc,yBAAyB,IAAI,CAAC;AAAA,MAC1E,GAAI,KAAK,uBAAuB,EAAE,kBAAkB,6BAA6B,IAAI,CAAC;AAAA,IACxF;AAAA,IACA;AAAA,EACF;AACF;AAcA,IAAM,oBAAoB,CAAC,iBAA8C;AAAA,EACvE,IAAI,cAAc;AAChB,WAAO;AAAA,EACT;AAAA,EACA,IAAI,iBAAiB;AACnB,WAAO;AAAA,MACL,eAAe,CAAC,iCAAiC;AAAA,MACjD,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,mBAAmB,MAAM;AAAA,EACzB,uBAAuB,MAAM;AAAA,EAC7B,QAAQ,OAAO,EAAE,cAAc,aAAa,YAAY,SAAS;AAAA,EACjE,YAAY,MAAM;AAAA,EAClB,yBAAyB,YAAY;AAEnC,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAAA,EACA,kBAAkB,MAAM;AAAA,EACxB,cAAc,MAAM;AAElB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EACA,oBAAoB,MAAM;AAAA,EAC1B,gBAAgB,MAAM;AACxB;AAEA,IAAM,yBAAyB,CAC7B,QACA,QAEA,6BAA6B;AAAA,EAC3B;AAAA,EACA,WAAW,IAAI,QAAQ;AAAA,EACvB,WAAW,CAAC,OAAO,UACjB,IAAI,mBAAmB;AAAA,IACrB,WAAW;AAAA,IACX,SAAS,6BAA6B,MAAM,QAAQ;AAAA,EACtD,CAAC;AAAA,EACH,SAAS,CAAC,KAAK,OAAO,UACpBC,WAAU,SAAS,8BAA8B,EAAE,GAAG,IAClD,IAAI,mBAAmB;AAAA,IACrB,WAAW;AAAA,IACX,SAAS,6BAA6B,MAAM,QAAQ;AAAA,EACtD,CAAC,IACD;AACR,CAAC,EAAE;AAAA,EACDF,QAAO;AAAA,IAAS,CAAC,QACfE,WAAU,SAAS,8BAA8B,EAAE,GAAG,IAClD,IAAI,mBAAmB,EAAE,WAAW,UAAU,SAAS,2BAA2B,CAAC,IACnF;AAAA,EACN;AACF;AAEF,IAAM,iBAAiB,CACrB,WACuC;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,QAAQ,MAAM,EAAE;AAAA,IACrC,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM;AAAA,EAC5D;AACA,SAAO,QAAQ,SAAS,IAAI,OAAO,YAAY,OAAO,IAAI;AAC5D;AAEA,IAAM,4BAA4B,CAChC,KACA,QACA,WAOAF,QAAO,IAAI,aAAa;AACtB,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,WAAmC,CAAC;AAC1C,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,OAAO,UAAU,UAAU;AAC7B,eAAS,IAAI,IAAI;AACjB;AAAA,IACF;AACA,UAAM,UAAU,OAAO;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,MACP,MAAM;AAAA,IACR;AACA,QAAI,SAAS,MAAM,SAAS,UAAU;AACpC,YAAM,SAAS,OAAO,IAAI,QAAQ,WAAW,QAAQ,MAAM,UAAU,QAAQ,OAAO,EAAE;AAAA,QACpFA,QAAO;AAAA,UAAS;AAAA,UAAgC,MAC9CA,QAAO;AAAA,YACL,IAAI,mBAAmB;AAAA,cACrB,WAAW;AAAA,cACX,SAAS,gCAAgC,OAAO,YAAY,KAAK,IAAI;AAAA,YACvE,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,MAAM;AACnB,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SAAS,mBAAmB,QAAQ,MAAM,QAAQ,SAAS,OAAO,YAAY,KAAK,IAAI;AAAA,QACzF,CAAC;AAAA,MACH;AACA,eAAS,IAAI,IAAI,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG,MAAM,KAAK;AAC7D;AAAA,IACF;AACA,QAAI,SAAS,MAAM,SAAS,QAAQ;AAClC,eAAS,IAAI,IAAI,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG,QAAQ,MAAM,IAAI,KAAK,QAAQ,MAAM;AACvF;AAAA,IACF;AACA,WAAO,OAAO,IAAI,mBAAmB;AAAA,MACnC,WAAW;AAAA,MACX,SAAS,uBAAuB,OAAO,YAAY,KAAK,IAAI;AAAA,IAC9D,CAAC;AAAA,EACH;AACA,SAAO,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,WAAW;AACvD,CAAC;AAEH,IAAM,+BAA+B,CACnC,KACA,QACA,WAOAA,QAAO,IAAI,aAAa;AACtB,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,WAAmC,CAAC;AAC1C,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,OAAO,UAAU,UAAU;AAC7B,eAAS,IAAI,IAAI;AACjB;AAAA,IACF;AACA,QAAI,UAAU,OAAO;AACnB,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,QACA,EAAE,CAAC,IAAI,GAAG,MAAM;AAAA,QAChB;AAAA,UACE,UAAU,OAAO;AAAA,UACjB,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,QACvB;AAAA,MACF;AACA,UAAI,eAAe,IAAI,MAAM,OAAW,UAAS,IAAI,IAAI,aAAa,IAAI;AAC1E;AAAA,IACF;AACA,UAAM,cACJ,mBAAmB,QACd,MAAM,iBAAiB,MAAM,cAC7B,OAAO,eAAe,OAAO;AACpC,UAAM,SAAS,OAAO,IAAI,QAAQ,WAAW,SAAS,KAAK,MAAM,QAAQ,GAAG,WAAW,EAAE;AAAA,MACvFA,QAAO;AAAA,QAAS;AAAA,QAAgC,MAC9CA,QAAO;AAAA,UACL,IAAI,mBAAmB;AAAA,YACrB,WAAW;AAAA,YACX,SAAS,gCAAgC,OAAO,YAAY,KAAK,IAAI;AAAA,UACvE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,MAAM;AACnB,aAAO,OAAO,IAAI,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,SAAS,mBAAmB,MAAM,QAAQ,SAAS,OAAO,YAAY,KAAK,IAAI;AAAA,MACjF,CAAC;AAAA,IACH;AACA,aAAS,IAAI,IAAI,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG,MAAM,KAAK;AAAA,EAC/D;AACA,SAAO,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,WAAW;AACvD,CAAC;AAEH,IAAM,uBAAuB,CAC3B,KACA,UACA,aACA,SAEAA,QAAO,IAAI,aAAa;AACtB,MAAI,KAAK,SAAS,SAAU,QAAO,CAAC;AACpC,QAAM,UAAU,OAAO,wBAAwB,KAAK,UAAU,aAAa,KAAK,UAAU;AAC1F,MAAI,SAAS,MAAM,SAAS,UAAU;AACpC,UAAM,SAAS,OAAO,IAAI,QAAQ,WAAW,QAAQ,MAAM,UAAU,QAAQ,OAAO,EAAE;AAAA,MACpFA,QAAO;AAAA,QAAS;AAAA,QAAgC,MAC9CA,QAAO;AAAA,UACL,IAAI,mBAAmB;AAAA,YACrB,WAAW;AAAA,YACX,SAAS,0CAA0C,KAAK,UAAU;AAAA,UACpE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,MAAM;AACnB,aAAO,OAAO,IAAI,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,SAAS,2CAA2C,KAAK,UAAU;AAAA,MACrE,CAAC;AAAA,IACH;AACA,WAAO,EAAE,CAAC,KAAK,UAAU,GAAG,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,MAAM,KAAK,OAAO;AAAA,EAC/E;AACA,MAAI,SAAS,MAAM,SAAS,QAAQ;AAClC,WAAO;AAAA,MACL,CAAC,KAAK,UAAU,GAAG,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,QAAQ,MAAM,IAAI,KAAK,QAAQ,MAAM;AAAA,IACzF;AAAA,EACF;AACA,SAAO,OAAO,IAAI,mBAAmB;AAAA,IACnC,WAAW;AAAA,IACX,SAAS,gCAAgC,KAAK,UAAU;AAAA,EAC1D,CAAC;AACH,CAAC;AAEH,IAAM,gCAAgC,CACpC,KACA,UACA,aACA,SAEAA,QAAO,IAAI,aAAa;AACtB,MAAI,KAAK,SAAS,SAAU,QAAO;AACnC,QAAM,UAAU,OAAO,wBAAwB,KAAK,UAAU,aAAa,KAAK,cAAc;AAC9F,MAAI,SAAS,MAAM,SAAS,cAAc;AACxC,WAAO,OAAO,IAAI,mBAAmB;AAAA,MACnC,WAAW;AAAA,MACX,SAAS,oDAAoD,QAAQ;AAAA,IACvE,CAAC;AAAA,EACH;AACA,QAAM,eAAe,QAAQ,MAAM;AACnC,QAAM,cAAc,OAAO,IAAI,YAC5B,mBAAmB,cAAc,QAAQ,OAAO,EAChD;AAAA,IACCA,QAAO;AAAA,MACL,CAAC,EAAE,QAAQ,MACT,IAAI,mBAAmB;AAAA,QACrB,WAAW;AAAA,QACX,SAAS,uCAAuC,YAAY,MAAM,OAAO;AAAA,MAC3E,CAAC;AAAA,IACL;AAAA,EACF;AACF,SAAO,kBAAkB,WAAW;AACtC,CAAC;AAEH,IAAM,sBAAsB,CAC1B,KACA,UACA,aACA,aACA,SAKAA,QAAO,IAAI,aAAa;AACtB,MAAI,CAAC,QAAQ,KAAK,SAAS,OAAQ,QAAO,EAAE,SAAS,CAAC,EAAE;AACxD,MAAI,KAAK,SAAS,UAAU;AAC1B,QAAI,gBAAgB,MAAM;AACxB,YAAM,UAAU,OAAO,qBAAqB,KAAK,UAAU,aAAa,IAAI;AAC5E,aAAO,EAAE,QAAQ;AAAA,IACnB;AACA,UAAM,cAAc,KAAK,iBAAiB,KAAK,eAAe,eAAe;AAC7E,UAAM,SAAS,OAAO,IAAI,QAAQ,WAAW,SAAS,KAAK,KAAK,QAAQ,GAAG,WAAW,EAAE;AAAA,MACtFA,QAAO;AAAA,QAAS;AAAA,QAAgC,MAC9CA,QAAO;AAAA,UACL,IAAI,mBAAmB;AAAA,YACrB,WAAW;AAAA,YACX,SAAS,6BAA6B,KAAK,QAAQ;AAAA,UACrD,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,MAAM;AACnB,aAAO,OAAO,IAAI,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,SAAS,6BAA6B,KAAK,QAAQ;AAAA,MACrD,CAAC;AAAA,IACH;AACA,WAAO;AAAA,MACL,SAAS,EAAE,CAAC,KAAK,UAAU,GAAG,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,MAAM,KAAK,OAAO;AAAA,IACjF;AAAA,EACF;AACA,QAAM,aACJ,kBAAkB,OACd,EAAE,IAAI,aAAa,KAAK,KAAK,YAAY,GAAG,OAAO,eAAe,YAAY,IAC9E,OAAOA,QAAO,IAAI,aAAa;AAC7B,UAAM,UAAU,OAAO;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,SAAS,MAAM,SAAS,eAC3B,EAAE,IAAI,QAAQ,MAAM,cAAc,OAAO,QAAQ,QAAQ,IACzD;AAAA,EACN,CAAC;AACP,MAAI,eAAe,MAAM;AACvB,WAAO,OAAO,IAAI,mBAAmB;AAAA,MACnC,WAAW;AAAA,MACX,SAAS,oDAAoD,QAAQ;AAAA,IACvE,CAAC;AAAA,EACH;AACA,QAAM,cAAc,OAAO,IAAI,YAC5B,mBAAmB,WAAW,IAAI,WAAW,KAAK,EAClD;AAAA,IACCA,QAAO;AAAA,MACL,CAAC,EAAE,QAAQ,MACT,IAAI,mBAAmB;AAAA,QACrB,WAAW;AAAA,QACX,SAAS,uCAAuC,WAAW,EAAE,MAAM,OAAO;AAAA,MAC5E,CAAC;AAAA,IACL;AAAA,EACF;AACF,SAAO,EAAE,SAAS,CAAC,GAAG,cAAc,kBAAkB,WAAW,EAAE;AACrE,CAAC;AAMH,IAAM,wBAAwB,CAC5B,UACA,aACA,IACA,KACA,eACuE;AACvE,MAAI,GAAG,cAAc,SAAS;AAC5B,QAAI,CAAC,YAAY;AACf,aAAOA,QAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAOA,QAAO,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,SAAS,GAAG;AAAA,MACZ,MAAM,GAAG;AAAA,MACT,KAAK,GAAG;AAAA,MACR,KAAK,GAAG;AAAA,IACV,CAAC;AAAA,EACH;AAEA,SAAOA,QAAO,IAAI,aAAa;AAC7B,UAAM,kBAAkB,OAAO,0BAA0B,KAAK,GAAG,SAAS;AAAA,MACxE;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,sBAAsB,OAAO,0BAA0B,KAAK,GAAG,aAAa;AAAA,MAChF;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,UAAkC,EAAE,GAAI,mBAAmB,CAAC,EAAG;AAErE,UAAM,OAAO,GAAG;AAChB,QAAI,KAAK,SAAS,UAAU;AAC1B,aAAO,OAAO,SAAS,OAAO,qBAAqB,KAAK,UAAU,aAAa,IAAI,CAAC;AAAA,IACtF;AACA,UAAM,eAAe,OAAO,8BAA8B,KAAK,UAAU,aAAa,IAAI;AAE1F,WAAO;AAAA,MACL,WAAW;AAAA,MACX,UAAU,GAAG;AAAA,MACb,iBAAiB,GAAG;AAAA,MACpB,aAAa;AAAA,MACb,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AAAA,MACrD;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAcA,IAAM,cAAc,MAClBA,QAAO,IAAI,aAAa;AACtB,QAAM,aAAa,OAAO,MAAM,KAAK;AACrC,QAAM,oBAAoB,oBAAI,IAA8D;AAC5F,QAAM,kBAAkB,OAAOG,aAAY,KAAK;AAAA,IAC9C,QAAQ,CAAC,QACPH,QAAO;AAAA,MACLA,QAAO,QAAQ,MAAM;AACnB,cAAM,YAAY,kBAAkB,IAAI,GAAG;AAC3C,YAAI,CAAC,WAAW;AACd,iBAAOA,QAAO;AAAA,YACZ,IAAI,mBAAmB;AAAA,cACrB,WAAW;AAAA,cACX,SAAS,iCAAiC,GAAG;AAAA,YAC/C,CAAC;AAAA,UACH;AAAA,QACF;AACA,eAAO;AAAA,MACT,CAAC;AAAA,MACD,CAAC,eACCA,QAAO;AAAA,QACLA,QAAO,WAAW;AAAA,UAChB,KAAK,MAAM,WAAW,MAAM;AAAA,UAC5B,OAAO,MACL,IAAI,mBAAmB;AAAA,YACrB,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AAAA,QACL,CAAC;AAAA,MACH;AAAA,IACJ;AAAA,IACF,UAAU;AAAA,IACV,YAAYI,UAAS,QAAQ,CAAC;AAAA,EAChC,CAAC,EAAE,KAAK,MAAM,QAAQ,UAAU,CAAC;AAEjC,SAAO,EAAE,iBAAiB,mBAAmB,WAAW;AAC1D,CAAC;AAoBH,IAAM,YAAY,CAAC,OAAuB,GAAG,iBAAiB,GAAG,EAAE;AAEnE,IAAM,eAAe,CAAC,SAAwE;AAC5F,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,OAAQ,QAAO,EAAE,MAAM,OAAO;AAChD,MAAI,KAAK,SAAS,UAAU;AAC1B,QAAI,EAAE,cAAc,MAAO,QAAO;AAClC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,QAAQ,UAAU,KAAK,QAAQ;AAAA,MAC/B,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AACA,MAAI,EAAE,kBAAkB,MAAO,QAAO;AACtC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,KAAK;AAAA,EACrB;AACF;AAcA,IAAM,oBAAoB,CACxB,QACA,eACmC;AACnC,MAAI,OAAO,eAAe,SAAU,QAAO;AAC3C,QAAM,QAAQ,OAAO,IAAI,WAAW,IAAI;AACxC,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,SAAS,UAAU;AAC3B,WAAO;AAAA,MACL,UAAU,MAAM;AAAA,MAChB,GAAI,WAAW,SAAS,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,MAAI,MAAM,SAAS,OAAQ,QAAO,MAAM;AAExC,SAAO;AACT;AAEA,IAAM,uBAAuB,CAC3B,QACA,WACmD;AACnD,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,MAA0C,CAAC;AACjD,aAAW,CAAC,MAAM,UAAU,KAAK,OAAO,QAAQ,MAAM,GAAG;AACvD,UAAM,QAAQ,kBAAkB,QAAQ,UAAU;AAClD,QAAI,UAAU,OAAW,KAAI,IAAI,IAAI;AAAA,EACvC;AACA,SAAO,OAAO,KAAK,GAAG,EAAE,SAAS,IAAI,MAAM;AAC7C;AAEA,IAAM,cAAc,CAClB,QACA,SACuC;AACvC,MAAI,KAAK,SAAS,OAAQ,QAAO,EAAE,MAAM,OAAO;AAChD,MAAI,KAAK,SAAS,UAAU;AAC1B,UAAM,QAAQ,OAAO,IAAI,KAAK,UAAU;AACxC,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AACA,QAAM,aAAa,OAAO,IAAI,KAAK,cAAc;AACjD,MAAI,YAAY,SAAS,aAAc,QAAO;AAC9C,SAAO,EAAE,MAAM,UAAU,cAAc,WAAW,aAAa;AACjE;AAEA,IAAM,sBAAsB,CAC1B,UACA,QACA,OACA,YACA,cACoB;AACpB,MAAI,OAAO,cAAc,SAAS;AAChC,WAAO;AAAA,MACL,WAAW;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO,OAAO,CAAC,GAAG,OAAO,IAAI,IAAI;AAAA,MACvC,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AACA,QAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AACzE,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,SAAS,qBAAqB,QAAQ,OAAO,OAAO;AAAA,IACpD,aAAa,qBAAqB,QAAQ,OAAO,WAAW;AAAA,IAC5D,MAAM,YAAY,QAAQ,OAAO,IAAI;AAAA,EACvC;AACF;AAEA,IAAM,mBAAmB,CACvB,WACA,YACA,WACiB;AACjB,MAAI,OAAO,cAAc,SAAS;AAChC,UAAMC,SAA6B;AAAA,MACjC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,MAAM;AAAA,MACN,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ;AAAA,IACF;AACA,WAAOA;AAAA,EACT;AACA,QAAM,QAA8B;AAAA,IAClC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,MAAM;AAAA,IACN,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,aAAa,eAAe,OAAO,WAAW;AAAA,IAC9C,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,MAAM,aAAa,OAAO,IAAI;AAAA,EAChC;AACA,SAAO;AACT;AAEO,IAAM,YAAY,aAAa,CAAC,YAA+B;AACpE,QAAM,aAAa,SAAS,4BAA4B;AAIxD,QAAM,aAA6C,EAAE,SAAS,KAAK;AAEnE,QAAM,gBAAgB,MACpB,WAAW,UACPL,QAAO,QAAQ,WAAW,OAAO,IACjC,YAAY,EAAE;AAAA,IACZA,QAAO;AAAA,MAAI,CAAC,OACVA,QAAO,KAAK,MAAM;AAChB,mBAAW,UAAU;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AAEN,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMb,cAAc,EAAE,WAAW;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,CAAC,SAA0B,aAAa,IAAI;AAAA,IAErD,WAAW,CAAC,QAAQ;AAClB,YAAM,kBAAkB,SAAS,mBAAmB,IAAI;AACxD,YAAM,gBAAgB,CAAC,UACrBA,QAAO,IAAI,aAAa;AACtB,cAAM,WAAW,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC3D,cAAM,UAAU,SAAS,KAAK;AAC9B,YAAI,CAAC,SAAS;AACZ,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,OAAO,OAAOA,QAAO,IAAI;AAAA,UAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;AAAA,UAC5B,OAAO,MAAM;AAAA,QACf,CAAC,EAAE,KAAKA,QAAO,cAAc,MAAM,KAAK,CAAC;AACzC,cAAM,YAAY,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAE1D,cAAM,eACJ,OAAO,UAAU,WACb,SACA,OAAO,uBAAuB,MAAM,SAAS,GAAG;AACtD,cAAM,mBACJ,OAAO,UAAU,WACb,SACA,OAAO,uBAAuB,MAAM,aAAa,GAAG;AAE1D,cAAM,YAAY,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AAED,cAAM,SAAS,OAAO,cAAc,SAAS,EAAE;AAAA,UAC7CA,QAAO,IAAI,CAAC,OAAO,EAAE,IAAI,MAAe,UAAU,EAAE,EAAE;AAAA,UACtDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,UAAU,KAAK,CAAC,CAAC;AAAA,UACzEA,QAAO,SAAS,2BAA2B;AAAA,QAC7C;AAEA,YAAI,OAAO,MAAM,OAAO,UAAU;AAChC,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,eAAe;AAAA,YACf,6BAA6B;AAAA,YAC7B,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,YACtC;AAAA,YACA,WAAW,OAAO,SAAS,MAAM;AAAA,YACjC,YAAY,OAAO,SAAS,QAAQ,QAAQ;AAAA,UAC9C;AAAA,QACF;AAQA,cAAM,QAAQ,OAAO,sBAAsB,SAAS;AAAA,UAClD;AAAA,UACA,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AACD,YAAI,MAAM,SAAS,OAAO;AACxB,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS,uBAAuB,KAAK;AAAA,UACvC,CAAC;AAAA,QACH;AAEA,cAAM,cAAc,OAAO,IAAI,MAC5B,MAAM;AAAA,UACL,UAAU;AAAA,UACV,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC,EACA;AAAA,UACCA,QAAO,IAAI,CAAC,WAAW,EAAE,IAAI,MAAe,MAAM,EAAE;AAAA,UACpDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,OAAO,KAAK,CAAC,CAAC;AAAA,UACtEA,QAAO,SAAS,wBAAwB;AAAA,QAC1C;AAEF,YAAI,YAAY,IAAI;AAClB,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,eAAe;AAAA,YACf,6BAA6B,YAAY,MAAM;AAAA,YAC/C;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,YAAY;AAAA,UACd;AAAA,QACF;AAEA,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,gBAAgB,OAAO,UAAU,WAAW,QAAQ,MAAM,SAAS;AAAA,QACnF,CAAC;AAAA,MACH;AAEF,YAAM,aAAa,SAAS;AAE5B,YAAM,YAAY,CAAC,WACjBA,QAAO,IAAI,aAAa;AACtB,cAAM,YAAY,mBAAmB,MAAM;AAC3C,cAAM,kBACJ,OAAO,cAAc,WACjB;AAAA,UACE,SAAS,0BAA0B,OAAO,SAAS,aAAa;AAAA,UAChE,aAAa,0BAA0B,OAAO,aAAa,iBAAiB;AAAA,UAC5E,MAAM,iBAAiB,OAAO,IAAI;AAAA,QACpC,IACA;AACN,cAAM,iBAAiB,kBACnB;AAAA,UACE,GAAG,gBAAgB,QAAQ;AAAA,UAC3B,GAAG,gBAAgB,YAAY;AAAA,UAC/B,GAAG,gBAAgB,KAAK;AAAA,QAC1B,IACA,CAAC;AACL,mBAAW,WAAW,gBAAgB;AACpC,gBAAMM,sBAAqB,OAAO;AAAA,YAChC,OAAO,cAAc,WAAW,OAAO,wBAAwB;AAAA,YAC/D;AAAA,UACF;AACA,iBAAO,yBAAyB,KAAK;AAAA,YACnC,UAAU;AAAA,YACV,aAAa,OAAO;AAAA,YACpB,aAAaA;AAAA,UACf,CAAC;AAAA,QACH;AACA,cAAM,cACJ,OAAO,cAAc,YAAY,eAAe,CAAC,IAC7C,OAAO,sBAAsB,OAAO,uBAAuB,eAAe,CAAC,CAAC,IAC5E;AACN,cAAM,KAAK;AAAA,UACT;AAAA,UACA,kBACI;AAAA,YACE,SAAS,gBAAgB,QAAQ;AAAA,YACjC,aAAa,gBAAgB,YAAY;AAAA,YACzC,MAAM,gBAAgB,KAAK;AAAA,UAC7B,IACA;AAAA,QACN;AASA,cAAM,WAAW,QACf,OAAO,cAAc,WACjBN,QAAO,IAAI,aAAa;AACtB,gBAAM,kBAAkB,OAAO,6BAA6B,KAAK,OAAO,SAAS;AAAA,YAC/E,UAAU;AAAA,YACV,aAAa,OAAO;AAAA,YACpB;AAAA,YACA,cAAc;AAAA,UAChB,CAAC;AACD,gBAAM,sBAAsB,OAAO;AAAA,YACjC;AAAA,YACA,OAAO;AAAA,YACP;AAAA,cACE,UAAU;AAAA,cACV,aAAa,OAAO;AAAA,cACpB;AAAA,cACA,cAAc;AAAA,YAChB;AAAA,UACF;AACA,gBAAM,eAAe,OAAO;AAAA,YAC1B;AAAA,YACA;AAAA,YACA,OAAO;AAAA,YACP;AAAA,YACA,OAAO;AAAA,UACT;AACA,gBAAM,UAAU;AAAA,YACd,GAAI,mBAAmB,CAAC;AAAA,YACxB,GAAG,aAAa;AAAA,UAClB;AACA,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,UAAU,OAAO;AAAA,YACjB,iBAAiB,OAAO,mBAAmB;AAAA,YAC3C,aAAa;AAAA,YACb,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AAAA,YACrD,cAAc,aAAa;AAAA,UAC7B;AAAA,QACF,CAAC,IACD,sBAAsB,WAAW,OAAO,OAAO,IAAI,KAAK,UAAU,GACtE;AAAA,UACAA,QAAO;AAAA,UACPA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,OAAO,UAAU,QAAQ,KAAK,GAAG,cAAc,SAAS;AAC1D,iBAAO,OAAOA,QAAO,KAAK,SAAS,OAAO;AAAA,QAC5C;AAMA,cAAM,YAGF,OAAO,UAAU,QAAQ,IACzB,OAAO,cAAc,mBAAmB,SAAS,OAAO,CAAC,EAAE;AAAA,UACzDA,QAAO;AAAA,YACL,CAAC,EAAE,QAAQ,MACT,IAAI,sBAAsB;AAAA,cACxB,OAAO;AAAA,cACP,SAAS,yBAAyB,OAAO;AAAA,YAC3C,CAAC;AAAA,UACL;AAAA,UACAA,QAAO;AAAA,UACPA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH,IACA,OAAO,KAAK,SAAS,OAAO;AAChC,cAAM,WAAW,OAAO,UAAU,SAAS,IACvC,UAAU,UACV,EAAE,QAAQ,QAAW,OAAO,CAAC,EAAW;AAE5C,cAAM,aAAa,OAAO,QAAQ,SAAS,QAAQ,QAAQ;AAE3D,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AAItB,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,OAAO,KAAK;AACpE,mBAAO,IAAI,QAAQ,aAAa,WAAW,OAAO,KAAK;AAEvD,mBAAO,IAAI,QAAQ,UAAU;AAAA,cAC3B;AAAA,cACA,OAAO,OAAO;AAAA,cACd,MAAM;AAAA,cACN,QAAQ;AAAA,YACV,CAAC;AAED,mBAAO,IAAI,QAAQ;AAAA,cACjB;AAAA,cACA,OAAO;AAAA,cACP,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBACzB,QAAQ,GAAG,SAAS,IAAI,EAAE,MAAM;AAAA,gBAChC,SAAS,UAAU,CAAC;AAAA,cACtB,EAAE;AAAA,YACJ;AAEA,mBAAO,IAAI,KAAK,QAAQ,SAAS;AAAA,cAC/B,IAAI;AAAA,cACJ,OAAO,OAAO;AAAA,cACd,MAAM;AAAA,cACN,MAAM;AAAA,cACN,KAAK,GAAG,cAAc,WAAW,GAAG,WAAW;AAAA,cAC/C,WAAW;AAAA,cACX,YAAY;AAAA,cACZ,SAAS,GAAG,cAAc;AAAA,cAC1B,OAAO,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBAChC,MAAM,EAAE;AAAA,gBACR,aAAa,EAAE,eAAe,aAAa,EAAE,QAAQ;AAAA,gBACrD,aAAa,EAAE;AAAA,gBACf,cAAc,EAAE;AAAA,cAClB,EAAE;AAAA,YACJ,CAAC;AAED,gBAAI,eAAe,SAAS,GAAG;AAC7B,yBAAW,WAAW,gBAAgB;AACpC,sBAAMM,sBAAqB,OAAO;AAAA,kBAChC,OAAO,cAAc,WAAW,OAAO,wBAAwB;AAAA,kBAC/D;AAAA,gBACF;AACA,uBAAO,IAAI,mBAAmB,IAAI;AAAA,kBAChC,aAAa,QAAQ,KAAKA,mBAAkB;AAAA,kBAC5C,UAAU;AAAA,kBACV,UAAU;AAAA,kBACV,aAAa,QAAQ,KAAK,OAAO,KAAK;AAAA,kBACtC,SAAS,QAAQ;AAAA,kBACjB,OAAO,QAAQ;AAAA,gBACjB,CAAC;AAAA,cACH;AAAA,YACF;AAAA,UACF,CAAC;AAAA,QACH,EACC;AAAA,UACCN,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,yBAAyB,SAAS,MAAM;AAAA,YAC1C;AAAA,UACF,CAAC;AAAA,QACH;AAEF,YAAI,YAAY;AACd,iBAAO,WACJ,aAAa,iBAAiB,WAAW,YAAY,MAAM,CAAC,EAC5D,KAAKA,QAAO,SAAS,+BAA+B,CAAC;AAAA,QAC1D;AAEA,YAAI,OAAO,UAAU,SAAS,GAAG;AAC/B,iBAAO,OAAOA,QAAO,KAAK,UAAU,OAAO;AAAA,QAC7C;AACA,eAAO,EAAE,WAAW,SAAS,MAAM,QAAQ,UAAU;AAAA,MACvD,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY;AAAA,YACV,wBAAwB,OAAO;AAAA,YAC/B,mBAAmB,OAAO;AAAA,UAC5B;AAAA,QACF,CAAC;AAAA,MACH;AAEF,YAAM,eAAe,CAAC,WAAmB,UACvCA,QAAO,IAAI,aAAa;AACtB,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AACtB,mBAAO,IAAI,mBAAmB,gBAAgB;AAAA,cAC5C,UAAU;AAAA,cACV,UAAU;AAAA,cACV,aAAa,QAAQ,KAAK,KAAK;AAAA,YACjC,CAAC;AACD,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,KAAK;AAC7D,mBAAO,IAAI,QAAQ,aAAa,WAAW,KAAK;AAChD,mBAAO,IAAI,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,aAAa,MAAM,CAAC;AAAA,UAC1E,CAAC;AAAA,QACH,EACC,KAAKA,QAAO,SAAS,2BAA2B,CAAC;AACpD,YAAI,YAAY;AACd,iBAAO,WACJ,aAAa,SAAS,EACtB,KAAKA,QAAO,SAAS,+BAA+B,CAAC;AAAA,QAC1D;AAAA,MACF,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,4BAA4B;AAAA,UAC1C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,gBAAgB,CAAC,WAAmB,UACxCA,QAAO,IAAI,aAAa;AACtB,cAAM,KAAK,OAAO,IAAI,QAAQ,gBAAgB,WAAW,KAAK,EAAE;AAAA,UAC9DA,QAAO,SAAS,iCAAiC;AAAA,YAC/C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH;AACA,YAAI,CAAC,IAAI;AACP,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS,oCAAoC,SAAS;AAAA,UACxD,CAAC;AAAA,QACH;AAEA,cAAM,KAAK,OAAO,sBAAsB,WAAW,OAAO,IAAI,KAAK,UAAU,EAAE;AAAA,UAC7EA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,WAAW,OAAO,cAAc,mBAAmB,EAAE,CAAC,EAAE;AAAA,UAC5DA,QAAO;AAAA,YACL,CAAC,EAAE,QAAQ,MACT,IAAI,sBAAsB;AAAA,cACxB,OAAO;AAAA,cACP,SAAS,uBAAuB,OAAO;AAAA,YACzC,CAAC;AAAA,UACL;AAAA,UACAA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH;AAEA,cAAM,WAAW,OAAO,IAAI,QAAQ,UAAU,WAAW,KAAK;AAC9D,cAAM,aAAa,SAAS,QAAQ,QAAQ,UAAU,QAAQ;AAE9D,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AACtB,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,KAAK;AAC7D,mBAAO,IAAI,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,aAAa,MAAM,CAAC;AAExE,mBAAO,IAAI,QAAQ;AAAA,cACjB;AAAA,cACA;AAAA,cACA,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBACzB,QAAQ,GAAG,SAAS,IAAI,EAAE,MAAM;AAAA,gBAChC,SAAS,UAAU,CAAC;AAAA,cACtB,EAAE;AAAA,YACJ;AACA,mBAAO,IAAI,KAAK,QAAQ,SAAS;AAAA,cAC/B,IAAI;AAAA,cACJ;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,cACN,KAAK,GAAG,cAAc,WAAW,GAAG,WAAW;AAAA,cAC/C,WAAW;AAAA,cACX,YAAY;AAAA,cACZ,SAAS,GAAG,cAAc;AAAA,cAC1B,OAAO,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBAChC,MAAM,EAAE;AAAA,gBACR,aAAa,EAAE,eAAe,aAAa,EAAE,QAAQ;AAAA,gBACrD,aAAa,EAAE;AAAA,gBACf,cAAc,EAAE;AAAA,cAClB,EAAE;AAAA,YACJ,CAAC;AAAA,UACH,CAAC;AAAA,QACH,EACC;AAAA,UACCA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,yBAAyB,SAAS,MAAM;AAAA,YAC1C;AAAA,UACF,CAAC;AAAA,QACH;AAEF,eAAO,EAAE,WAAW,SAAS,MAAM,OAAO;AAAA,MAC5C,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,eAAe,CAAC,WAAmB,OAAe,UACtDA,QAAO,IAAI,aAAa;AACtB,cAAM,WAAW,OAAO,IAAI,QAAQ,UAAU,WAAW,KAAK;AAC9D,YAAI,CAAC,YAAY,SAAS,OAAO,cAAc,SAAU;AAEzD,cAAM,mBACJ,MAAM,YAAY,SACd,0BAA0B,MAAM,SAAS,aAAa,IACtD;AACN,cAAM,uBACJ,MAAM,gBAAgB,SAClB,0BAA0B,MAAM,aAAa,iBAAiB,IAC9D;AACN,cAAM,gBAAgB,MAAM,SAAS,SAAY,iBAAiB,MAAM,IAAI,IAAI;AAChF,cAAM,iBAAiB;AAAA,UACrB,GAAI,kBAAkB,YAAY,CAAC;AAAA,UACnC,GAAI,sBAAsB,YAAY,CAAC;AAAA,UACvC,GAAI,eAAe,YAAY,CAAC;AAAA,QAClC;AACA,cAAM,cAAc,OAAO;AAAA,UACzB,MAAM;AAAA,UACN;AAAA,QACF;AACA,YAAI,aAAa;AACf,iBAAO,yBAAyB,KAAK;AAAA,YACnC,UAAU;AAAA,YACV,aAAa;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AAEA,cAAM,SAAS,SAAS;AACxB,cAAM,gBAAqC;AAAA,UACzC,GAAG;AAAA,UACH,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,UACnE,GAAI,mBAAmB,EAAE,SAAS,iBAAiB,OAAO,IAAI,CAAC;AAAA,UAC/D,GAAI,gBAAgB,EAAE,MAAM,cAAc,KAAK,IAAI,CAAC;AAAA,UACpD,GAAI,uBAAuB,EAAE,aAAa,qBAAqB,OAAO,IAAI,CAAC;AAAA,QAC7E;AACA,cAAM,aAAa,MAAM,MAAM,KAAK,KAAK,SAAS;AAElD,cAAM,mBAAmB;AAAA,UACvB,GAAI,MAAM,YAAY,SAAY,CAAC,SAAS,IAAI,CAAC;AAAA,UACjD,GAAI,MAAM,gBAAgB,SAAY,CAAC,cAAc,IAAI,CAAC;AAAA,UAC1D,GAAI,MAAM,SAAS,SAAY,CAAC,OAAO,IAAI,CAAC;AAAA,QAC9C;AACA,cAAM,yBAAyB,eAAe,MAAM,yBAAyB;AAC7E,eAAO,IAAI;AAAA,UACTA,QAAO,IAAI,aAAa;AACtB,mBAAO,IAAI,QAAQ,UAAU;AAAA,cAC3B;AAAA,cACA;AAAA,cACA,MAAM;AAAA,cACN,QAAQ;AAAA,YACV,CAAC;AACD,gBAAI,iBAAiB,SAAS,KAAK,eAAe,SAAS,GAAG;AAC5D,qBAAO,IAAI,mBAAmB,iBAAiB;AAAA,gBAC7C,aAAa,QAAQ,KAAK,sBAAsB;AAAA,gBAChD,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa,QAAQ,KAAK,KAAK;AAAA,gBAC/B,cAAc;AAAA,gBACd,UAAU,eAAe,IAAI,CAAC,aAAa;AAAA,kBACzC,SAAS,QAAQ;AAAA,kBACjB,OAAO,QAAQ;AAAA,gBACjB,EAAE;AAAA,cACJ,CAAC;AAAA,YACH;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,YAAY;AACd,gBAAM,WAAW,OAAO,IAAI,mBAAmB,cAAc;AAAA,YAC3D,UAAU;AAAA,YACV,UAAU;AAAA,YACV,aAAa,QAAQ,KAAK,KAAK;AAAA,UACjC,CAAC;AACD,gBAAM,YAAY;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,iBAAO,WACJ,aAAa,iBAAiB,WAAW,YAAY,SAAS,CAAC,EAC/D,KAAKA,QAAO,SAAS,+BAA+B,CAAC;AAAA,QAC1D;AAAA,MACF,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,4BAA4B;AAAA,UAC1C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,YAAY,CAAC,WAAmB,UACpC,IAAI,QAAQ,UAAU,WAAW,KAAK,EAAE;AAAA,QACtCA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB,CAAC,UAAkB,gBACrC,sBAAsB,KAAK,UAAU,WAAW;AAAA,QAClD,kBAAkB,CAAC,UACjBA,QAAO,IAAI,aAAa;AACtB,iBAAO,yBAAyB,KAAK;AAAA,YACnC,UAAU,MAAM;AAAA,YAChB,aAAa,MAAM;AAAA,YACnB,aAAa,MAAM;AAAA,UACrB,CAAC;AACD,gBAAM,UAAU,OAAO,IAAI,mBAAmB,IAAI;AAAA,YAChD,aAAa,MAAM;AAAA,YACnB,UAAU;AAAA,YACV,UAAU,MAAM;AAAA,YAChB,aAAa,MAAM;AAAA,YACnB,SAAS,MAAM;AAAA,YACf,OAAO,MAAM;AAAA,UACf,CAAC;AACD,iBAAO,wBAAwB,OAAO;AAAA,QACxC,CAAC;AAAA,QACH,qBAAqB,CAAC,UAAkB,aAAqB,MAAc,UACzEA,QAAO,IAAI,aAAa;AACtB,iBAAO,yBAAyB,KAAK;AAAA,YACnC;AAAA,YACA;AAAA,YACA,aAAa;AAAA,UACf,CAAC;AACD,iBAAO,IAAI,mBAAmB,OAAO;AAAA,YACnC,aAAa,QAAQ,KAAK,KAAK;AAAA,YAC/B,UAAU;AAAA,YACV;AAAA,YACA,aAAa,QAAQ,KAAK,WAAW;AAAA,YACrC,SAAS;AAAA,UACX,CAAC;AAAA,QACH,CAAC;AAAA,MACL;AAAA,IACF;AAAA,IAEA,YAAY,CAAC,EAAE,KAAK,SAAS,MAAM,OAAO,MACxCA,QAAO,IAAI,aAAa;AACtB,YAAM,UAAU,OAAO,cAAc;AAOrC,YAAM,YAAY,QAAQ;AAC1B,YAAM,QAAQ,OAAO,IAAI,QAAQ,WAAW,QAAQ,IAAI,SAAS,EAAE;AAAA,QACjEA,QAAO,SAAS,2BAA2B;AAAA,UACzC,YAAY,EAAE,iBAAiB,QAAQ,GAAG;AAAA,QAC5C,CAAC;AAAA,MACH;AACA,UAAI,CAAC,OAAO;AACV,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,UAAU,QAAQ;AAAA,UAClB,SAAS,kCAAkC,QAAQ,EAAE;AAAA,QACvD,CAAC;AAAA,MACH;AAEA,YAAM,KAAK,OAAO,IAAI,QAAQ,gBAAgB,MAAM,WAAW,SAAS,EAAE;AAAA,QACxEA,QAAO,SAAS,iCAAiC;AAAA,UAC/C,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,QACxD,CAAC;AAAA,MACH;AACA,UAAI,CAAC,IAAI;AACP,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SAAS,uCAAuC,MAAM,SAAS;AAAA,QACjE,CAAC;AAAA,MACH;AAEA,aAAO,OAAO,cAAc;AAAA,QAC1B,QAAQ,QAAQ;AAAA,QAChB,UAAU,MAAM,QAAQ;AAAA,QACxB;AAAA,QACA,YAAY;AAAA,QACZ,UAAU,MAAM;AAAA,QAChB,aAAa;AAAA,QACb,cAAc,IAAI,OAAO,CAAC,EAAG;AAAA,QAC7B,kBAAkB,MAChB,sBAAsB,MAAM,WAAW,WAAW,IAAI,KAAK,UAAU,EAAE;AAAA,UACrEA,QAAO,UAAU;AAAA,YACf,cAAc,MACZA,QAAO;AAAA,cACL,IAAI,mBAAmB;AAAA,gBACrB,WAAW,GAAG;AAAA,gBACd,SAAS;AAAA,cACX,CAAC;AAAA,YACH;AAAA,YACF,sBAAsB,MACpBA,QAAO;AAAA,cACL,IAAI,mBAAmB;AAAA,gBACrB,WAAW,GAAG;AAAA,gBACd,SAAS;AAAA,cACX,CAAC;AAAA,YACH;AAAA,UACJ,CAAC;AAAA,UACDA,QAAO,QAAQ,CAAC,OAAO,mBAAmB,EAAE,CAAC;AAAA,UAC7CA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB,MAAM;AAAA,cAC9B,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AAAA,QACF,iBAAiB,QAAQ;AAAA,QACzB,mBAAmB,QAAQ;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH,CAAC,EAAE;AAAA,MACDA,QAAO,SAAS,0BAA0B;AAAA,QACxC,YAAY;AAAA,UACV,iBAAiB,QAAQ;AAAA,UACzB,sBAAsB,QAAQ;AAAA,QAChC;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEF,QAAQ,CAAC,EAAE,KAAK,IAAI,MAClBA,QAAO,IAAI,aAAa;AACtB,YAAM,kBAAkB,SAAS,mBAAmB,IAAI;AACxD,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,SAAS,OAAOA,QAAO,IAAI;AAAA,QAC/B,KAAK,MAAM,IAAI,IAAI,OAAO;AAAA,QAC1B,OAAO,CAAC,UAAU;AAAA,MACpB,CAAC,EAAE,KAAKA,QAAO,MAAM;AACrB,UAAIO,QAAO,OAAO,MAAM,EAAG,QAAO;AAElC,YAAM,OAAO,OAAO,MAAM,YAAY;AACtC,YAAM,YAAY,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAE1D,YAAM,YAAY,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,YAAY,OAAO,cAAc,SAAS,EAAE;AAAA,QAChDP,QAAO,IAAI,MAAM,IAAI;AAAA,QACrBA,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC;AAAA,QACxCA,QAAO,SAAS,2BAA2B;AAAA,MAC7C;AAEA,UAAI,WAAW;AACb,eAAO,sBAAsB,KAAK;AAAA,UAChC,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAUA,YAAM,QAAQ,OAAO,sBAAsB,SAAS,EAAE,gBAAgB,CAAC;AACvE,UAAI,MAAM,SAAS,OAAO;AACxB,eAAO,sBAAsB,KAAK;AAAA,UAChC,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAOA,UAAI,gBAAgB,OAAO,OAAO,KAAK,GAAG;AACxC,eAAO,sBAAsB,KAAK;AAAA,UAChC,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT,CAAC,EAAE;AAAA,MACDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,IAAI,CAAC;AAAA,MACvCA,QAAO,SAAS,qBAAqB;AAAA,QACnC,YAAY,EAAE,gBAAgB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOF,oBAAoB,CAAC,EAAE,KAAK,UAAU,SAAS,MAC7CA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;AAC1D,YAAM,UAAU,OAAOA,QAAO;AAAA,QAC5B,CAAC,GAAG,MAAM;AAAA,QACV,CAAC,UACCA,QAAO,IAAI,aAAa;AACtB,gBAAM,OAAO,OAAO,IAAI,QAAQ,qBAAqB,UAAU,KAAK;AACpE,gBAAM,OAAO,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC3D,iBAAO,CAAC,OAAO,IAAI;AAAA,QACrB,CAAC;AAAA,QACH,EAAE,aAAa,YAAY;AAAA,MAC7B;AACA,YAAM,UAAU,IAAI,IAAI,OAAO;AAE/B,YAAM,MAAuC,CAAC;AAC9C,iBAAW,OAAO,UAAU;AAC1B,cAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ,GAAG,IAAI,IAAI,EAAE;AACrD,cAAM,MAAM,SAAS;AACrB,YAAI,KAAK,oBAAoB,MAAM;AACjC,cAAI,IAAI,EAAE,IAAI;AAAA,YACZ,kBAAkB;AAAA,YAClB,qBAAqB,IAAI,SAAS,SAAS,YAAY,IAAI;AAAA,UAC7D;AAAA,QACF,OAAO;AACL,cAAI,IAAI,EAAE,IAAI,EAAE,kBAAkB,MAAM;AAAA,QAC1C;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,cAAc,CAAC,EAAE,KAAK,UAAU,MAAM,MACpCA,QAAO,IAAI,aAAa;AACtB,aAAO,IAAI;AAAA,QACTA,QAAO,IAAI,aAAa;AACtB,iBAAO,IAAI,mBAAmB,gBAAgB;AAAA,YAC5C,UAAU;AAAA,YACV;AAAA,YACA,aAAa,QAAQ,KAAK,KAAK;AAAA,UACjC,CAAC;AACD,iBAAO,IAAI,QAAQ,0BAA0B,UAAU,KAAK;AAC5D,iBAAO,IAAI,QAAQ,aAAa,UAAU,KAAK;AAAA,QACjD,CAAC;AAAA,MACH;AACA,UAAI,SAAS,YAAY;AACvB,eAAO,QAAQ,WAAW,aAAa,QAAQ;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,IAEH,iBAAiB,MAAMA,QAAO,QAAQ,CAAC,CAAC;AAAA,IAExC,qBAAqB,MAAMA,QAAO,QAAQ,CAAC,CAAC;AAAA,IAE5C,eAAe,MAAMA,QAAO;AAAA;AAAA;AAAA;AAAA,IAM5B,OAAO,MACLA,QAAO,IAAI,aAAa;AACtB,YAAM,UAAU,WAAW;AAC3B,UAAI,SAAS;AACX,gBAAQ,kBAAkB,MAAM;AAChC,eAAOG,aAAY,cAAc,QAAQ,eAAe;AACxD,eAAO,MAAM,MAAM,QAAQ,YAAYK,MAAK,IAAI;AAChD,mBAAW,UAAU;AAAA,MACvB;AAAA,IACF,CAAC,EAAE,KAAKR,QAAO,SAAS,kBAAkB,CAAC;AAAA,EAC/C;AAKF,CAAC;","names":["Duration","Effect","Exit","Option","Predicate","ScopedCache","ConfiguredCredentialBinding","Effect","Effect","Effect","Option","Schema","Schema","Option","Option","Effect","Effect","Option","Schema","Schema","Option","Effect","Effect","Option","Schema","Effect","ConfiguredCredentialBinding","Predicate","ScopedCache","Duration","entry","bindingTargetScope","Option","Exit"]}
+{"version":3,"sources":["../src/sdk/binding-store.ts","../src/sdk/plugin.ts","../src/sdk/connection.ts","../src/sdk/discover.ts","../src/sdk/manifest.ts","../src/sdk/invoke.ts","../src/sdk/probe-shape.ts"],"sourcesContent":["// ---------------------------------------------------------------------------\n// MCP plugin storage — four tables:\n//   - mcp_source: per-source structural data (transport, endpoint,\n//     stdio command/args/env, etc.) plus the auth flattened into\n//     columns so source-owned credential slots are queryable. The non-ref\n//     structural data still lives in `config` as JSON because it's\n//     plugin-private and varies by transport (`remote` vs `stdio`\n//     have different shapes).\n//   - mcp_source_header / mcp_source_query_param: child tables for\n//     remote sources' headers and query_params SecretBackedMap entries.\n//   - mcp_binding: per-tool McpToolBinding (toolId/toolName/description/\n//     input+output schemas/annotations). Stays JSON: it carries no\n//     refs, and `inputSchema` / `outputSchema` are arbitrary\n//     user-supplied JSON Schemas — a legitimate JSON case.\n// OAuth session storage lives at the core level in `oauth2_session`\n// and is owned by `ctx.oauth`.\n// ---------------------------------------------------------------------------\n\nimport { Effect, Option, Schema } from \"effect\";\n\nimport {\n  ConfiguredCredentialBinding,\n  defineSchema,\n  type StorageDeps,\n  type StorageFailure,\n} from \"@executor-js/sdk/core\";\n\nimport {\n  McpToolBinding,\n  McpStoredSourceData,\n  type McpConnectionAuth,\n  type ConfiguredMcpCredentialValue,\n} from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Schema\n// ---------------------------------------------------------------------------\n\nexport const mcpSchema = defineSchema({\n  mcp_source: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      name: { type: \"string\", required: true },\n      // Plugin-private structural data minus the ref-bearing fields\n      // (auth, headers, queryParams). For remote sources: transport,\n      // endpoint, remoteTransport. For stdio: transport, command,\n      // args, env, cwd.\n      config: { type: \"json\", required: true },\n      // Flattened McpConnectionAuth. The stored source only names slots;\n      // concrete per-user/per-workspace values live in core credential_binding.\n      auth_kind: {\n        type: [\"none\", \"header\", \"oauth2\"],\n        required: true,\n        defaultValue: \"none\",\n      },\n      // Header-auth fields.\n      auth_header_name: { type: \"string\", required: false },\n      auth_header_slot: { type: \"string\", required: false },\n      auth_header_prefix: { type: \"string\", required: false },\n      // OAuth2 auth fields.\n      auth_connection_slot: { type: \"string\", required: false },\n      auth_client_id_slot: {\n        type: \"string\",\n        required: false,\n      },\n      auth_client_secret_slot: {\n        type: \"string\",\n        required: false,\n      },\n      created_at: { type: \"date\", required: true },\n    },\n  },\n  mcp_source_header: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      source_id: { type: \"string\", required: true, index: true },\n      name: { type: \"string\", required: true },\n      kind: { type: [\"text\", \"binding\"], required: true },\n      text_value: { type: \"string\", required: false },\n      slot_key: { type: \"string\", required: false },\n      prefix: { type: \"string\", required: false },\n    },\n  },\n  mcp_source_query_param: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      source_id: { type: \"string\", required: true, index: true },\n      name: { type: \"string\", required: true },\n      kind: { type: [\"text\", \"binding\"], required: true },\n      text_value: { type: \"string\", required: false },\n      slot_key: { type: \"string\", required: false },\n      prefix: { type: \"string\", required: false },\n    },\n  },\n  mcp_binding: {\n    fields: {\n      id: { type: \"string\", required: true },\n      scope_id: { type: \"string\", required: true, index: true },\n      source_id: { type: \"string\", required: true, index: true },\n      binding: { type: \"json\", required: true },\n      created_at: { type: \"date\", required: true },\n    },\n  },\n});\n\nexport type McpSchema = typeof mcpSchema;\n\n// ---------------------------------------------------------------------------\n// Serialization helpers — JSON columns round-trip through the adapter as\n// either plain objects or serialized strings depending on the backend.\n// ---------------------------------------------------------------------------\n\nconst decodeSourceData = Schema.decodeUnknownSync(McpStoredSourceData);\nconst encodeSourceData = Schema.encodeSync(McpStoredSourceData);\n\nconst decodeBinding = Schema.decodeUnknownSync(McpToolBinding);\nconst encodeBinding = Schema.encodeSync(McpToolBinding);\nconst decodeJson = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown));\n\nconst coerceJson = (value: unknown): unknown => {\n  if (typeof value !== \"string\") return value;\n  return Option.getOrElse(decodeJson(value), () => value);\n};\n\n// --- auth column packing/unpacking ------------------------------------------\n\ninterface AuthColumns {\n  readonly auth_kind: \"none\" | \"header\" | \"oauth2\";\n  readonly auth_header_name?: string;\n  readonly auth_header_slot?: string;\n  readonly auth_header_prefix?: string;\n  readonly auth_connection_slot?: string;\n  readonly auth_client_id_slot?: string;\n  readonly auth_client_secret_slot?: string;\n}\n\nconst authToColumns = (auth: McpConnectionAuth): AuthColumns => {\n  if (auth.kind === \"header\") {\n    return {\n      auth_kind: \"header\",\n      auth_header_name: auth.headerName,\n      auth_header_slot: auth.secretSlot,\n      auth_header_prefix: auth.prefix,\n    };\n  }\n  if (auth.kind === \"oauth2\") {\n    return {\n      auth_kind: \"oauth2\",\n      auth_connection_slot: auth.connectionSlot,\n      auth_client_id_slot: auth.clientIdSlot,\n      auth_client_secret_slot: auth.clientSecretSlot,\n    };\n  }\n  return { auth_kind: \"none\" };\n};\n\nconst columnsToAuth = (row: Record<string, unknown>): McpConnectionAuth => {\n  const kind = row.auth_kind;\n  if (kind === \"header\" && typeof row.auth_header_slot === \"string\") {\n    const prefix = row.auth_header_prefix as string | null | undefined;\n    return {\n      kind: \"header\",\n      headerName: (row.auth_header_name as string | null) ?? \"\",\n      secretSlot: row.auth_header_slot,\n      ...(prefix ? { prefix } : {}),\n    };\n  }\n  if (kind === \"oauth2\" && typeof row.auth_connection_slot === \"string\") {\n    const cid = row.auth_client_id_slot as string | null | undefined;\n    const csec = row.auth_client_secret_slot as string | null | undefined;\n    return {\n      kind: \"oauth2\",\n      connectionSlot: row.auth_connection_slot,\n      ...(cid ? { clientIdSlot: cid } : {}),\n      ...(csec ? { clientSecretSlot: csec } : {}),\n    };\n  }\n  return { kind: \"none\" };\n};\n\n// --- ConfiguredCredentialValue map <-> child rows ---------------------------\n\ninterface ConfiguredCredentialRow {\n  readonly id: string;\n  readonly scope_id: string;\n  readonly source_id: string;\n  readonly name: string;\n  readonly kind: \"text\" | \"binding\";\n  readonly text_value?: string;\n  readonly slot_key?: string;\n  readonly prefix?: string;\n  readonly [k: string]: unknown;\n}\n\nconst valueMapToRows = (\n  sourceId: string,\n  scope: string,\n  values: Record<string, ConfiguredMcpCredentialValue> | undefined,\n): readonly ConfiguredCredentialRow[] => {\n  if (!values) return [];\n  return Object.entries(values).map(([name, value]) => {\n    const id = JSON.stringify([sourceId, name]);\n    if (typeof value === \"string\") {\n      return {\n        id,\n        scope_id: scope,\n        source_id: sourceId,\n        name,\n        kind: \"text\",\n        text_value: value,\n      };\n    }\n    return {\n      id,\n      scope_id: scope,\n      source_id: sourceId,\n      name,\n      kind: \"binding\",\n      slot_key: value.slot,\n      prefix: value.prefix,\n    };\n  });\n};\n\nconst rowsToValueMap = (\n  rows: readonly Record<string, unknown>[],\n): Record<string, ConfiguredMcpCredentialValue> => {\n  const out: Record<string, ConfiguredMcpCredentialValue> = {};\n  for (const row of rows) {\n    if (typeof row.name !== \"string\") continue;\n    const name = row.name;\n    if (row.kind === \"binding\" && typeof row.slot_key === \"string\") {\n      const prefix = row.prefix as string | undefined | null;\n      out[name] = prefix\n        ? ConfiguredCredentialBinding.make({ kind: \"binding\", slot: row.slot_key, prefix })\n        : ConfiguredCredentialBinding.make({ kind: \"binding\", slot: row.slot_key });\n    } else if (row.kind === \"text\" && typeof row.text_value === \"string\") {\n      out[name] = row.text_value;\n    }\n  }\n  return out;\n};\n\n// ---------------------------------------------------------------------------\n// Stored source (decoded) — what callers see\n// ---------------------------------------------------------------------------\n\nexport interface McpStoredSource {\n  readonly namespace: string;\n  /** Executor scope id this source row lives in. Writes stamp this on\n   *  `scope_id`; reads return whichever scope's row the adapter's\n   *  fall-through walk surfaced first. */\n  readonly scope: string;\n  readonly name: string;\n  readonly config: McpStoredSourceData;\n}\n\n// ---------------------------------------------------------------------------\n// Store interface\n// ---------------------------------------------------------------------------\n\n// Every method routes through the typed adapter (`ctx.storage.adapter`)\n// so the typed error channel is `StorageFailure`. Schema-decode failures\n// inside `Effect.gen` land as defects, not typed errors, and are caught\n// by the HTTP edge's observability middleware.\n//\n// Every read/write that targets a single row pins BOTH the natural id\n// (namespace, toolId, sessionId) AND the owning `scope_id`. The store\n// runs behind the scoped adapter (which auto-injects `scope_id IN\n// (stack)`), so a bare `{id}` filter resolves to any matching row in\n// the stack in adapter-iteration order. For shadowed rows (same id at\n// multiple scopes — e.g. an org-level MCP source with a per-user\n// override), that's a scope-isolation bug: updates and deletes can\n// land on the wrong scope's row. Callers thread the resolved scope in\n// (typically `path.scopeId` for HTTP, `toolRow.scope_id` /\n// `input.scope` for invokeTool/lifecycle) so every keyed mutation\n// targets exactly one row.\nexport interface McpBindingStore {\n  readonly listBindingsBySource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<\n    ReadonlyArray<{\n      readonly toolId: string;\n      readonly binding: McpToolBinding;\n    }>,\n    StorageFailure\n  >;\n\n  readonly getBinding: (\n    toolId: string,\n    scope: string,\n  ) => Effect.Effect<\n    { readonly binding: McpToolBinding; readonly namespace: string } | null,\n    StorageFailure\n  >;\n\n  readonly putBindings: (\n    namespace: string,\n    scope: string,\n    entries: ReadonlyArray<{\n      readonly toolId: string;\n      readonly binding: McpToolBinding;\n    }>,\n  ) => Effect.Effect<void, StorageFailure>;\n\n  readonly removeBindingsByNamespace: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<void, StorageFailure>;\n\n  readonly getSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSource | null, StorageFailure>;\n  readonly getSourceConfig: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSourceData | null, StorageFailure>;\n  readonly putSource: (source: McpStoredSource) => Effect.Effect<void, StorageFailure>;\n  readonly removeSource: (namespace: string, scope: string) => Effect.Effect<void, StorageFailure>;\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\nexport const makeMcpStore = ({ adapter: db }: StorageDeps<McpSchema>): McpBindingStore => {\n  return {\n    listBindingsBySource: (namespace, scope) =>\n      Effect.gen(function* () {\n        const rows = yield* db.findMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        return rows.map((row) => ({\n          toolId: row.id,\n          binding: decodeBinding(coerceJson(row.binding)),\n        }));\n      }),\n\n    getBinding: (toolId, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"id\", value: toolId },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        const binding = decodeBinding(coerceJson(row.binding));\n        return { binding, namespace: row.source_id };\n      }),\n\n    putBindings: (namespace, scope, entries) =>\n      Effect.gen(function* () {\n        if (entries.length === 0) return;\n        const now = new Date();\n        yield* db.createMany({\n          model: \"mcp_binding\",\n          data: entries.map((e) => ({\n            id: e.toolId,\n            scope_id: scope,\n            source_id: namespace,\n            binding: encodeBinding(e.binding),\n            created_at: now,\n          })),\n          forceAllowId: true,\n        });\n      }),\n\n    removeBindingsByNamespace: (namespace, scope) =>\n      db\n        .deleteMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        })\n        .pipe(Effect.asVoid),\n\n    getSource: (namespace, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        return {\n          namespace: row.id,\n          scope: row.scope_id,\n          name: row.name,\n          config: yield* hydrateSourceData(row, namespace, scope),\n        };\n      }),\n\n    getSourceConfig: (namespace, scope) =>\n      Effect.gen(function* () {\n        const row = yield* db.findOne({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        if (!row) return null;\n        return yield* hydrateSourceData(row, namespace, scope);\n      }),\n\n    putSource: (source) =>\n      Effect.gen(function* () {\n        const now = new Date();\n        // Drop the source row and its child rows; recreate. Two-step\n        // matches the existing put-overwrites-existing semantic.\n        yield* db.delete({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: source.namespace },\n            { field: \"scope_id\", value: source.scope },\n          ],\n        });\n        yield* deleteSourceChildren(source.namespace, source.scope);\n\n        const auth: McpConnectionAuth =\n          source.config.transport === \"remote\" ? source.config.auth : { kind: \"none\" };\n        const authCols = authToColumns(auth);\n        const headers = source.config.transport === \"remote\" ? source.config.headers : undefined;\n        const queryParams =\n          source.config.transport === \"remote\" ? source.config.queryParams : undefined;\n\n        // The encoded config keeps every plugin-private field but\n        // strips auth/headers/queryParams — those moved to columns/\n        // child tables. We round-trip through encodeSourceData so the\n        // remaining fields stay in the same JSON shape decode expects.\n        const encodedConfig = stripExtractedFields(\n          encodeSourceData(source.config) as Record<string, unknown>,\n        );\n\n        yield* db.create({\n          model: \"mcp_source\",\n          data: {\n            id: source.namespace,\n            scope_id: source.scope,\n            name: source.name,\n            config: encodedConfig,\n            created_at: now,\n            ...authCols,\n          },\n          forceAllowId: true,\n        });\n\n        const headerRows = valueMapToRows(source.namespace, source.scope, headers);\n        if (headerRows.length > 0) {\n          yield* db.createMany({\n            model: \"mcp_source_header\",\n            data: headerRows,\n            forceAllowId: true,\n          });\n        }\n        const paramRows = valueMapToRows(source.namespace, source.scope, queryParams);\n        if (paramRows.length > 0) {\n          yield* db.createMany({\n            model: \"mcp_source_query_param\",\n            data: paramRows,\n            forceAllowId: true,\n          });\n        }\n      }),\n\n    removeSource: (namespace, scope) =>\n      Effect.gen(function* () {\n        yield* db.deleteMany({\n          model: \"mcp_binding\",\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n        yield* deleteSourceChildren(namespace, scope);\n        yield* db.delete({\n          model: \"mcp_source\",\n          where: [\n            { field: \"id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n      }),\n  };\n\n  // ---------------------------------------------------------------------\n  // Private helpers — depend on `db` so they live inside the closure.\n  // ---------------------------------------------------------------------\n\n  function deleteSourceChildren(namespace: string, scope: string) {\n    return Effect.gen(function* () {\n      for (const model of [\"mcp_source_header\", \"mcp_source_query_param\"] as const) {\n        yield* db.deleteMany({\n          model,\n          where: [\n            { field: \"source_id\", value: namespace },\n            { field: \"scope_id\", value: scope },\n          ],\n        });\n      }\n    });\n  }\n\n  function hydrateSourceData(\n    row: Record<string, unknown>,\n    namespace: string,\n    scope: string,\n  ): Effect.Effect<McpStoredSourceData, StorageFailure> {\n    return Effect.gen(function* () {\n      // The stored JSON has auth/headers/queryParams stripped (those\n      // moved to columns / child tables). We must rehydrate the full\n      // shape BEFORE handing it to the schema decoder, because\n      // `McpRemoteSourceData.auth` is required.\n      const partial = coerceJson(row.config) as Record<string, unknown>;\n      if (partial.transport !== \"remote\") {\n        // stdio sources have no extracted fields — decode as-is.\n        return decodeSourceData(partial);\n      }\n      const headerRows = yield* db.findMany({\n        model: \"mcp_source_header\",\n        where: [\n          { field: \"source_id\", value: namespace },\n          { field: \"scope_id\", value: scope },\n        ],\n      });\n      const paramRows = yield* db.findMany({\n        model: \"mcp_source_query_param\",\n        where: [\n          { field: \"source_id\", value: namespace },\n          { field: \"scope_id\", value: scope },\n        ],\n      });\n      const headers = rowsToValueMap(headerRows);\n      const queryParams = rowsToValueMap(paramRows);\n      const reassembled = {\n        ...partial,\n        ...(Object.keys(headers).length > 0 ? { headers } : {}),\n        ...(Object.keys(queryParams).length > 0 ? { queryParams } : {}),\n        auth: columnsToAuth(row),\n      };\n      return decodeSourceData(reassembled);\n    });\n  }\n};\n\n// Strip auth/headers/queryParams from the encoded source-data shape.\n// Keeps the remaining structural fields (transport, endpoint, etc.) in\n// the JSON config column. Per-transport: only the remote variant has\n// these fields, so this is a no-op for stdio.\nconst stripExtractedFields = (encoded: Record<string, unknown>): Record<string, unknown> => {\n  if (encoded.transport !== \"remote\") return encoded;\n  const { auth, headers, queryParams, ...rest } = encoded;\n  void auth;\n  void headers;\n  void queryParams;\n  return rest;\n};\n","import {\n  Duration,\n  Effect,\n  Exit,\n  Layer,\n  Match,\n  Option,\n  Predicate,\n  Result,\n  Scope,\n  ScopedCache,\n} from \"effect\";\nimport type { HttpClient } from \"effect/unstable/http\";\n\nimport type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\n\nimport {\n  ConfiguredCredentialBinding,\n  ConnectionId,\n  type CredentialBindingRef,\n  type CredentialBindingValue,\n  ScopeId,\n  SecretId,\n  SourceDetectionResult,\n  definePlugin,\n  resolveSecretBackedMap as resolveSharedSecretBackedMap,\n  type PluginCtx,\n  type StorageFailure,\n  StorageError,\n  type ToolAnnotations,\n} from \"@executor-js/sdk/core\";\n\nimport {\n  makeMcpStore,\n  mcpSchema,\n  type McpBindingStore,\n  type McpStoredSource,\n} from \"./binding-store\";\nimport { createMcpConnector, type ConnectorInput, type McpConnection } from \"./connection\";\nimport { discoverTools } from \"./discover\";\nimport { McpConnectionError, McpInvocationError, McpToolDiscoveryError } from \"./errors\";\nimport { invokeMcpTool } from \"./invoke\";\nimport { deriveMcpNamespace, type McpToolManifest, type McpToolManifestEntry } from \"./manifest\";\nimport { probeMcpEndpointShape, type McpShapeProbeResult } from \"./probe-shape\";\nimport {\n  MCP_HEADER_AUTH_SLOT,\n  MCP_OAUTH_CLIENT_ID_SLOT,\n  MCP_OAUTH_CLIENT_SECRET_SLOT,\n  MCP_OAUTH_CONNECTION_SLOT,\n  McpToolBinding,\n  McpSourceBindingInput,\n  McpSourceBindingRef,\n  mcpHeaderSlot,\n  mcpQueryParamSlot,\n  type McpConnectionAuth,\n  type McpConnectionAuthInput,\n  type McpCredentialInput,\n  type McpSourceBindingValue,\n  type SecretBackedValue,\n  type McpStoredSourceData,\n  type ConfiguredMcpCredentialValue,\n} from \"./types\";\n\nimport {\n  SECRET_REF_PREFIX,\n  type ConfigFileSink,\n  type McpAuthConfig,\n  type McpRemoteSourceConfig as McpRemoteConfigEntry,\n  type McpStdioSourceConfig as McpStdioConfigEntry,\n  type SourceConfig,\n} from \"@executor-js/config\";\n\n// ---------------------------------------------------------------------------\n// Plugin config — discriminated union on transport\n// ---------------------------------------------------------------------------\n\n/**\n * Executor scope id that owns a newly-added MCP source row. Must be one\n * of the executor's configured scopes. Admins adding a shared server at\n * org scope pin here; per-user stdio sources can pin at the inner\n * scope.\n */\ntype McpSourceScopeField = { readonly scope: string };\n\nexport interface McpRemoteSourceConfig extends McpSourceScopeField {\n  readonly transport: \"remote\";\n  readonly name: string;\n  readonly endpoint: string;\n  readonly remoteTransport?: \"streamable-http\" | \"sse\" | \"auto\";\n  readonly queryParams?: Record<string, McpCredentialInput>;\n  readonly headers?: Record<string, McpCredentialInput>;\n  readonly namespace?: string;\n  readonly auth?: McpConnectionAuthInput;\n  /**\n   * Scope that owns any direct credentials supplied on this call. Required\n   * whenever headers/queryParams/auth carry direct secret or connection ids.\n   */\n  readonly credentialTargetScope?: string;\n}\n\nexport interface McpStdioSourceConfig extends McpSourceScopeField {\n  readonly transport: \"stdio\";\n  readonly name: string;\n  readonly command: string;\n  readonly args?: string[];\n  readonly env?: Record<string, string>;\n  readonly cwd?: string;\n  readonly namespace?: string;\n}\n\nexport type McpSourceConfig = McpRemoteSourceConfig | McpStdioSourceConfig;\n\n// ---------------------------------------------------------------------------\n// Extension types\n// ---------------------------------------------------------------------------\n\n// OAuth start/complete/callback moved to the shared\n// `/scopes/:scopeId/oauth/*` surface in `@executor-js/api` — no\n// plugin-specific types needed here.\n\nexport interface McpProbeResult {\n  readonly connected: boolean;\n  readonly requiresOAuth: boolean;\n  readonly supportsDynamicRegistration: boolean;\n  readonly name: string;\n  readonly namespace: string;\n  readonly toolCount: number | null;\n  readonly serverName: string | null;\n}\n\nexport interface McpUpdateSourceInput {\n  readonly name?: string;\n  readonly endpoint?: string;\n  readonly headers?: Record<string, McpCredentialInput>;\n  readonly queryParams?: Record<string, McpCredentialInput>;\n  readonly credentialTargetScope?: string;\n  readonly auth?: McpConnectionAuthInput;\n}\n\nexport interface McpProbeEndpointInput {\n  readonly endpoint: string;\n  readonly headers?: Record<string, SecretBackedValue>;\n  readonly queryParams?: Record<string, SecretBackedValue>;\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst toStoredSourceData = (\n  config: McpSourceConfig,\n  remoteCredentials?: {\n    readonly headers: Record<string, ConfiguredMcpCredentialValue>;\n    readonly queryParams: Record<string, ConfiguredMcpCredentialValue>;\n    readonly auth: McpConnectionAuth;\n  },\n): McpStoredSourceData => {\n  if (config.transport === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: config.command,\n      args: config.args,\n      env: config.env,\n      cwd: config.cwd,\n    };\n  }\n  return {\n    transport: \"remote\",\n    endpoint: config.endpoint,\n    remoteTransport: config.remoteTransport ?? \"auto\",\n    queryParams: remoteCredentials?.queryParams,\n    headers: remoteCredentials?.headers,\n    auth: remoteCredentials?.auth ?? { kind: \"none\" },\n  };\n};\n\nconst normalizeNamespace = (config: McpSourceConfig): string =>\n  config.namespace ??\n  deriveMcpNamespace({\n    name: config.name,\n    endpoint: config.transport === \"remote\" ? config.endpoint : undefined,\n    command: config.transport === \"stdio\" ? config.command : undefined,\n  });\n\nconst toBinding = (entry: McpToolManifestEntry): McpToolBinding =>\n  McpToolBinding.make({\n    toolId: entry.toolId,\n    toolName: entry.toolName,\n    description: entry.description,\n    inputSchema: entry.inputSchema,\n    outputSchema: entry.outputSchema,\n    annotations: entry.annotations,\n  });\n\nconst MCP_PLUGIN_ID = \"mcp\";\n\n/** Match `token` as a separator-bounded run inside a URL hostname or path,\n *  used as a low-confidence detection hint when wire-shape detection fails.\n *  Boundary chars are everything non-alphanumeric, so `/api/mcp`,\n *  `mcp.example.com`, `mcp-server`, and `mcp_v1` all match while\n *  `mcphost.com` and `/mcpstore` do not. */\nconst urlMatchesToken = (url: URL, token: string): boolean => {\n  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, \"i\");\n  return re.test(url.hostname) || re.test(url.pathname);\n};\n\n/** Translate a non-MCP probe outcome into a message a user can act on.\n *  The technical `reason` (`401 without Bearer WWW-Authenticate — not an\n *  MCP auth challenge`, etc.) stays in telemetry via the probe span; the\n *  user gets a sentence pointing at their next step. Exported for tests. */\nexport const userFacingProbeMessage = (\n  shape: Extract<McpShapeProbeResult, { kind: \"not-mcp\" } | { kind: \"unreachable\" }>,\n): string => {\n  if (shape.kind === \"unreachable\") {\n    return \"Couldn't reach this URL. Check the address, your network, and that the server is running.\";\n  }\n  return Match.value(shape.category).pipe(\n    Match.when(\n      \"auth-required\",\n      () =>\n        \"This server requires authentication. Add credentials (Authorization header, query parameter, or API key) below and retry.\",\n    ),\n    Match.when(\n      \"wrong-shape\",\n      () =>\n        \"This URL doesn't appear to host an MCP server. Double-check the address, including the path.\",\n    ),\n    Match.exhaustive,\n  );\n};\n\nconst scopeRanks = (ctx: PluginCtx<McpBindingStore>): ReadonlyMap<string, number> =>\n  new Map(ctx.scopes.map((scope, index) => [String(scope.id), index]));\n\nconst scopeRank = (ranks: ReadonlyMap<string, number>, scopeId: string): number =>\n  ranks.get(scopeId) ?? Infinity;\n\nconst coreBindingToMcpBinding = (binding: CredentialBindingRef): McpSourceBindingRef =>\n  McpSourceBindingRef.make({\n    sourceId: binding.sourceId,\n    sourceScopeId: binding.sourceScopeId,\n    scopeId: binding.scopeId,\n    slot: binding.slotKey,\n    value: binding.value,\n    createdAt: binding.createdAt,\n    updatedAt: binding.updatedAt,\n  });\n\nconst listMcpSourceBindings = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n): Effect.Effect<readonly McpSourceBindingRef[], StorageFailure> =>\n  Effect.gen(function* () {\n    const ranks = scopeRanks(ctx);\n    const sourceSourceRank = scopeRank(ranks, sourceScope);\n    if (sourceSourceRank === Infinity) return [];\n    const bindings = yield* ctx.credentialBindings.listForSource({\n      pluginId: MCP_PLUGIN_ID,\n      sourceId,\n      sourceScope: ScopeId.make(sourceScope),\n    });\n    return bindings\n      .filter((binding) => scopeRank(ranks, binding.scopeId) <= sourceSourceRank)\n      .map(coreBindingToMcpBinding);\n  });\n\nconst resolveMcpSourceBinding = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n  slot: string,\n): Effect.Effect<McpSourceBindingRef | null, StorageFailure> =>\n  Effect.gen(function* () {\n    const ranks = scopeRanks(ctx);\n    const sourceSourceRank = scopeRank(ranks, sourceScope);\n    if (sourceSourceRank === Infinity) return null;\n    const bindings = yield* ctx.credentialBindings.listForSource({\n      pluginId: MCP_PLUGIN_ID,\n      sourceId,\n      sourceScope: ScopeId.make(sourceScope),\n    });\n    const binding = bindings\n      .filter(\n        (candidate) =>\n          candidate.slotKey === slot && scopeRank(ranks, candidate.scopeId) <= sourceSourceRank,\n      )\n      .sort((a, b) => scopeRank(ranks, a.scopeId) - scopeRank(ranks, b.scopeId))[0];\n    return binding ? coreBindingToMcpBinding(binding) : null;\n  });\n\nconst validateMcpBindingTarget = (\n  ctx: PluginCtx<McpBindingStore>,\n  input: {\n    readonly sourceScope: string;\n    readonly targetScope: string;\n    readonly sourceId: string;\n  },\n): Effect.Effect<void, StorageFailure> =>\n  Effect.gen(function* () {\n    const ranks = scopeRanks(ctx);\n    const sourceSourceRank = scopeRank(ranks, input.sourceScope);\n    const targetRank = scopeRank(ranks, input.targetScope);\n    const scopeList = `[${ctx.scopes.map((s) => s.id).join(\", \")}]`;\n    if (sourceSourceRank === Infinity) {\n      return yield* new StorageError({\n        message:\n          `MCP source binding references source scope \"${input.sourceScope}\" ` +\n          `which is not in the executor's scope stack ${scopeList}.`,\n        cause: undefined,\n      });\n    }\n    if (targetRank === Infinity) {\n      return yield* new StorageError({\n        message:\n          `MCP source binding targets scope \"${input.targetScope}\" which is not ` +\n          `in the executor's scope stack ${scopeList}.`,\n        cause: undefined,\n      });\n    }\n    if (targetRank > sourceSourceRank) {\n      return yield* new StorageError({\n        message:\n          `MCP source bindings for \"${input.sourceId}\" cannot be written at ` +\n          `outer scope \"${input.targetScope}\" because the base source lives at ` +\n          `\"${input.sourceScope}\"`,\n        cause: undefined,\n      });\n    }\n  });\n\nconst bindingTargetScope = (\n  targetScope: string | undefined,\n  bindings: readonly unknown[],\n): Effect.Effect<string | undefined, McpConnectionError> => {\n  if (bindings.length === 0) return Effect.succeed(undefined);\n  if (targetScope) return Effect.succeed(targetScope);\n  return Effect.fail(\n    new McpConnectionError({\n      transport: \"remote\",\n      message: \"credentialTargetScope is required when adding direct MCP credentials\",\n    }),\n  );\n};\n\nconst targetScopeForBinding = (\n  fallbackTargetScope: string | undefined,\n  binding: { readonly targetScope?: string },\n): Effect.Effect<string, McpConnectionError> => {\n  const targetScope = binding.targetScope ?? fallbackTargetScope;\n  if (targetScope) return Effect.succeed(targetScope);\n  return Effect.fail(\n    new McpConnectionError({\n      transport: \"remote\",\n      message: \"credentialTargetScope is required when adding direct MCP credentials\",\n    }),\n  );\n};\n\nconst canonicalizeCredentialMap = (\n  values: Record<string, McpCredentialInput> | undefined,\n  slotForName: (name: string) => string,\n): {\n  readonly values: Record<string, ConfiguredMcpCredentialValue>;\n  readonly bindings: ReadonlyArray<{\n    readonly slot: string;\n    readonly value: McpSourceBindingValue;\n    readonly targetScope?: string;\n  }>;\n} => {\n  const nextValues: Record<string, ConfiguredMcpCredentialValue> = {};\n  const bindings: Array<{ slot: string; value: McpSourceBindingValue; targetScope?: string }> = [];\n  for (const [name, value] of Object.entries(values ?? {})) {\n    if (typeof value === \"string\") {\n      nextValues[name] = value;\n      continue;\n    }\n    if (\"kind\" in value) {\n      nextValues[name] = value;\n      continue;\n    }\n    const slot = slotForName(name);\n    nextValues[name] = ConfiguredCredentialBinding.make({\n      kind: \"binding\",\n      slot,\n      prefix: value.prefix,\n    });\n    bindings.push({\n      slot,\n      targetScope: \"targetScope\" in value ? value.targetScope : undefined,\n      value: {\n        kind: \"secret\",\n        secretId: SecretId.make(value.secretId),\n        ...(\"secretScopeId\" in value && value.secretScopeId\n          ? { secretScopeId: value.secretScopeId }\n          : {}),\n      },\n    });\n  }\n  return { values: nextValues, bindings };\n};\n\nconst canonicalizeAuth = (\n  auth: McpConnectionAuthInput | undefined,\n): {\n  readonly auth: McpConnectionAuth;\n  readonly bindings: ReadonlyArray<{\n    readonly slot: string;\n    readonly value: McpSourceBindingValue;\n    readonly targetScope?: string;\n  }>;\n} => {\n  if (!auth || auth.kind === \"none\") return { auth: { kind: \"none\" }, bindings: [] };\n  if (auth.kind === \"header\") {\n    if (\"secretSlot\" in auth) return { auth, bindings: [] };\n    return {\n      auth: {\n        kind: \"header\",\n        headerName: auth.headerName,\n        secretSlot: MCP_HEADER_AUTH_SLOT,\n        prefix: auth.prefix,\n      },\n      bindings: [\n        {\n          slot: MCP_HEADER_AUTH_SLOT,\n          targetScope: auth.targetScope,\n          value: {\n            kind: \"secret\",\n            secretId: SecretId.make(auth.secretId),\n            ...(auth.secretScopeId ? { secretScopeId: auth.secretScopeId } : {}),\n          },\n        },\n      ],\n    };\n  }\n  if (\"connectionSlot\" in auth) return { auth, bindings: [] };\n  const bindings: Array<{ slot: string; value: McpSourceBindingValue; targetScope?: string }> = [\n    {\n      slot: MCP_OAUTH_CONNECTION_SLOT,\n      value: {\n        kind: \"connection\",\n        connectionId: ConnectionId.make(auth.connectionId),\n      },\n    },\n  ];\n  if (auth.clientIdSecretId) {\n    bindings.push({\n      slot: MCP_OAUTH_CLIENT_ID_SLOT,\n      value: { kind: \"secret\", secretId: SecretId.make(auth.clientIdSecretId) },\n    });\n  }\n  if (auth.clientSecretSecretId) {\n    bindings.push({\n      slot: MCP_OAUTH_CLIENT_SECRET_SLOT,\n      value: { kind: \"secret\", secretId: SecretId.make(auth.clientSecretSecretId) },\n    });\n  }\n  return {\n    auth: {\n      kind: \"oauth2\",\n      connectionSlot: MCP_OAUTH_CONNECTION_SLOT,\n      ...(auth.clientIdSecretId ? { clientIdSlot: MCP_OAUTH_CLIENT_ID_SLOT } : {}),\n      ...(auth.clientSecretSecretId ? { clientSecretSlot: MCP_OAUTH_CLIENT_SECRET_SLOT } : {}),\n    },\n    bindings,\n  };\n};\n\n// ---------------------------------------------------------------------------\n// MCP-SDK OAuth provider adapter — builds the `OAuthClientProvider` the\n// MCP SDK's StreamableHTTP/SSE transports want, wrapping a pre-resolved\n// access token.\n//\n// Refresh is NOT driven through this provider — `ctx.connections.access\n// Token` owns that lifecycle at the core level via the canonical\n// \"oauth2\" ConnectionProvider. This adapter only injects the current\n// token into the transport's Authorization header and fails loudly if\n// the SDK ever tries to initiate a new OAuth flow (which would bypass\n// our refresh machinery).\n// ---------------------------------------------------------------------------\nconst makeOAuthProvider = (accessToken: string): OAuthClientProvider => ({\n  get redirectUrl() {\n    return \"http://localhost/oauth/callback\";\n  },\n  get clientMetadata() {\n    return {\n      redirect_uris: [\"http://localhost/oauth/callback\"],\n      grant_types: [\"authorization_code\", \"refresh_token\"] as string[],\n      response_types: [\"code\"] as string[],\n      token_endpoint_auth_method: \"none\" as const,\n      client_name: \"Executor\",\n    };\n  },\n  clientInformation: () => undefined,\n  saveClientInformation: () => undefined,\n  tokens: () => ({ access_token: accessToken, token_type: \"Bearer\" }),\n  saveTokens: () => undefined,\n  redirectToAuthorization: async () => {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: MCP SDK OAuthClientProvider callback can only signal reauthorization by throwing\n    throw new Error(\"MCP OAuth re-authorization required\");\n  },\n  saveCodeVerifier: () => undefined,\n  codeVerifier: () => {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: MCP SDK OAuthClientProvider callback requires a thrown verifier failure\n    throw new Error(\"No active PKCE verifier\");\n  },\n  saveDiscoveryState: () => undefined,\n  discoveryState: () => undefined,\n});\n\nconst resolveSecretBackedMap = (\n  values: Record<string, SecretBackedValue> | undefined,\n  ctx: PluginCtx<McpBindingStore>,\n): Effect.Effect<Record<string, string> | undefined, McpConnectionError | StorageFailure> =>\n  resolveSharedSecretBackedMap({\n    values,\n    getSecret: ctx.secrets.get,\n    onMissing: (_name, value) =>\n      new McpConnectionError({\n        transport: \"remote\",\n        message: `Failed to resolve secret \"${value.secretId}\"`,\n      }),\n    onError: (err, _name, value) =>\n      Predicate.isTagged(\"SecretOwnedByConnectionError\")(err)\n        ? new McpConnectionError({\n            transport: \"remote\",\n            message: `Failed to resolve secret \"${value.secretId}\"`,\n          })\n        : err,\n  }).pipe(\n    Effect.mapError((err) =>\n      Predicate.isTagged(\"SecretOwnedByConnectionError\")(err)\n        ? new McpConnectionError({ transport: \"remote\", message: \"Failed to resolve secret\" })\n        : err,\n    ),\n  );\n\nconst plainStringMap = (\n  values: Record<string, McpCredentialInput> | undefined,\n): Record<string, string> | undefined => {\n  if (!values) return undefined;\n  const entries = Object.entries(values).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst resolveMcpBindingValueMap = (\n  ctx: PluginCtx<McpBindingStore>,\n  values: Record<string, ConfiguredMcpCredentialValue> | undefined,\n  params: {\n    readonly sourceId: string;\n    readonly sourceScope: string;\n    readonly targetScope?: string;\n    readonly missingLabel: string;\n  },\n): Effect.Effect<Record<string, string> | undefined, McpConnectionError | StorageFailure> =>\n  Effect.gen(function* () {\n    if (!values) return undefined;\n    const resolved: Record<string, string> = {};\n    for (const [name, value] of Object.entries(values)) {\n      if (typeof value === \"string\") {\n        resolved[name] = value;\n        continue;\n      }\n      const binding = yield* resolveMcpSourceBinding(\n        ctx,\n        params.sourceId,\n        params.sourceScope,\n        value.slot,\n      );\n      if (binding?.value.kind === \"secret\") {\n        const secret = yield* ctx.secrets.getAtScope(binding.value.secretId, binding.scopeId).pipe(\n          Effect.catchTag(\"SecretOwnedByConnectionError\", () =>\n            Effect.fail(\n              new McpConnectionError({\n                transport: \"remote\",\n                message: `Failed to resolve secret for ${params.missingLabel} \"${name}\"`,\n              }),\n            ),\n          ),\n        );\n        if (secret === null) {\n          return yield* new McpConnectionError({\n            transport: \"remote\",\n            message: `Missing secret \"${binding.value.secretId}\" for ${params.missingLabel} \"${name}\"`,\n          });\n        }\n        resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;\n        continue;\n      }\n      if (binding?.value.kind === \"text\") {\n        resolved[name] = value.prefix ? `${value.prefix}${binding.value.text}` : binding.value.text;\n        continue;\n      }\n      return yield* new McpConnectionError({\n        transport: \"remote\",\n        message: `Missing binding for ${params.missingLabel} \"${name}\"`,\n      });\n    }\n    return Object.keys(resolved).length > 0 ? resolved : undefined;\n  });\n\nconst resolveMcpCredentialInputMap = (\n  ctx: PluginCtx<McpBindingStore>,\n  values: Record<string, McpCredentialInput> | undefined,\n  params: {\n    readonly sourceId: string;\n    readonly sourceScope: string;\n    readonly targetScope?: string;\n    readonly missingLabel: string;\n  },\n): Effect.Effect<Record<string, string> | undefined, McpConnectionError | StorageFailure> =>\n  Effect.gen(function* () {\n    if (!values) return undefined;\n    const resolved: Record<string, string> = {};\n    for (const [name, value] of Object.entries(values)) {\n      if (typeof value === \"string\") {\n        resolved[name] = value;\n        continue;\n      }\n      if (\"kind\" in value) {\n        const slotResolved = yield* resolveMcpBindingValueMap(\n          ctx,\n          { [name]: value },\n          {\n            sourceId: params.sourceId,\n            sourceScope: params.sourceScope,\n            missingLabel: params.missingLabel,\n          },\n        );\n        if (slotResolved?.[name] !== undefined) resolved[name] = slotResolved[name];\n        continue;\n      }\n      const secretScope =\n        \"secretScopeId\" in value\n          ? (value.secretScopeId ?? value.targetScope)\n          : (params.targetScope ?? params.sourceScope);\n      const secret = yield* ctx.secrets.getAtScope(SecretId.make(value.secretId), secretScope).pipe(\n        Effect.catchTag(\"SecretOwnedByConnectionError\", () =>\n          Effect.fail(\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve secret for ${params.missingLabel} \"${name}\"`,\n            }),\n          ),\n        ),\n      );\n      if (secret === null) {\n        return yield* new McpConnectionError({\n          transport: \"remote\",\n          message: `Missing secret \"${value.secretId}\" for ${params.missingLabel} \"${name}\"`,\n        });\n      }\n      resolved[name] = value.prefix ? `${value.prefix}${secret}` : secret;\n    }\n    return Object.keys(resolved).length > 0 ? resolved : undefined;\n  });\n\nconst resolveMcpHeaderAuth = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n  auth: McpConnectionAuth,\n): Effect.Effect<Record<string, string>, McpConnectionError | StorageFailure> =>\n  Effect.gen(function* () {\n    if (auth.kind !== \"header\") return {};\n    const binding = yield* resolveMcpSourceBinding(ctx, sourceId, sourceScope, auth.secretSlot);\n    if (binding?.value.kind === \"secret\") {\n      const secret = yield* ctx.secrets.getAtScope(binding.value.secretId, binding.scopeId).pipe(\n        Effect.catchTag(\"SecretOwnedByConnectionError\", () =>\n          Effect.fail(\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve header auth binding \"${auth.secretSlot}\"`,\n            }),\n          ),\n        ),\n      );\n      if (secret === null) {\n        return yield* new McpConnectionError({\n          transport: \"remote\",\n          message: `Missing secret for header auth binding \"${auth.secretSlot}\"`,\n        });\n      }\n      return { [auth.headerName]: auth.prefix ? `${auth.prefix}${secret}` : secret };\n    }\n    if (binding?.value.kind === \"text\") {\n      return {\n        [auth.headerName]: auth.prefix ? `${auth.prefix}${binding.value.text}` : binding.value.text,\n      };\n    }\n    return yield* new McpConnectionError({\n      transport: \"remote\",\n      message: `Missing header auth binding \"${auth.secretSlot}\"`,\n    });\n  });\n\nconst resolveMcpStoredOauthProvider = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n  auth: McpConnectionAuth,\n): Effect.Effect<OAuthClientProvider | undefined, McpConnectionError | StorageFailure> =>\n  Effect.gen(function* () {\n    if (auth.kind !== \"oauth2\") return undefined;\n    const binding = yield* resolveMcpSourceBinding(ctx, sourceId, sourceScope, auth.connectionSlot);\n    if (binding?.value.kind !== \"connection\") {\n      return yield* new McpConnectionError({\n        transport: \"remote\",\n        message: `Missing OAuth connection binding for MCP source \"${sourceId}\"`,\n      });\n    }\n    const connectionId = binding.value.connectionId;\n    const accessToken = yield* ctx.connections\n      .accessTokenAtScope(connectionId, binding.scopeId)\n      .pipe(\n        Effect.mapError(\n          ({ message }) =>\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve OAuth connection \"${connectionId}\": ${message}`,\n            }),\n        ),\n      );\n    return makeOAuthProvider(accessToken);\n  });\n\nconst resolveMcpInputAuth = (\n  ctx: PluginCtx<McpBindingStore>,\n  sourceId: string,\n  sourceScope: string,\n  targetScope: string | undefined,\n  auth: McpConnectionAuthInput | undefined,\n): Effect.Effect<\n  { readonly headers: Record<string, string>; readonly authProvider?: OAuthClientProvider },\n  McpConnectionError | StorageFailure\n> =>\n  Effect.gen(function* () {\n    if (!auth || auth.kind === \"none\") return { headers: {} };\n    if (auth.kind === \"header\") {\n      if (\"secretSlot\" in auth) {\n        const headers = yield* resolveMcpHeaderAuth(ctx, sourceId, sourceScope, auth);\n        return { headers };\n      }\n      const secretScope = auth.secretScopeId ?? auth.targetScope ?? targetScope ?? sourceScope;\n      const secret = yield* ctx.secrets.getAtScope(SecretId.make(auth.secretId), secretScope).pipe(\n        Effect.catchTag(\"SecretOwnedByConnectionError\", () =>\n          Effect.fail(\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve secret \"${auth.secretId}\"`,\n            }),\n          ),\n        ),\n      );\n      if (secret === null) {\n        return yield* new McpConnectionError({\n          transport: \"remote\",\n          message: `Failed to resolve secret \"${auth.secretId}\"`,\n        });\n      }\n      return {\n        headers: { [auth.headerName]: auth.prefix ? `${auth.prefix}${secret}` : secret },\n      };\n    }\n    const connection =\n      \"connectionId\" in auth\n        ? { id: ConnectionId.make(auth.connectionId), scope: targetScope ?? sourceScope }\n        : yield* Effect.gen(function* () {\n            const binding = yield* resolveMcpSourceBinding(\n              ctx,\n              sourceId,\n              sourceScope,\n              auth.connectionSlot,\n            );\n            return binding?.value.kind === \"connection\"\n              ? { id: binding.value.connectionId, scope: binding.scopeId }\n              : null;\n          });\n    if (connection === null) {\n      return yield* new McpConnectionError({\n        transport: \"remote\",\n        message: `Missing OAuth connection binding for MCP source \"${sourceId}\"`,\n      });\n    }\n    const accessToken = yield* ctx.connections\n      .accessTokenAtScope(connection.id, connection.scope)\n      .pipe(\n        Effect.mapError(\n          ({ message }) =>\n            new McpConnectionError({\n              transport: \"remote\",\n              message: `Failed to resolve OAuth connection \"${connection.id}\": ${message}`,\n            }),\n        ),\n      );\n    return { headers: {}, authProvider: makeOAuthProvider(accessToken) };\n  });\n\n// ---------------------------------------------------------------------------\n// Shared connector resolution — reads secrets, builds stdio/remote input\n// ---------------------------------------------------------------------------\n\nconst resolveConnectorInput = (\n  sourceId: string,\n  sourceScope: string,\n  sd: McpStoredSourceData,\n  ctx: PluginCtx<McpBindingStore>,\n  allowStdio: boolean,\n): Effect.Effect<ConnectorInput, McpConnectionError | StorageFailure> => {\n  if (sd.transport === \"stdio\") {\n    if (!allowStdio) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message:\n            \"MCP stdio transport is disabled. Enable it by passing `dangerouslyAllowStdioMCP: true` to mcpPlugin() — only safe for trusted local contexts.\",\n        }),\n      );\n    }\n    return Effect.succeed({\n      transport: \"stdio\" as const,\n      command: sd.command,\n      args: sd.args,\n      env: sd.env,\n      cwd: sd.cwd,\n    });\n  }\n\n  return Effect.gen(function* () {\n    const resolvedHeaders = yield* resolveMcpBindingValueMap(ctx, sd.headers, {\n      sourceId,\n      sourceScope,\n      missingLabel: \"header\",\n    });\n    const resolvedQueryParams = yield* resolveMcpBindingValueMap(ctx, sd.queryParams, {\n      sourceId,\n      sourceScope,\n      missingLabel: \"query parameter\",\n    });\n    const headers: Record<string, string> = { ...(resolvedHeaders ?? {}) };\n\n    const auth = sd.auth;\n    if (auth.kind === \"header\") {\n      Object.assign(headers, yield* resolveMcpHeaderAuth(ctx, sourceId, sourceScope, auth));\n    }\n    const authProvider = yield* resolveMcpStoredOauthProvider(ctx, sourceId, sourceScope, auth);\n\n    return {\n      transport: \"remote\" as const,\n      endpoint: sd.endpoint,\n      remoteTransport: sd.remoteTransport,\n      queryParams: resolvedQueryParams,\n      headers: Object.keys(headers).length > 0 ? headers : undefined,\n      authProvider,\n    };\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Connection cache — kept as plugin-module state so both invokeTool and\n// the close hook see the same ScopedCache instance. The ScopedCache's\n// lookup key is the stringified stored source data identity.\n// ---------------------------------------------------------------------------\n\ninterface McpRuntime {\n  readonly connectionCache: ScopedCache.ScopedCache<string, McpConnection, McpConnectionError>;\n  readonly pendingConnectors: Map<string, Effect.Effect<McpConnection, McpConnectionError>>;\n  readonly cacheScope: Scope.Closeable;\n}\n\nconst makeRuntime = (): Effect.Effect<McpRuntime, never> =>\n  Effect.gen(function* () {\n    const cacheScope = yield* Scope.make();\n    const pendingConnectors = new Map<string, Effect.Effect<McpConnection, McpConnectionError>>();\n    const connectionCache = yield* ScopedCache.make({\n      lookup: (key: string) =>\n        Effect.acquireRelease(\n          Effect.suspend(() => {\n            const connector = pendingConnectors.get(key);\n            if (!connector) {\n              return Effect.fail(\n                new McpConnectionError({\n                  transport: \"auto\",\n                  message: `No pending connector for key: ${key}`,\n                }),\n              );\n            }\n            return connector;\n          }),\n          (connection) =>\n            Effect.ignore(\n              Effect.tryPromise({\n                try: () => connection.close(),\n                catch: () =>\n                  new McpConnectionError({\n                    transport: \"auto\",\n                    message: \"Failed to close MCP connection\",\n                  }),\n              }),\n            ),\n        ),\n      capacity: 64,\n      timeToLive: Duration.minutes(5),\n    }).pipe(Scope.provide(cacheScope));\n\n    return { connectionCache, pendingConnectors, cacheScope };\n  });\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\nexport interface McpPluginOptions {\n  /**\n   * Allow configuring stdio-transport MCP sources. Off by default.\n   *\n   * Stdio sources spawn a local subprocess that inherits the parent\n   * `process.env`. Only enable for trusted single-user contexts.\n   */\n  readonly dangerouslyAllowStdioMCP?: boolean;\n  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;\n  /** If provided, source add/remove is mirrored to executor.jsonc\n   *  (best-effort — file errors are logged, not raised). */\n  readonly configFile?: ConfigFileSink;\n}\n\nconst secretRef = (id: string): string => `${SECRET_REF_PREFIX}${id}`;\n\nconst authToConfig = (auth: McpConnectionAuthInput | undefined): McpAuthConfig | undefined => {\n  if (!auth) return undefined;\n  if (auth.kind === \"none\") return { kind: \"none\" };\n  if (auth.kind === \"header\") {\n    if (!(\"secretId\" in auth)) return undefined;\n    return {\n      kind: \"header\",\n      headerName: auth.headerName,\n      secret: secretRef(auth.secretId),\n      prefix: auth.prefix,\n    };\n  }\n  if (!(\"connectionId\" in auth)) return undefined;\n  return {\n    kind: \"oauth2\",\n    connectionId: auth.connectionId,\n  };\n};\n\n// ---------------------------------------------------------------------------\n// Storage-form → input-form reconstruction\n//\n// `toMcpConfigEntry` consumes the `McpSourceConfig` *input* shape — the\n// legacy form with `secretId` / `connectionId`, which `authToConfig` and\n// `plainStringMap` know how to render into the file. Stored remote data\n// is in slot form (`secretSlot`, `{kind: \"binding\", slot}`), so writing\n// the file from a stored row needs the slot → secret/connection lookups\n// realized first. Walk the source's `credential_binding` rows and rebuild\n// the input shape; any slot whose binding is missing is dropped.\n// ---------------------------------------------------------------------------\n\nconst toCredentialInput = (\n  bySlot: Map<string, CredentialBindingValue>,\n  configured: ConfiguredMcpCredentialValue,\n): McpCredentialInput | undefined => {\n  if (typeof configured === \"string\") return configured;\n  const value = bySlot.get(configured.slot);\n  if (!value) return undefined;\n  if (value.kind === \"secret\") {\n    return {\n      secretId: value.secretId,\n      ...(configured.prefix ? { prefix: configured.prefix } : {}),\n    };\n  }\n  if (value.kind === \"text\") return value.text;\n  // headers / queryParams cannot reference connections — only auth can.\n  return undefined;\n};\n\nconst toCredentialInputMap = (\n  bySlot: Map<string, CredentialBindingValue>,\n  values: Record<string, ConfiguredMcpCredentialValue> | undefined,\n): Record<string, McpCredentialInput> | undefined => {\n  if (!values) return undefined;\n  const out: Record<string, McpCredentialInput> = {};\n  for (const [name, configured] of Object.entries(values)) {\n    const input = toCredentialInput(bySlot, configured);\n    if (input !== undefined) out[name] = input;\n  }\n  return Object.keys(out).length > 0 ? out : undefined;\n};\n\nconst toAuthInput = (\n  bySlot: Map<string, CredentialBindingValue>,\n  auth: McpConnectionAuth,\n): McpConnectionAuthInput | undefined => {\n  if (auth.kind === \"none\") return { kind: \"none\" };\n  if (auth.kind === \"header\") {\n    const value = bySlot.get(auth.secretSlot);\n    if (value?.kind !== \"secret\") return undefined;\n    return {\n      kind: \"header\",\n      headerName: auth.headerName,\n      secretId: value.secretId,\n      prefix: auth.prefix,\n    };\n  }\n  const connection = bySlot.get(auth.connectionSlot);\n  if (connection?.kind !== \"connection\") return undefined;\n  return { kind: \"oauth2\", connectionId: connection.connectionId };\n};\n\nconst inputFormFromStored = (\n  bindings: ReadonlyArray<CredentialBindingRef>,\n  stored: McpStoredSourceData,\n  scope: string,\n  sourceName: string,\n  namespace: string,\n): McpSourceConfig => {\n  if (stored.transport === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      scope,\n      name: sourceName,\n      namespace,\n      command: stored.command,\n      args: stored.args ? [...stored.args] : undefined,\n      env: stored.env,\n      cwd: stored.cwd,\n    };\n  }\n  const bySlot = new Map(bindings.map((b) => [b.slotKey, b.value] as const));\n  return {\n    transport: \"remote\",\n    scope,\n    name: sourceName,\n    namespace,\n    endpoint: stored.endpoint,\n    remoteTransport: stored.remoteTransport,\n    headers: toCredentialInputMap(bySlot, stored.headers),\n    queryParams: toCredentialInputMap(bySlot, stored.queryParams),\n    auth: toAuthInput(bySlot, stored.auth),\n  };\n};\n\nconst toMcpConfigEntry = (\n  namespace: string,\n  sourceName: string,\n  config: McpSourceConfig,\n): SourceConfig => {\n  if (config.transport === \"stdio\") {\n    const entry: McpStdioConfigEntry = {\n      kind: \"mcp\",\n      transport: \"stdio\",\n      name: sourceName,\n      command: config.command,\n      args: config.args,\n      env: config.env,\n      cwd: config.cwd,\n      namespace,\n    };\n    return entry;\n  }\n  const entry: McpRemoteConfigEntry = {\n    kind: \"mcp\",\n    transport: \"remote\",\n    name: sourceName,\n    endpoint: config.endpoint,\n    remoteTransport: config.remoteTransport,\n    queryParams: plainStringMap(config.queryParams),\n    headers: plainStringMap(config.headers),\n    namespace,\n    auth: authToConfig(config.auth),\n  };\n  return entry;\n};\n\nexport const mcpPlugin = definePlugin((options?: McpPluginOptions) => {\n  const allowStdio = options?.dangerouslyAllowStdioMCP ?? false;\n  // Per-plugin-instance runtime holder. Captured by closures in\n  // `extension`, `invokeTool`, and `close`, so all three see the same\n  // connection cache across a single createExecutor lifecycle.\n  const runtimeRef: { current: McpRuntime | null } = { current: null };\n\n  const ensureRuntime = (): Effect.Effect<McpRuntime, never> =>\n    runtimeRef.current\n      ? Effect.succeed(runtimeRef.current)\n      : makeRuntime().pipe(\n          Effect.tap((rt) =>\n            Effect.sync(() => {\n              runtimeRef.current = rt;\n            }),\n          ),\n        );\n\n  return {\n    id: \"mcp\" as const,\n    packageName: \"@executor-js/plugin-mcp\",\n    // Surfaced to the client bundle via the Vite plugin (see\n    // `@executor-js/vite-plugin`). The MCP `./client` factory reads\n    // `allowStdio` and gates the stdio tab + presets in AddMcpSource —\n    // so the server's `dangerouslyAllowStdioMCP` flag is the single\n    // source of truth for both runtime and UI.\n    clientConfig: { allowStdio },\n    schema: mcpSchema,\n    storage: (deps): McpBindingStore => makeMcpStore(deps),\n\n    extension: (ctx) => {\n      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;\n      const probeEndpoint = (input: string | McpProbeEndpointInput) =>\n        Effect.gen(function* () {\n          const endpoint = typeof input === \"string\" ? input : input.endpoint;\n          const trimmed = endpoint.trim();\n          if (!trimmed) {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: \"Endpoint URL is required\",\n            });\n          }\n\n          const name = yield* Effect.try({\n            try: () => new URL(trimmed).hostname,\n            catch: () => \"mcp\",\n          }).pipe(Effect.orElseSucceed(() => \"mcp\"));\n          const namespace = deriveMcpNamespace({ endpoint: trimmed });\n\n          const probeHeaders =\n            typeof input === \"string\"\n              ? undefined\n              : yield* resolveSecretBackedMap(input.headers, ctx);\n          const probeQueryParams =\n            typeof input === \"string\"\n              ? undefined\n              : yield* resolveSecretBackedMap(input.queryParams, ctx);\n\n          const connector = createMcpConnector({\n            transport: \"remote\",\n            endpoint: trimmed,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n\n          const result = yield* discoverTools(connector).pipe(\n            Effect.map((m) => ({ ok: true as const, manifest: m })),\n            Effect.catch(() => Effect.succeed({ ok: false as const, manifest: null })),\n            Effect.withSpan(\"mcp.plugin.discover_tools\"),\n          );\n\n          if (result.ok && result.manifest) {\n            return {\n              connected: true,\n              requiresOAuth: false,\n              supportsDynamicRegistration: false,\n              name: result.manifest.server?.name ?? name,\n              namespace,\n              toolCount: result.manifest.tools.length,\n              serverName: result.manifest.server?.name ?? null,\n            } satisfies McpProbeResult;\n          }\n\n          // Before asking the core OAuth service to look for metadata,\n          // confirm the endpoint actually speaks MCP. An OAuth-protected\n          // non-MCP service (e.g. a GraphQL API whose host publishes\n          // RFC 9728 + 8414 metadata) would otherwise pass the OAuth\n          // probe and be misclassified as MCP. The shape probe rejects\n          // anything whose initialize response isn't 2xx or 401+Bearer.\n          const shape = yield* probeMcpEndpointShape(trimmed, {\n            httpClientLayer,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n          if (shape.kind !== \"mcp\") {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: userFacingProbeMessage(shape),\n            });\n          }\n\n          const probeResult = yield* ctx.oauth\n            .probe({\n              endpoint: trimmed,\n              headers: probeHeaders,\n              queryParams: probeQueryParams,\n            })\n            .pipe(\n              Effect.map((oauth) => ({ ok: true as const, oauth })),\n              Effect.catch(() => Effect.succeed({ ok: false as const, oauth: null })),\n              Effect.withSpan(\"mcp.plugin.probe_oauth\"),\n            );\n\n          if (probeResult.ok) {\n            return {\n              connected: false,\n              requiresOAuth: true,\n              supportsDynamicRegistration: probeResult.oauth.supportsDynamicRegistration,\n              name,\n              namespace,\n              toolCount: null,\n              serverName: null,\n            } satisfies McpProbeResult;\n          }\n\n          return yield* new McpConnectionError({\n            transport: \"remote\",\n            message:\n              \"This server requires authentication, but OAuth metadata wasn't found. Add credentials (Authorization header, query parameter, or API key) below and retry.\",\n          });\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.probe_endpoint\", {\n            attributes: { \"mcp.endpoint\": typeof input === \"string\" ? input : input.endpoint },\n          }),\n        );\n\n      const configFile = options?.configFile;\n\n      const addSource = (config: McpSourceConfig) =>\n        Effect.gen(function* () {\n          const namespace = normalizeNamespace(config);\n          const canonicalRemote =\n            config.transport === \"remote\"\n              ? {\n                  headers: canonicalizeCredentialMap(config.headers, mcpHeaderSlot),\n                  queryParams: canonicalizeCredentialMap(config.queryParams, mcpQueryParamSlot),\n                  auth: canonicalizeAuth(config.auth),\n                }\n              : null;\n          const directBindings = canonicalRemote\n            ? [\n                ...canonicalRemote.headers.bindings,\n                ...canonicalRemote.queryParams.bindings,\n                ...canonicalRemote.auth.bindings,\n              ]\n            : [];\n          for (const binding of directBindings) {\n            const bindingTargetScope = yield* targetScopeForBinding(\n              config.transport === \"remote\" ? config.credentialTargetScope : undefined,\n              binding,\n            );\n            yield* validateMcpBindingTarget(ctx, {\n              sourceId: namespace,\n              sourceScope: config.scope,\n              targetScope: bindingTargetScope,\n            });\n          }\n          const targetScope =\n            config.transport === \"remote\" && directBindings[0]\n              ? yield* targetScopeForBinding(config.credentialTargetScope, directBindings[0])\n              : undefined;\n          const sd = toStoredSourceData(\n            config,\n            canonicalRemote\n              ? {\n                  headers: canonicalRemote.headers.values,\n                  queryParams: canonicalRemote.queryParams.values,\n                  auth: canonicalRemote.auth.auth,\n                }\n              : undefined,\n          );\n\n          // Stdio sources are gated — a resolver failure there is a\n          // config error the admin must fix before the source makes\n          // sense to persist at all. For remote sources we defer the\n          // resolver failure: auth might not be ready yet (oauth2\n          // connection awaiting per-user sign-in, header secret\n          // awaiting upload) but the source row should still land so\n          // it shows up in the list and exposes a Sign-in affordance.\n          const resolved = yield* (\n            config.transport === \"remote\"\n              ? Effect.gen(function* () {\n                  const resolvedHeaders = yield* resolveMcpCredentialInputMap(ctx, config.headers, {\n                    sourceId: namespace,\n                    sourceScope: config.scope,\n                    targetScope,\n                    missingLabel: \"header\",\n                  });\n                  const resolvedQueryParams = yield* resolveMcpCredentialInputMap(\n                    ctx,\n                    config.queryParams,\n                    {\n                      sourceId: namespace,\n                      sourceScope: config.scope,\n                      targetScope,\n                      missingLabel: \"query parameter\",\n                    },\n                  );\n                  const resolvedAuth = yield* resolveMcpInputAuth(\n                    ctx,\n                    namespace,\n                    config.scope,\n                    targetScope,\n                    config.auth,\n                  );\n                  const headers = {\n                    ...(resolvedHeaders ?? {}),\n                    ...resolvedAuth.headers,\n                  };\n                  return {\n                    transport: \"remote\" as const,\n                    endpoint: config.endpoint,\n                    remoteTransport: config.remoteTransport ?? \"auto\",\n                    queryParams: resolvedQueryParams,\n                    headers: Object.keys(headers).length > 0 ? headers : undefined,\n                    authProvider: resolvedAuth.authProvider,\n                  };\n                })\n              : resolveConnectorInput(namespace, config.scope, sd, ctx, allowStdio)\n          ).pipe(\n            Effect.result,\n            Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n              attributes: {\n                \"mcp.source.namespace\": namespace,\n                \"mcp.source.transport\": sd.transport,\n              },\n            }),\n          );\n\n          if (Result.isFailure(resolved) && sd.transport === \"stdio\") {\n            return yield* Effect.fail(resolved.failure);\n          }\n\n          // Try discovery only if we have a live connector input.\n          // Otherwise fall straight through to the persist step with\n          // an empty manifest and surface the resolver failure to\n          // the caller at the end.\n          const discovery: Result.Result<\n            McpToolManifest,\n            McpToolDiscoveryError | McpConnectionError | StorageFailure\n          > = Result.isSuccess(resolved)\n            ? yield* discoverTools(createMcpConnector(resolved.success)).pipe(\n                Effect.mapError(\n                  ({ message }) =>\n                    new McpToolDiscoveryError({\n                      stage: \"list_tools\",\n                      message: `MCP discovery failed: ${message}`,\n                    }),\n                ),\n                Effect.result,\n                Effect.withSpan(\"mcp.plugin.discover_tools\", {\n                  attributes: { \"mcp.source.namespace\": namespace },\n                }),\n              )\n            : Result.fail(resolved.failure);\n          const manifest = Result.isSuccess(discovery)\n            ? discovery.success\n            : { server: undefined, tools: [] as const };\n\n          const sourceName = config.name ?? manifest.server?.name ?? namespace;\n\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                // Remove stale rows at the target scope (plugin-owned).\n                // Pinning scope keeps a shadowed outer-scope row intact\n                // when a per-user addSource re-uses the same namespace.\n                yield* ctx.storage.removeBindingsByNamespace(namespace, config.scope);\n                yield* ctx.storage.removeSource(namespace, config.scope);\n\n                yield* ctx.storage.putSource({\n                  namespace,\n                  scope: config.scope,\n                  name: sourceName,\n                  config: sd,\n                });\n\n                yield* ctx.storage.putBindings(\n                  namespace,\n                  config.scope,\n                  manifest.tools.map((e) => ({\n                    toolId: `${namespace}.${e.toolId}`,\n                    binding: toBinding(e),\n                  })),\n                );\n\n                yield* ctx.core.sources.register({\n                  id: namespace,\n                  scope: config.scope,\n                  kind: \"mcp\",\n                  name: sourceName,\n                  url: sd.transport === \"remote\" ? sd.endpoint : undefined,\n                  canRemove: true,\n                  canRefresh: true,\n                  canEdit: sd.transport === \"remote\",\n                  tools: manifest.tools.map((e) => ({\n                    name: e.toolId,\n                    description: e.description ?? `MCP tool: ${e.toolName}`,\n                    inputSchema: e.inputSchema,\n                    outputSchema: e.outputSchema,\n                  })),\n                });\n\n                if (directBindings.length > 0) {\n                  for (const binding of directBindings) {\n                    const bindingTargetScope = yield* targetScopeForBinding(\n                      config.transport === \"remote\" ? config.credentialTargetScope : undefined,\n                      binding,\n                    );\n                    yield* ctx.credentialBindings.set({\n                      targetScope: ScopeId.make(bindingTargetScope),\n                      pluginId: MCP_PLUGIN_ID,\n                      sourceId: namespace,\n                      sourceScope: ScopeId.make(config.scope),\n                      slotKey: binding.slot,\n                      value: binding.value,\n                    });\n                  }\n                }\n              }),\n            )\n            .pipe(\n              Effect.withSpan(\"mcp.plugin.persist_source\", {\n                attributes: {\n                  \"mcp.source.namespace\": namespace,\n                  \"mcp.source.tool_count\": manifest.tools.length,\n                },\n              }),\n            );\n\n          if (configFile) {\n            yield* configFile\n              .upsertSource(toMcpConfigEntry(namespace, sourceName, config))\n              .pipe(Effect.withSpan(\"mcp.plugin.config_file.upsert\"));\n          }\n\n          if (Result.isFailure(discovery)) {\n            return yield* Effect.fail(discovery.failure);\n          }\n          return { toolCount: manifest.tools.length, namespace };\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.add_source\", {\n            attributes: {\n              \"mcp.source.transport\": config.transport,\n              \"mcp.source.name\": config.name,\n            },\n          }),\n        );\n\n      const removeSource = (namespace: string, scope: string) =>\n        Effect.gen(function* () {\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                yield* ctx.credentialBindings.removeForSource({\n                  pluginId: MCP_PLUGIN_ID,\n                  sourceId: namespace,\n                  sourceScope: ScopeId.make(scope),\n                });\n                yield* ctx.storage.removeBindingsByNamespace(namespace, scope);\n                yield* ctx.storage.removeSource(namespace, scope);\n                yield* ctx.core.sources.unregister({ id: namespace, targetScope: scope });\n              }),\n            )\n            .pipe(Effect.withSpan(\"mcp.plugin.persist_remove\"));\n          if (configFile) {\n            yield* configFile\n              .removeSource(namespace)\n              .pipe(Effect.withSpan(\"mcp.plugin.config_file.remove\"));\n          }\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.remove_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const refreshSource = (namespace: string, scope: string) =>\n        Effect.gen(function* () {\n          const sd = yield* ctx.storage.getSourceConfig(namespace, scope).pipe(\n            Effect.withSpan(\"mcp.plugin.load_source_config\", {\n              attributes: { \"mcp.source.namespace\": namespace },\n            }),\n          );\n          if (!sd) {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: `No stored config for MCP source \"${namespace}\"`,\n            });\n          }\n\n          const ci = yield* resolveConnectorInput(namespace, scope, sd, ctx, allowStdio).pipe(\n            Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n              attributes: {\n                \"mcp.source.namespace\": namespace,\n                \"mcp.source.transport\": sd.transport,\n              },\n            }),\n          );\n          const manifest = yield* discoverTools(createMcpConnector(ci)).pipe(\n            Effect.mapError(\n              ({ message }) =>\n                new McpToolDiscoveryError({\n                  stage: \"list_tools\",\n                  message: `MCP refresh failed: ${message}`,\n                }),\n            ),\n            Effect.withSpan(\"mcp.plugin.discover_tools\", {\n              attributes: { \"mcp.source.namespace\": namespace },\n            }),\n          );\n\n          const existing = yield* ctx.storage.getSource(namespace, scope);\n          const sourceName = manifest.server?.name ?? existing?.name ?? namespace;\n\n          yield* ctx\n            .transaction(\n              Effect.gen(function* () {\n                yield* ctx.storage.removeBindingsByNamespace(namespace, scope);\n                yield* ctx.core.sources.unregister({ id: namespace, targetScope: scope });\n\n                yield* ctx.storage.putBindings(\n                  namespace,\n                  scope,\n                  manifest.tools.map((e) => ({\n                    toolId: `${namespace}.${e.toolId}`,\n                    binding: toBinding(e),\n                  })),\n                );\n                yield* ctx.core.sources.register({\n                  id: namespace,\n                  scope,\n                  kind: \"mcp\",\n                  name: sourceName,\n                  url: sd.transport === \"remote\" ? sd.endpoint : undefined,\n                  canRemove: true,\n                  canRefresh: true,\n                  canEdit: sd.transport === \"remote\",\n                  tools: manifest.tools.map((e) => ({\n                    name: e.toolId,\n                    description: e.description ?? `MCP tool: ${e.toolName}`,\n                    inputSchema: e.inputSchema,\n                    outputSchema: e.outputSchema,\n                  })),\n                });\n              }),\n            )\n            .pipe(\n              Effect.withSpan(\"mcp.plugin.persist_source\", {\n                attributes: {\n                  \"mcp.source.namespace\": namespace,\n                  \"mcp.source.tool_count\": manifest.tools.length,\n                },\n              }),\n            );\n\n          return { toolCount: manifest.tools.length };\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.refresh_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const updateSource = (namespace: string, scope: string, input: McpUpdateSourceInput) =>\n        Effect.gen(function* () {\n          const existing = yield* ctx.storage.getSource(namespace, scope);\n          if (!existing || existing.config.transport !== \"remote\") return;\n\n          const canonicalHeaders =\n            input.headers !== undefined\n              ? canonicalizeCredentialMap(input.headers, mcpHeaderSlot)\n              : null;\n          const canonicalQueryParams =\n            input.queryParams !== undefined\n              ? canonicalizeCredentialMap(input.queryParams, mcpQueryParamSlot)\n              : null;\n          const canonicalAuth = input.auth !== undefined ? canonicalizeAuth(input.auth) : null;\n          const directBindings = [\n            ...(canonicalHeaders?.bindings ?? []),\n            ...(canonicalQueryParams?.bindings ?? []),\n            ...(canonicalAuth?.bindings ?? []),\n          ];\n          const targetScope = yield* bindingTargetScope(\n            input.credentialTargetScope,\n            directBindings,\n          );\n          if (targetScope) {\n            yield* validateMcpBindingTarget(ctx, {\n              sourceId: namespace,\n              sourceScope: scope,\n              targetScope,\n            });\n          }\n\n          const remote = existing.config;\n          const updatedConfig: McpStoredSourceData = {\n            ...remote,\n            ...(input.endpoint !== undefined ? { endpoint: input.endpoint } : {}),\n            ...(canonicalHeaders ? { headers: canonicalHeaders.values } : {}),\n            ...(canonicalAuth ? { auth: canonicalAuth.auth } : {}),\n            ...(canonicalQueryParams ? { queryParams: canonicalQueryParams.values } : {}),\n          };\n          const sourceName = input.name?.trim() || existing.name;\n\n          const affectedPrefixes = [\n            ...(input.headers !== undefined ? [\"header:\"] : []),\n            ...(input.queryParams !== undefined ? [\"query_param:\"] : []),\n            ...(input.auth !== undefined ? [\"auth:\"] : []),\n          ];\n          const replacementTargetScope = targetScope ?? input.credentialTargetScope ?? scope;\n          yield* ctx.transaction(\n            Effect.gen(function* () {\n              yield* ctx.storage.putSource({\n                namespace,\n                scope,\n                name: sourceName,\n                config: updatedConfig,\n              });\n              if (affectedPrefixes.length > 0 || directBindings.length > 0) {\n                yield* ctx.credentialBindings.replaceForSource({\n                  targetScope: ScopeId.make(replacementTargetScope),\n                  pluginId: MCP_PLUGIN_ID,\n                  sourceId: namespace,\n                  sourceScope: ScopeId.make(scope),\n                  slotPrefixes: affectedPrefixes,\n                  bindings: directBindings.map((binding) => ({\n                    slotKey: binding.slot,\n                    value: binding.value,\n                  })),\n                });\n              }\n            }),\n          );\n\n          if (configFile) {\n            const bindings = yield* ctx.credentialBindings.listForSource({\n              pluginId: MCP_PLUGIN_ID,\n              sourceId: namespace,\n              sourceScope: ScopeId.make(scope),\n            });\n            const inputForm = inputFormFromStored(\n              bindings,\n              updatedConfig,\n              scope,\n              sourceName,\n              namespace,\n            );\n            yield* configFile\n              .upsertSource(toMcpConfigEntry(namespace, sourceName, inputForm))\n              .pipe(Effect.withSpan(\"mcp.plugin.config_file.upsert\"));\n          }\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.update_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      const getSource = (namespace: string, scope: string) =>\n        ctx.storage.getSource(namespace, scope).pipe(\n          Effect.withSpan(\"mcp.plugin.get_source\", {\n            attributes: { \"mcp.source.namespace\": namespace },\n          }),\n        );\n\n      return {\n        probeEndpoint,\n        addSource,\n        removeSource,\n        refreshSource,\n        getSource,\n        updateSource,\n        listSourceBindings: (sourceId: string, sourceScope: string) =>\n          listMcpSourceBindings(ctx, sourceId, sourceScope),\n        setSourceBinding: (input: McpSourceBindingInput) =>\n          Effect.gen(function* () {\n            yield* validateMcpBindingTarget(ctx, {\n              sourceId: input.sourceId,\n              sourceScope: input.sourceScope,\n              targetScope: input.scope,\n            });\n            const binding = yield* ctx.credentialBindings.set({\n              targetScope: input.scope,\n              pluginId: MCP_PLUGIN_ID,\n              sourceId: input.sourceId,\n              sourceScope: input.sourceScope,\n              slotKey: input.slot,\n              value: input.value,\n            });\n            return coreBindingToMcpBinding(binding);\n          }),\n        removeSourceBinding: (sourceId: string, sourceScope: string, slot: string, scope: string) =>\n          Effect.gen(function* () {\n            yield* validateMcpBindingTarget(ctx, {\n              sourceId,\n              sourceScope,\n              targetScope: scope,\n            });\n            yield* ctx.credentialBindings.remove({\n              targetScope: ScopeId.make(scope),\n              pluginId: MCP_PLUGIN_ID,\n              sourceId,\n              sourceScope: ScopeId.make(sourceScope),\n              slotKey: slot,\n            });\n          }),\n      };\n    },\n\n    invokeTool: ({ ctx, toolRow, args, elicit }) =>\n      Effect.gen(function* () {\n        const runtime = yield* ensureRuntime();\n\n        // toolRow.scope_id is the resolved owning scope of the tool\n        // (innermost-wins from the executor's stack). The matching\n        // mcp_binding + mcp_source rows live at the same scope, so\n        // pin every store lookup to it instead of relying on the\n        // scoped adapter's stack-wide fall-through.\n        const toolScope = toolRow.scope_id;\n        const entry = yield* ctx.storage.getBinding(toolRow.id, toolScope).pipe(\n          Effect.withSpan(\"mcp.plugin.load_binding\", {\n            attributes: { \"mcp.tool.name\": toolRow.id },\n          }),\n        );\n        if (!entry) {\n          return yield* new McpInvocationError({\n            toolName: toolRow.id,\n            message: `No MCP binding found for tool \"${toolRow.id}\"`,\n          });\n        }\n\n        const sd = yield* ctx.storage.getSourceConfig(entry.namespace, toolScope).pipe(\n          Effect.withSpan(\"mcp.plugin.load_source_config\", {\n            attributes: { \"mcp.source.namespace\": entry.namespace },\n          }),\n        );\n        if (!sd) {\n          return yield* new McpConnectionError({\n            transport: \"auto\",\n            message: `No MCP source config for namespace \"${entry.namespace}\"`,\n          });\n        }\n\n        return yield* invokeMcpTool({\n          toolId: toolRow.id,\n          toolName: entry.binding.toolName,\n          args,\n          sourceData: sd,\n          sourceId: entry.namespace,\n          sourceScope: toolScope,\n          invokerScope: ctx.scopes[0]!.id,\n          resolveConnector: () =>\n            resolveConnectorInput(entry.namespace, toolScope, sd, ctx, allowStdio).pipe(\n              Effect.catchTags({\n                StorageError: () =>\n                  Effect.fail(\n                    new McpConnectionError({\n                      transport: sd.transport,\n                      message: \"Failed to resolve MCP connector storage state\",\n                    }),\n                  ),\n                UniqueViolationError: () =>\n                  Effect.fail(\n                    new McpConnectionError({\n                      transport: sd.transport,\n                      message: \"Failed to resolve MCP connector storage state\",\n                    }),\n                  ),\n              }),\n              Effect.flatMap((ci) => createMcpConnector(ci)),\n              Effect.withSpan(\"mcp.plugin.resolve_connector\", {\n                attributes: {\n                  \"mcp.source.namespace\": entry.namespace,\n                  \"mcp.source.transport\": sd.transport,\n                },\n              }),\n            ),\n          connectionCache: runtime.connectionCache,\n          pendingConnectors: runtime.pendingConnectors,\n          elicit,\n        });\n      }).pipe(\n        Effect.withSpan(\"mcp.plugin.invoke_tool\", {\n          attributes: {\n            \"mcp.tool.name\": toolRow.id,\n            \"mcp.tool.source_id\": toolRow.source_id,\n          },\n        }),\n      ),\n\n    detect: ({ ctx, url }) =>\n      Effect.gen(function* () {\n        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;\n        const trimmed = url.trim();\n        if (!trimmed) return null;\n\n        const parsed = yield* Effect.try({\n          try: () => new URL(trimmed),\n          catch: (cause) => cause,\n        }).pipe(Effect.option);\n        if (Option.isNone(parsed)) return null;\n\n        const name = parsed.value.hostname || \"mcp\";\n        const namespace = deriveMcpNamespace({ endpoint: trimmed });\n\n        const connector = createMcpConnector({\n          transport: \"remote\",\n          endpoint: trimmed,\n        });\n\n        const connected = yield* discoverTools(connector).pipe(\n          Effect.map(() => true),\n          Effect.catch(() => Effect.succeed(false)),\n          Effect.withSpan(\"mcp.plugin.discover_tools\"),\n        );\n\n        if (connected) {\n          return SourceDetectionResult.make({\n            kind: \"mcp\",\n            confidence: \"high\",\n            endpoint: trimmed,\n            name,\n            namespace,\n          });\n        }\n\n        // The shape probe inspects the JSON-RPC `initialize` response\n        // and only classifies as MCP when the wire shape is\n        // unambiguous (2xx + JSON-RPC body, 2xx SSE, or 401 + Bearer +\n        // JSON-RPC error envelope). That body-shape gate is what\n        // separates real MCP servers — including those that\n        // authenticate with static API keys and publish no OAuth\n        // metadata — from unrelated OAuth-protected services whose\n        // host happens to expose RFC 9728/8414 documents.\n        const shape = yield* probeMcpEndpointShape(trimmed, { httpClientLayer });\n        if (shape.kind === \"mcp\") {\n          return SourceDetectionResult.make({\n            kind: \"mcp\",\n            confidence: \"high\",\n            endpoint: trimmed,\n            name,\n            namespace,\n          });\n        }\n\n        // Low-confidence URL-token fallback. When wire-shape detection\n        // can't confirm MCP (server unreachable, behind unusual auth,\n        // returns a non-canonical body, etc.) but the URL itself is a\n        // strong hint, surface a candidate so the user can still pick\n        // it from the detect dropdown rather than getting nothing.\n        if (urlMatchesToken(parsed.value, \"mcp\")) {\n          return SourceDetectionResult.make({\n            kind: \"mcp\",\n            confidence: \"low\",\n            endpoint: trimmed,\n            name,\n            namespace,\n          });\n        }\n\n        return null;\n      }).pipe(\n        Effect.catch(() => Effect.succeed(null)),\n        Effect.withSpan(\"mcp.plugin.detect\", {\n          attributes: { \"mcp.endpoint\": url },\n        }),\n      ),\n\n    // Honor upstream destructiveHint from MCP ToolAnnotations.\n    // Bindings are fetched per scope so shadowed sources (e.g. an org-level\n    // source overridden per-user) each resolve against their own scope's\n    // row rather than collapsing onto whichever row the scoped adapter\n    // sees first.\n    resolveAnnotations: ({ ctx, sourceId, toolRows }) =>\n      Effect.gen(function* () {\n        const scopes = new Set(toolRows.map((row) => row.scope_id));\n        const entries = yield* Effect.forEach(\n          [...scopes],\n          (scope) =>\n            Effect.gen(function* () {\n              const list = yield* ctx.storage.listBindingsBySource(sourceId, scope);\n              const byId = new Map(list.map((e) => [e.toolId, e.binding]));\n              return [scope, byId] as const;\n            }),\n          { concurrency: \"unbounded\" },\n        );\n        const byScope = new Map(entries);\n\n        const out: Record<string, ToolAnnotations> = {};\n        for (const row of toolRows) {\n          const binding = byScope.get(row.scope_id)?.get(row.id);\n          const ann = binding?.annotations;\n          if (ann?.destructiveHint === true) {\n            out[row.id] = {\n              requiresApproval: true,\n              approvalDescription: ann.title ?? binding?.toolName ?? row.id,\n            };\n          } else {\n            out[row.id] = { requiresApproval: false };\n          }\n        }\n        return out;\n      }),\n\n    removeSource: ({ ctx, sourceId, scope }) =>\n      Effect.gen(function* () {\n        yield* ctx.transaction(\n          Effect.gen(function* () {\n            yield* ctx.credentialBindings.removeForSource({\n              pluginId: MCP_PLUGIN_ID,\n              sourceId,\n              sourceScope: ScopeId.make(scope),\n            });\n            yield* ctx.storage.removeBindingsByNamespace(sourceId, scope);\n            yield* ctx.storage.removeSource(sourceId, scope);\n          }),\n        );\n        if (options?.configFile) {\n          yield* options.configFile.removeSource(sourceId);\n        }\n      }),\n\n    usagesForSecret: () => Effect.succeed([]),\n\n    usagesForConnection: () => Effect.succeed([]),\n\n    refreshSource: () => Effect.void,\n\n    // Connection refresh for oauth2-minted sources is owned by the\n    // canonical `\"oauth2\"` ConnectionProvider that core registers via\n    // `makeOAuth2Service`. No MCP-specific provider needed.\n\n    close: () =>\n      Effect.gen(function* () {\n        const runtime = runtimeRef.current;\n        if (runtime) {\n          runtime.pendingConnectors.clear();\n          yield* ScopedCache.invalidateAll(runtime.connectionCache);\n          yield* Scope.close(runtime.cacheScope, Exit.void);\n          runtimeRef.current = null;\n        }\n      }).pipe(Effect.withSpan(\"mcp.plugin.close\")),\n  };\n  // HTTP transport (routes/handlers/extensionService) is layered on by\n  // the api-aware factory in `@executor-js/plugin-mcp/api`. Hosts that\n  // want the HTTP surface import the plugin from there; SDK-only\n  // consumers stay on this entry and avoid the server-only deps.\n});\n\n// ---------------------------------------------------------------------------\n// McpPluginExtension — shape of `executor.mcp` for consumers that want\n// to type against it directly (api/, react/). Mirrors what `extension`\n// returns above.\n// ---------------------------------------------------------------------------\n\n/**\n * Errors any MCP extension method may surface. The first four are\n * plugin-domain tagged errors that flow directly to clients (4xx, each\n * carrying its own `HttpApiSchema` status). `StorageFailure` covers\n * raw backend failures (`StorageError`) plus `UniqueViolationError`;\n * the HTTP edge (`@executor-js/api`'s `withCapture`) translates\n * `StorageError` to the opaque `InternalError({ traceId })` at Layer\n * composition. `UniqueViolationError` passes through — plugins can\n * `Effect.catchTag` it if they want a friendlier user-facing error.\n */\nexport type McpExtensionFailure = McpConnectionError | McpToolDiscoveryError | StorageFailure;\n\nexport interface McpPluginExtension {\n  readonly probeEndpoint: (\n    input: string | McpProbeEndpointInput,\n  ) => Effect.Effect<McpProbeResult, McpExtensionFailure>;\n  readonly addSource: (\n    config: McpSourceConfig,\n  ) => Effect.Effect<\n    { readonly toolCount: number; readonly namespace: string },\n    McpExtensionFailure\n  >;\n  readonly removeSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<void, McpExtensionFailure>;\n  readonly refreshSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<{ readonly toolCount: number }, McpExtensionFailure>;\n  readonly getSource: (\n    namespace: string,\n    scope: string,\n  ) => Effect.Effect<McpStoredSource | null, McpExtensionFailure>;\n  readonly updateSource: (\n    namespace: string,\n    scope: string,\n    input: McpUpdateSourceInput,\n  ) => Effect.Effect<void, McpExtensionFailure>;\n  readonly listSourceBindings: (\n    sourceId: string,\n    sourceScope: string,\n  ) => Effect.Effect<readonly McpSourceBindingRef[], StorageFailure>;\n  readonly setSourceBinding: (\n    input: McpSourceBindingInput,\n  ) => Effect.Effect<McpSourceBindingRef, StorageFailure>;\n  readonly removeSourceBinding: (\n    sourceId: string,\n    sourceScope: string,\n    slot: string,\n    scope: string,\n  ) => Effect.Effect<void, StorageFailure>;\n}\n","import type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { SSEClientTransport } from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { CfWorkerJsonSchemaValidator } from \"@modelcontextprotocol/sdk/validation/cfworker\";\nimport { Effect } from \"effect\";\n\n// NOTE: `StdioClientTransport` is NOT imported eagerly. The upstream module\n// (`@modelcontextprotocol/sdk/client/stdio.js`) touches `node:child_process`\n// at evaluation time, which crashes workerd (incl. vitest-pool-workers) at\n// SIGSEGV on module instantiation. Cloud callers set\n// `dangerouslyAllowStdioMCP: false` and never reach the stdio branch below;\n// prod bundles that DO use stdio load it via a dynamic import inside the\n// stdio branch of `createMcpConnector`.\n\nimport type { McpRemoteSourceData, McpStdioSourceData } from \"./types\";\nimport { McpConnectionError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Connection type\n// ---------------------------------------------------------------------------\n\nexport type McpConnection = {\n  readonly client: Client;\n  readonly close: () => Promise<void>;\n};\n\nexport type McpConnector = Effect.Effect<McpConnection, McpConnectionError>;\n\n// ---------------------------------------------------------------------------\n// Connector input — extends stored source data with resolved auth\n// ---------------------------------------------------------------------------\n\nexport type RemoteConnectorInput = Omit<\n  McpRemoteSourceData,\n  \"auth\" | \"remoteTransport\" | \"headers\" | \"queryParams\"\n> & {\n  readonly remoteTransport?: McpRemoteSourceData[\"remoteTransport\"];\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n  readonly authProvider?: OAuthClientProvider;\n};\n\nexport type StdioConnectorInput = McpStdioSourceData;\n\nexport type ConnectorInput = RemoteConnectorInput | StdioConnectorInput;\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst buildEndpointUrl = (endpoint: string, queryParams: Record<string, string>): URL => {\n  const url = new URL(endpoint);\n  for (const [key, value] of Object.entries(queryParams)) {\n    url.searchParams.set(key, value);\n  }\n  return url;\n};\n\n// Use the cfworker JSON Schema validator instead of the SDK's default\n// (Ajv). Ajv compiles schemas via `new Function(...)`, which throws\n// `Code generation from strings disallowed for this context` when the\n// MCP plugin runs inside a Cloudflare Worker (executor.sh). The\n// cfworker validator does not use code generation and works in every\n// runtime we ship to.\nconst createClient = (): Client =>\n  new Client(\n    { name: \"executor-mcp\", version: \"0.1.0\" },\n    {\n      capabilities: { elicitation: { form: {}, url: {} } },\n      jsonSchemaValidator: new CfWorkerJsonSchemaValidator(),\n    },\n  );\n\nconst connectionFromClient = (client: Client): McpConnection => ({\n  client,\n  close: () => client.close(),\n});\n\nconst connectClient = (input: {\n  transport: string;\n  createTransport: () => Parameters<Client[\"connect\"]>[0];\n}): Effect.Effect<McpConnection, McpConnectionError> =>\n  Effect.gen(function* () {\n    const client = createClient();\n    const transportInstance = input.createTransport();\n\n    yield* Effect.tryPromise({\n      try: () => client.connect(transportInstance),\n      catch: () =>\n        new McpConnectionError({\n          transport: input.transport,\n          message: `Failed connecting via ${input.transport}`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.connection.handshake\", {\n        attributes: { \"plugin.mcp.transport\": input.transport },\n      }),\n    );\n\n    return connectionFromClient(client);\n  });\n\n// ---------------------------------------------------------------------------\n// Public factory\n// ---------------------------------------------------------------------------\n\nexport const createMcpConnector = (input: ConnectorInput): McpConnector => {\n  if (input.transport === \"stdio\") {\n    const command = input.command.trim();\n    if (!command) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message: \"MCP stdio transport requires a command\",\n        }),\n      );\n    }\n\n    return Effect.gen(function* () {\n      // Dynamic import so the underlying module (which evaluates\n      // `node:child_process`) is only loaded when stdio is actually used.\n      const { createStdioTransport } = yield* Effect.tryPromise({\n        try: () => import(\"./stdio-connector\"),\n        catch: () =>\n          new McpConnectionError({\n            transport: \"stdio\",\n            message: \"Failed to load stdio transport module\",\n          }),\n      });\n\n      return yield* connectClient({\n        transport: \"stdio\",\n        createTransport: () =>\n          createStdioTransport({\n            command,\n            args: input.args,\n            env: input.env,\n            cwd: input.cwd?.trim().length ? input.cwd.trim() : undefined,\n          }),\n      });\n    });\n  }\n\n  // Remote transport\n  const headers = input.headers ?? {};\n  const remoteTransport = input.remoteTransport ?? \"auto\";\n  const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;\n\n  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});\n\n  const connectStreamableHttp = connectClient({\n    transport: \"streamable-http\",\n    createTransport: () =>\n      new StreamableHTTPClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  const connectSse = connectClient({\n    transport: \"sse\",\n    createTransport: () =>\n      new SSEClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  if (remoteTransport === \"streamable-http\") return connectStreamableHttp;\n  if (remoteTransport === \"sse\") return connectSse;\n\n  // auto — try streamable-http first, fall back to SSE\n  return connectStreamableHttp.pipe(Effect.catch(() => connectSse));\n};\n","// ---------------------------------------------------------------------------\n// MCP tool discovery — connect to an MCP server and list its tools\n// ---------------------------------------------------------------------------\n\nimport { Effect } from \"effect\";\n\nimport type { McpConnector } from \"./connection\";\nimport { McpToolDiscoveryError } from \"./errors\";\nimport {\n  extractManifestFromListToolsResult,\n  isListToolsResult,\n  type McpToolManifest,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Connect to an MCP server and discover all available tools.\n * Returns the parsed manifest containing server metadata and tool entries.\n */\nexport const discoverTools = (\n  connector: McpConnector,\n): Effect.Effect<McpToolManifest, McpToolDiscoveryError> =>\n  Effect.gen(function* () {\n    // Acquire connection\n    const connection = yield* connector.pipe(\n      Effect.mapError(\n        ({ message }) =>\n          new McpToolDiscoveryError({\n            stage: \"connect\",\n            message: `Failed connecting to MCP server: ${message}`,\n          }),\n      ),\n    );\n\n    // List tools\n    const listResult = yield* Effect.tryPromise({\n      try: () => connection.client.listTools(),\n      catch: () =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"Failed listing MCP tools\",\n        }),\n    });\n\n    if (!isListToolsResult(listResult)) {\n      yield* closeConnection(connection);\n      return yield* new McpToolDiscoveryError({\n        stage: \"list_tools\",\n        message: \"MCP listTools response did not match the expected schema\",\n      });\n    }\n\n    const manifest = extractManifestFromListToolsResult(listResult, {\n      serverInfo: connection.client.getServerVersion?.(),\n    });\n\n    // Close the connection after discovery\n    yield* closeConnection(connection);\n\n    return manifest;\n  });\n\nconst closeConnection = (connection: {\n  readonly close: () => Promise<void>;\n}): Effect.Effect<void, never> =>\n  Effect.ignore(\n    Effect.tryPromise({\n      try: () => connection.close(),\n      catch: () =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"Failed closing MCP connection\",\n        }),\n    }),\n  );\n","import { Option, Schema } from \"effect\";\n\nimport { McpToolAnnotations } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Output types\n// ---------------------------------------------------------------------------\n\nexport interface McpToolManifestEntry {\n  readonly toolId: string;\n  readonly toolName: string;\n  readonly description: string | null;\n  readonly inputSchema?: unknown;\n  readonly outputSchema?: unknown;\n  readonly annotations?: McpToolAnnotations;\n}\n\nexport interface McpServerMetadata {\n  readonly name: string | null;\n  readonly version: string | null;\n}\n\nexport interface McpToolManifest {\n  readonly server: McpServerMetadata | null;\n  readonly tools: readonly McpToolManifestEntry[];\n}\n\n// ---------------------------------------------------------------------------\n// Schemas\n// ---------------------------------------------------------------------------\n\nconst ListedTool = Schema.Struct({\n  name: Schema.String,\n  description: Schema.optional(Schema.NullOr(Schema.String)),\n  inputSchema: Schema.optional(Schema.Unknown),\n  parameters: Schema.optional(Schema.Unknown),\n  outputSchema: Schema.optional(Schema.Unknown),\n  annotations: Schema.optional(McpToolAnnotations),\n});\n\nconst ListToolsResult = Schema.Struct({\n  tools: Schema.Array(ListedTool),\n});\n\nconst ServerInfo = Schema.Struct({\n  name: Schema.optional(Schema.String),\n  version: Schema.optional(Schema.String),\n});\n\nconst decodeListToolsResult = Schema.decodeUnknownOption(ListToolsResult);\nconst decodeServerInfo = Schema.decodeUnknownOption(ServerInfo);\n\nexport const isListToolsResult = (value: unknown): boolean =>\n  Option.isSome(decodeListToolsResult(value));\n\n// ---------------------------------------------------------------------------\n// Tool ID sanitization\n// ---------------------------------------------------------------------------\n\nconst sanitize = (value: string): string => {\n  const s = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return s || \"tool\";\n};\n\nconst uniqueId = (value: string, seen: Map<string, number>): string => {\n  const base = sanitize(value);\n  const n = (seen.get(base) ?? 0) + 1;\n  seen.set(base, n);\n  return n === 1 ? base : `${base}_${n}`;\n};\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport const joinToolPath = (namespace: string | undefined, toolId: string): string =>\n  namespace?.trim() ? `${namespace}.${toolId}` : toolId;\n\nexport const extractManifestFromListToolsResult = (\n  listToolsResult: unknown,\n  metadata?: { serverInfo?: unknown },\n): McpToolManifest => {\n  const seen = new Map<string, number>();\n\n  const listed = decodeListToolsResult(listToolsResult).pipe(\n    Option.map((result) => result.tools),\n    Option.getOrElse(() => []),\n  );\n\n  const server = decodeServerInfo(metadata?.serverInfo).pipe(\n    Option.map(\n      (info): McpServerMetadata => ({\n        name: info.name ?? null,\n        version: info.version ?? null,\n      }),\n    ),\n    Option.getOrNull,\n  );\n\n  const tools = listed.flatMap((tool): McpToolManifestEntry[] => {\n    const toolName = tool.name.trim();\n    if (!toolName) return [];\n\n    return [\n      {\n        toolId: uniqueId(toolName, seen),\n        toolName,\n        description: tool.description ?? null,\n        inputSchema: tool.inputSchema ?? tool.parameters,\n        outputSchema: tool.outputSchema,\n        annotations: tool.annotations,\n      },\n    ];\n  });\n\n  return { server, tools };\n};\n\n// ---------------------------------------------------------------------------\n// Namespace derivation\n// ---------------------------------------------------------------------------\n\nconst slugify = (value: string): string =>\n  value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n\nconst hostnameOf = (url: string): string | null => {\n  if (!URL.canParse(url)) return null;\n  return new URL(url).hostname;\n};\n\nconst basenameOf = (path: string): string => path.trim().split(/[\\\\/]/).pop() ?? path.trim();\n\nexport const deriveMcpNamespace = (input: {\n  name?: string | null;\n  endpoint?: string | null;\n  command?: string | null;\n}): string => {\n  if (input.name?.trim()) return slugify(input.name) || \"mcp\";\n\n  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;\n  if (fromEndpoint) return slugify(fromEndpoint) || \"mcp\";\n\n  if (input.command?.trim()) return slugify(basenameOf(input.command)) || \"mcp\";\n\n  return \"mcp\";\n};\n","// ---------------------------------------------------------------------------\n// MCP tool invocation — shared helper called from plugin.invokeTool.\n//\n// Responsible for:\n//   1. Finding/creating a cached MCP client connection for the source.\n//   2. Installing a per-invocation `ElicitRequestSchema` handler that\n//      bridges MCP's elicit capability into the host's elicit function\n//      threaded via `InvokeToolInput.elicit`.\n//   3. Calling `client.callTool({ name, arguments })`.\n//   4. Retrying once on connection failure (invalidate + reconnect).\n// ---------------------------------------------------------------------------\n\nimport { Cause, Effect, Exit, Option, Predicate, Schema, ScopedCache } from \"effect\";\n\nimport { ElicitRequestSchema } from \"@modelcontextprotocol/sdk/types.js\";\n\nimport {\n  FormElicitation,\n  UrlElicitation,\n  type Elicit,\n  type ElicitationRequest,\n} from \"@executor-js/sdk/core\";\n\nimport { McpConnectionError, McpInvocationError } from \"./errors\";\nimport type { McpConnection } from \"./connection\";\nimport type { McpStoredSourceData } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst ArgsRecord = Schema.Record(Schema.String, Schema.Unknown);\nconst decodeArgsRecord = Schema.decodeUnknownOption(ArgsRecord);\n\nconst argsRecord = (value: unknown): Record<string, unknown> =>\n  Option.getOrElse(decodeArgsRecord(value), () => ({}));\n\nconst stableJson = (value: unknown): string => {\n  if (Array.isArray(value)) return `[${value.map(stableJson).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value as Record<string, unknown>)\n      .sort(([a], [b]) => a.localeCompare(b))\n      .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value);\n};\n\nconst fingerprint = (value: unknown): string => {\n  const input = stableJson(value);\n  let hash = 0x811c9dc5;\n  for (let i = 0; i < input.length; i++) {\n    hash ^= input.charCodeAt(i);\n    hash = Math.imul(hash, 0x01000193);\n  }\n  return (hash >>> 0).toString(16).padStart(8, \"0\");\n};\n\nconst connectionCacheKey = (input: {\n  readonly sourceData: McpStoredSourceData;\n  readonly invokerScope: string;\n  readonly sourceId: string;\n  readonly sourceScope: string;\n}): string => {\n  const sd = input.sourceData;\n  return sd.transport === \"stdio\"\n    ? `stdio:${fingerprint({\n        sourceId: input.sourceId,\n        sourceScope: input.sourceScope,\n        command: sd.command,\n        args: sd.args ?? [],\n        env: sd.env ?? {},\n        cwd: sd.cwd ?? null,\n      })}`\n    : `remote:${fingerprint({\n        sourceId: input.sourceId,\n        sourceScope: input.sourceScope,\n        invokerScope: input.invokerScope,\n        endpoint: sd.endpoint,\n        remoteTransport: sd.remoteTransport ?? \"auto\",\n        headers: sd.headers ?? {},\n        queryParams: sd.queryParams ?? {},\n        auth: sd.auth,\n      })}`;\n};\n\n// ---------------------------------------------------------------------------\n// Elicitation bridge — decode incoming MCP ElicitRequest, route through\n// the host's elicit function, marshal the response back to MCP shape.\n// ---------------------------------------------------------------------------\n\nconst McpElicitParams = Schema.Union([\n  Schema.Struct({\n    mode: Schema.Literal(\"url\"),\n    message: Schema.String,\n    url: Schema.String,\n    elicitationId: Schema.optional(Schema.String),\n    id: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    mode: Schema.optional(Schema.Literal(\"form\")),\n    message: Schema.String,\n    requestedSchema: Schema.Record(Schema.String, Schema.Unknown),\n  }),\n]);\ntype McpElicitParams = typeof McpElicitParams.Type;\n\nconst decodeElicitParams = Schema.decodeUnknownSync(McpElicitParams);\n\nconst toElicitationRequest = (params: McpElicitParams): ElicitationRequest =>\n  params.mode === \"url\"\n    ? UrlElicitation.make({\n        message: params.message,\n        url: params.url,\n        elicitationId: params.elicitationId ?? params.id ?? \"\",\n      })\n    : FormElicitation.make({\n        message: params.message,\n        requestedSchema: params.requestedSchema,\n      });\n\nconst installElicitationHandler = (client: McpConnection[\"client\"], elicit: Elicit): void => {\n  client.setRequestHandler(ElicitRequestSchema, async (request: { params: unknown }) => {\n    const params = decodeElicitParams(request.params);\n    const req = toElicitationRequest(params);\n    // Use runPromiseExit so we can inspect typed failures — `elicit`\n    // fails with `ElicitationDeclinedError` on decline/cancel, which\n    // we translate into the equivalent MCP elicit response instead of\n    // surfacing as a JSON-RPC error.\n    const exit = await Effect.runPromiseExit(elicit(req));\n    if (Exit.isSuccess(exit)) {\n      const response = exit.value;\n      return {\n        action: response.action,\n        ...(response.action === \"accept\" && response.content ? { content: response.content } : {}),\n      };\n    }\n    const failure = exit.cause.reasons.find(Cause.isFailReason);\n    if (failure) {\n      const err = failure.error;\n      if (Predicate.isTagged(err, \"ElicitationDeclinedError\")) {\n        const action =\n          Predicate.hasProperty(err, \"action\") && err.action === \"cancel\" ? \"cancel\" : \"decline\";\n        return { action };\n      }\n    }\n    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: MCP SDK async request handlers signal unexpected failures by rejecting\n    throw Cause.squash(exit.cause);\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Single tool call — install handler, callTool, return raw result\n// ---------------------------------------------------------------------------\n\nconst useConnection = (\n  connection: McpConnection,\n  toolName: string,\n  args: Record<string, unknown>,\n  elicit: Elicit,\n): Effect.Effect<unknown, McpInvocationError> =>\n  Effect.gen(function* () {\n    installElicitationHandler(connection.client, elicit);\n    return yield* Effect.tryPromise({\n      try: () => connection.client.callTool({ name: toolName, arguments: args }),\n      catch: () =>\n        new McpInvocationError({\n          toolName,\n          message: `MCP tool call failed for ${toolName}`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.client.call_tool\", {\n        attributes: { \"mcp.tool.name\": toolName },\n      }),\n    );\n  });\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport interface InvokeMcpToolInput {\n  readonly toolId: string;\n  readonly toolName: string;\n  readonly args: unknown;\n  readonly sourceData: McpStoredSourceData;\n  readonly sourceId: string;\n  readonly sourceScope: string;\n  /** Innermost executor scope id at invoke time. Mixed into the\n   *  connection cache key so per-user OAuth/secret resolution doesn't\n   *  collapse multiple users onto one shared connection. */\n  readonly invokerScope: string;\n  readonly resolveConnector: () => Effect.Effect<McpConnection, McpConnectionError>;\n  readonly connectionCache: ScopedCache.ScopedCache<string, McpConnection, McpConnectionError>;\n  readonly pendingConnectors: Map<string, Effect.Effect<McpConnection, McpConnectionError>>;\n  readonly elicit: Elicit;\n}\n\nexport const invokeMcpTool = (\n  input: InvokeMcpToolInput,\n): Effect.Effect<unknown, McpConnectionError | McpInvocationError> => {\n  const transport: string =\n    input.sourceData.transport === \"stdio\" ? \"stdio\" : (input.sourceData.remoteTransport ?? \"auto\");\n  return Effect.gen(function* () {\n    const cacheKey = connectionCacheKey(input);\n    const args = argsRecord(input.args);\n\n    // Register the connector for the cache lookup (side-channel pattern\n    // — the ScopedCache lookup closure reads from `pendingConnectors`).\n    const connector = input.resolveConnector();\n    input.pendingConnectors.set(cacheKey, connector);\n\n    // Check cache state BEFORE acquire so the span clearly attributes\n    // tail latency to either a cold handshake (miss) or warm reuse (hit).\n    // Without this every `plugin.mcp.connection.acquire` span looks the\n    // same in Axiom and you have to cross-reference the\n    // `plugin.mcp.connection.handshake` count to back out the hit rate.\n    const cacheHit = yield* ScopedCache.has(input.connectionCache, cacheKey);\n\n    const firstConnection = yield* ScopedCache.get(input.connectionCache, cacheKey).pipe(\n      Effect.withSpan(\"plugin.mcp.connection.acquire\", {\n        attributes: {\n          \"plugin.mcp.transport\": transport,\n          \"plugin.mcp.cache_key\": cacheKey,\n          \"plugin.mcp.attempt\": 1,\n          \"plugin.mcp.cache_hit\": cacheHit,\n        },\n      }),\n    );\n\n    return yield* useConnection(firstConnection, input.toolName, args, input.elicit).pipe(\n      // On failure, invalidate the cache and retry once with a fresh\n      // connection. Matches the old invoker's retry-once semantics.\n      Effect.catch(() =>\n        Effect.gen(function* () {\n          yield* ScopedCache.invalidate(input.connectionCache, cacheKey);\n          input.pendingConnectors.set(cacheKey, connector);\n          const fresh = yield* ScopedCache.get(input.connectionCache, cacheKey);\n          return yield* useConnection(fresh, input.toolName, args, input.elicit);\n        }).pipe(\n          Effect.withSpan(\"plugin.mcp.invoke.retry\", {\n            attributes: {\n              \"plugin.mcp.transport\": transport,\n              \"plugin.mcp.cache_key\": cacheKey,\n              \"mcp.tool.name\": input.toolName,\n            },\n          }),\n        ),\n      ),\n    );\n  }).pipe(\n    Effect.scoped,\n    Effect.withSpan(\"plugin.mcp.invoke\", {\n      attributes: {\n        \"mcp.tool.name\": input.toolName,\n        \"plugin.mcp.tool_id\": input.toolId,\n        \"plugin.mcp.transport\": transport,\n      },\n    }),\n  );\n};\n","// ---------------------------------------------------------------------------\n// MCP endpoint shape probe — decide whether an unknown HTTP endpoint is\n// actually speaking MCP before we try to classify it as such.\n//\n// Background:\n//\n//   `discoverTools` (via the MCP SDK's StreamableHTTP / SSE transport)\n//   fails for every non-MCP endpoint too — 200-with-HTML, 400-GraphQL,\n//   404, etc. all surface as the same opaque transport error. We need\n//   our own classifier that distinguishes \"real MCP\" from\n//   \"OAuth-protected non-MCP service\" without relying on RFC 9728/8414\n//   metadata, since (a) plenty of non-MCP APIs publish that metadata,\n//   and (b) plenty of real MCP servers authenticate with static API\n//   keys and publish no OAuth metadata at all (e.g. cubic.dev).\n//\n// The probe issues an unauth JSON-RPC `initialize` POST and accepts\n// only the wire shapes a real MCP server can return:\n//\n//   - 2xx with `Content-Type: text/event-stream` — streamable HTTP\n//     transport, body is an SSE stream we don't consume.\n//   - 2xx with `Content-Type: application/json` whose body parses as a\n//     JSON-RPC 2.0 envelope (`{jsonrpc:\"2.0\", result|error|method,...}`).\n//   - 401 with `WWW-Authenticate: Bearer` AND a JSON-RPC error envelope\n//     in the body. The body shape is what separates a real MCP server\n//     from an unrelated OAuth-protected API: GraphQL/REST/HTML 401s\n//     don't shape themselves as JSON-RPC.\n//\n// When POST returns 404/405/406/415 we retry with GET + `Accept:\n// text/event-stream` to support legacy SSE-only servers; that path\n// only accepts 2xx with `text/event-stream` or the same 401+Bearer\n// shape.\n//\n// One `fetch` (occasionally two), no MCP-SDK session state, no OAuth\n// round-trip, no DCR — every non-MCP endpoint exits here.\n// ---------------------------------------------------------------------------\n\nimport { Data, Duration, Effect, Layer, Option, Schema } from \"effect\";\nimport { FetchHttpClient, HttpClient, HttpClientRequest } from \"effect/unstable/http\";\n\n/** MCP initialize request body used as the shape probe. Any real MCP\n *  server either answers it (unauth-OK server) or returns the spec-\n *  mandated 401 + WWW-Authenticate pair. A non-MCP endpoint hit with\n *  this body will respond with whatever it does for unknown JSON\n *  payloads — 400, 404, HTML, a GraphQL error envelope, etc. — none of\n *  which match the gate below. */\nconst INITIALIZE_BODY = JSON.stringify({\n  jsonrpc: \"2.0\",\n  id: 1,\n  method: \"initialize\",\n  params: {\n    protocolVersion: \"2025-06-18\",\n    capabilities: {},\n    clientInfo: { name: \"executor-probe\", version: \"0\" },\n  },\n});\n\n/** Header-name lookup is case-insensitive per RFC 7230. `fetch`'s\n *  `Response.headers` already lower-cases, but we normalise explicitly\n *  to stay robust against test mocks that construct `Headers` loosely. */\nconst readHeader = (headers: Readonly<Record<string, string>>, name: string): string | null => {\n  const direct = headers[name];\n  if (direct !== undefined) return direct;\n  const lower = name.toLowerCase();\n  for (const [k, v] of Object.entries(headers)) {\n    if (k.toLowerCase() === lower) return v;\n  }\n  return null;\n};\n\nclass ProbeTransportError extends Data.TaggedError(\"ProbeTransportError\")<{\n  readonly reason: string;\n  readonly cause: unknown;\n}> {}\n\nconst decodeJsonString = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown));\n\nconst asObject = (body: string): Record<string, unknown> | null => {\n  if (!body) return null;\n  const parsed = decodeJsonString(body);\n  if (Option.isNone(parsed)) return null;\n  const value = parsed.value;\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return null;\n  return value as Record<string, unknown>;\n};\n\n/** Quick check that a body parses as a JSON-RPC 2.0 envelope. The MCP wire\n *  protocol is JSON-RPC 2.0, so a real MCP server's response to `initialize`\n *  (whether 2xx with the result, or a 401 error envelope) carries this\n *  shape. Non-MCP services don't — GraphQL APIs return `{errors:[...]}`,\n *  REST APIs return their own envelope, marketing pages return HTML. */\nconst isJsonRpcEnvelope = (body: string): boolean => {\n  const obj = asObject(body);\n  if (!obj) return false;\n  if (obj.jsonrpc !== \"2.0\") return false;\n  return \"result\" in obj || \"error\" in obj || \"method\" in obj;\n};\n\n/** Quick check that a body parses as an RFC 6750 OAuth Bearer error\n *  envelope (`{error: \"invalid_token\", error_description?: ..., ...}`).\n *  Real MCP servers like Atlassian return this shape on unauth requests\n *  even when their WWW-Authenticate omits `resource_metadata=`. The\n *  GraphQL `{errors: [...]}` envelope, which a non-MCP OAuth-protected\n *  GraphQL API would return, is explicitly excluded. */\nconst isOAuthErrorBody = (body: string): boolean => {\n  const obj = asObject(body);\n  if (!obj) return false;\n  if (Array.isArray(obj.errors)) return false;\n  return typeof obj.error === \"string\";\n};\n\n/** RFC 9728 protected-resource-metadata document. We only need the two\n *  fields that prove the document genuinely describes an OAuth-protected\n *  resource: `resource` (the resource identifier) and a non-empty\n *  `authorization_servers` list. */\nconst ProtectedResourceMetadata = Schema.Struct({\n  resource: Schema.String,\n  authorization_servers: Schema.Array(Schema.String),\n});\nconst decodeProtectedResourceMetadata = Schema.decodeUnknownOption(\n  Schema.fromJsonString(ProtectedResourceMetadata),\n);\n\n/** RFC 9728 §3.1 path-scoped well-known URL: insert\n *  `/.well-known/oauth-protected-resource` before the resource's path\n *  component. `https://host/api/mcp` → `https://host/.well-known/oauth-\n *  protected-resource/api/mcp`. This is exactly the URL the MCP\n *  authorization spec tells clients to construct. */\nconst protectedResourceMetadataUrl = (endpoint: URL): string => {\n  const path = endpoint.pathname === \"/\" ? \"\" : endpoint.pathname;\n  return `${endpoint.origin}/.well-known/oauth-protected-resource${path}`;\n};\n\n/** The RFC 9728 `resource` value must actually describe this endpoint\n *  before we trust the document — an exact URL match, or a same-origin\n *  parent whose path is a prefix of the endpoint's. Guards against a\n *  shared host serving protected-resource metadata for some unrelated\n *  resource. */\nconst resourceMatchesEndpoint = (resource: string, endpoint: URL): boolean => {\n  if (!URL.canParse(resource)) return false;\n  const parsed = new URL(resource);\n  if (parsed.origin !== endpoint.origin) return false;\n  const resourcePath = parsed.pathname.replace(/\\/+$/, \"\");\n  const endpointPath = endpoint.pathname.replace(/\\/+$/, \"\");\n  return endpointPath === resourcePath || endpointPath.startsWith(`${resourcePath}/`);\n};\n\n/** Workaround for MCP servers that omit (or under-specify) the\n *  `WWW-Authenticate` challenge on their 401 — e.g. Datadog's\n *  `mcp.datadoghq.com` returns a bare `401 {\"errors\":[\"Unauthorized\"]}`\n *  with no header at all, so the wire-shape gate above can't tell it\n *  apart from an unrelated OAuth-protected API and the user lands on the\n *  manual-credentials prompt instead of an OAuth sign-in.\n *\n *  The MCP authorization spec still requires such servers to publish\n *  RFC 9728 metadata at the path-scoped well-known URL. A document there\n *  whose `resource` matches this endpoint is a deliberate, MCP-spec-\n *  specific signal a generic OAuth API would not emit — strong enough to\n *  classify the endpoint as MCP so the OAuth flow can start. */\nconst probeProtectedResourceMetadata = (\n  client: HttpClient.HttpClient,\n  endpoint: URL,\n  timeoutMs: number,\n): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    const response = yield* client\n      .execute(\n        HttpClientRequest.get(protectedResourceMetadataUrl(endpoint)).pipe(\n          HttpClientRequest.setHeader(\"accept\", \"application/json\"),\n        ),\n      )\n      .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n    if (response.status < 200 || response.status >= 300) return false;\n    const body = yield* response.text.pipe(\n      Effect.timeout(Duration.millis(timeoutMs)),\n      Effect.catch(() => Effect.succeed(\"\")),\n    );\n    const metadata = decodeProtectedResourceMetadata(body);\n    if (Option.isNone(metadata)) return false;\n    if (metadata.value.authorization_servers.length === 0) return false;\n    return resourceMatchesEndpoint(metadata.value.resource, endpoint);\n  }).pipe(Effect.catch(() => Effect.succeed(false)));\n\nconst ErrorMessageShape = Schema.Struct({ message: Schema.String });\nconst decodeErrorMessageShape = Schema.decodeUnknownOption(ErrorMessageShape);\n\nconst reasonFromBoundaryCause = (cause: unknown): string => {\n  const messageShape = decodeErrorMessageShape(cause);\n  if (Option.isSome(messageShape)) return messageShape.value.message;\n  if (typeof cause === \"string\") return cause;\n  if (typeof cause === \"number\" || typeof cause === \"boolean\" || typeof cause === \"bigint\") {\n    return `${cause}`;\n  }\n  if (typeof cause === \"symbol\") return cause.description ?? \"symbol\";\n  if (cause === null) return \"null\";\n  if (typeof cause === \"undefined\") return \"undefined\";\n  return \"fetch failed\";\n};\n\n/** Why the probe rejected an endpoint as not-MCP.\n *\n *  - `auth-required` — server returned 401. We don't know for sure it's\n *    an MCP server (no spec-compliant Bearer challenge or the body\n *    isn't JSON-RPC), but the right next step for the user is the same\n *    either way: provide credentials and retry. This is what\n *    misclassifies real MCP servers like cubic.dev (no\n *    resource_metadata) or ref.tools (no WWW-Authenticate at all)\n *    without the URL-token fallback at the detect layer.\n *  - `wrong-shape` — endpoint responded but with a body or status that\n *    doesn't match any MCP shape (200 HTML, 400 GraphQL, 404 from a\n *    static host, etc.). User action: this URL probably isn't MCP. */\nexport type McpProbeRejectCategory = \"auth-required\" | \"wrong-shape\";\n\nexport type McpShapeProbeResult =\n  /** Server answered initialize successfully — either a 2xx with a\n   *  JSON-RPC payload, or a 401 + WWW-Authenticate: Bearer (RFC 6750\n   *  challenge) that the MCP auth spec requires. */\n  | { readonly kind: \"mcp\"; readonly requiresAuth: boolean }\n  /** Endpoint is reachable but the response does not look like MCP. */\n  | {\n      readonly kind: \"not-mcp\";\n      readonly reason: string;\n      readonly category: McpProbeRejectCategory;\n    }\n  /** Transport-level failure (DNS, TLS, timeout, abort, ...). */\n  | { readonly kind: \"unreachable\"; readonly reason: string };\n\nexport interface ProbeOptions {\n  /** Abort the request after this many ms. Default 8000. */\n  readonly timeoutMs?: number;\n  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n}\n\n/**\n * Hit `endpoint` with a JSON-RPC `initialize` POST and classify the\n * response according to the MCP authorization spec.\n *\n * Returns `{kind: \"mcp\"}` only when the endpoint either:\n *   - answers with 2xx (unauth-OK MCP server), or\n *   - responds 401 with a `Bearer` WWW-Authenticate challenge.\n *\n * Anything else (400, 404, 200-with-HTML, 200-with-GraphQL-errors, ...)\n * is classified `not-mcp`. Transport errors surface as `unreachable`.\n */\nexport const probeMcpEndpointShape = (\n  endpoint: string,\n  options: ProbeOptions = {},\n): Effect.Effect<McpShapeProbeResult> =>\n  Effect.gen(function* () {\n    const timeoutMs = options.timeoutMs ?? 8_000;\n    const outcome = yield* Effect.gen(function* () {\n      const client = yield* HttpClient.HttpClient;\n\n      const readBody = (response: {\n        readonly text: Effect.Effect<string, unknown>;\n      }): Effect.Effect<string> =>\n        response.text.pipe(\n          Effect.timeout(Duration.millis(timeoutMs)),\n          Effect.catch(() => Effect.succeed(\"\")),\n        );\n\n      const classify = (\n        response: {\n          readonly status: number;\n          readonly headers: Readonly<Record<string, string>>;\n          readonly text: Effect.Effect<string, unknown>;\n        },\n        method: \"GET\" | \"POST\",\n      ): Effect.Effect<McpShapeProbeResult | null> =>\n        Effect.gen(function* () {\n          const contentType = readHeader(response.headers, \"content-type\") ?? \"\";\n          const isSse = /^\\s*text\\/event-stream\\b/i.test(contentType);\n\n          if (response.status === 401) {\n            const wwwAuth = readHeader(response.headers, \"www-authenticate\");\n            if (!wwwAuth || !/^\\s*bearer\\b/i.test(wwwAuth)) {\n              // Spec-non-compliant 401 (no `Bearer` challenge). Before\n              // giving up, check whether the server still publishes\n              // RFC 9728 protected-resource metadata for this path —\n              // some real MCP servers (Datadog) do exactly this.\n              if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {\n                return { kind: \"mcp\", requiresAuth: true } as const;\n              }\n              return {\n                kind: \"not-mcp\",\n                category: \"auth-required\",\n                reason: \"401 without Bearer WWW-Authenticate — not an MCP auth challenge\",\n              } as const;\n            }\n            // Spec-compliant MCP signal: the auth spec mandates a\n            // `resource_metadata=` attribute pointing at the server's\n            // RFC 9728 document. Real OAuth-protected MCP servers\n            // (sentry.dev, etc.) include it. This attribute is rare on\n            // unrelated OAuth services and is the cleanest accept signal\n            // we have when the 401 body is RFC 6750 OAuth-shape rather\n            // than JSON-RPC.\n            if (/(?:^|[\\s,])resource_metadata\\s*=/i.test(wwwAuth)) {\n              return { kind: \"mcp\", requiresAuth: true } as const;\n            }\n            // Looser RFC 6750 §3.1 signal: the Bearer challenge carries\n            // `error=` / `error_description=` auth-params. Real MCP\n            // servers (Supabase, GitHub Copilot, Vercel, Neon, Tavily,\n            // Replicate, ...) include this even when they omit\n            // `resource_metadata=`. The body alone isn't enough for\n            // those — Supabase, e.g., returns `{\"message\":\"Unauthorized\"}`\n            // which is neither JSON-RPC nor RFC 6750. The `error=`\n            // auth-param is the tiebreaker.\n            if (/(?:^|[\\s,])error\\s*=/i.test(wwwAuth)) {\n              return { kind: \"mcp\", requiresAuth: true } as const;\n            }\n            // SSE responses can't carry a JSON-RPC error envelope; accept the\n            // Bearer challenge alone in that case (rare but spec-permissible).\n            if (isSse) return { kind: \"mcp\", requiresAuth: true } as const;\n            // Fallback for MCP servers whose 401 omits\n            // `resource_metadata=`. Two body shapes count:\n            //   - JSON-RPC error (cubic.dev: API-key auth, JSON-RPC\n            //     errors end-to-end).\n            //   - RFC 6750 OAuth Bearer error envelope `{error:\n            //     \"invalid_token\", ...}` without GraphQL `{errors:[...]}`\n            //     (Atlassian).\n            // Non-MCP OAuth-protected services that issue bare Bearer\n            // challenges (Railway-style GraphQL, etc.) return `errors`\n            // arrays or other shapes that fail both checks.\n            const body = yield* readBody(response);\n            if (!isJsonRpcEnvelope(body) && !isOAuthErrorBody(body)) {\n              // Bearer challenge with no usable accept signal. Same\n              // RFC 9728 fallback as the no-`Bearer` case above.\n              if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {\n                return { kind: \"mcp\", requiresAuth: true } as const;\n              }\n              return {\n                kind: \"not-mcp\",\n                category: \"auth-required\",\n                reason:\n                  \"401 + Bearer without resource_metadata, JSON-RPC body, or OAuth error body\",\n              } as const;\n            }\n            return { kind: \"mcp\", requiresAuth: true } as const;\n          }\n\n          if (response.status >= 200 && response.status < 300) {\n            if (method === \"GET\") {\n              if (!isSse) {\n                return {\n                  kind: \"not-mcp\",\n                  category: \"wrong-shape\",\n                  reason: \"GET response is not an SSE stream\",\n                } as const;\n              }\n              return { kind: \"mcp\", requiresAuth: false } as const;\n            }\n            // POST 2xx: SSE body is opaque to us; otherwise require a\n            // JSON-RPC envelope so we don't accept HTML/REST 200 responses.\n            if (isSse) return { kind: \"mcp\", requiresAuth: false } as const;\n            const body = yield* readBody(response);\n            if (!isJsonRpcEnvelope(body)) {\n              return {\n                kind: \"not-mcp\",\n                category: \"wrong-shape\",\n                reason: \"2xx POST body is not a JSON-RPC envelope\",\n              } as const;\n            }\n            return { kind: \"mcp\", requiresAuth: false } as const;\n          }\n\n          return null;\n        });\n\n      const url = new URL(endpoint);\n      for (const [key, value] of Object.entries(options.queryParams ?? {})) {\n        url.searchParams.set(key, value);\n      }\n\n      let postRequest = HttpClientRequest.post(url.toString()).pipe(\n        HttpClientRequest.setHeader(\"content-type\", \"application/json\"),\n        HttpClientRequest.setHeader(\"accept\", \"application/json, text/event-stream\"),\n        HttpClientRequest.bodyText(INITIALIZE_BODY, \"application/json\"),\n      );\n      for (const [name, value] of Object.entries(options.headers ?? {})) {\n        postRequest = HttpClientRequest.setHeader(postRequest, name, value);\n      }\n\n      const postResponse = yield* client\n        .execute(postRequest)\n        .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n\n      const postResult = yield* classify(postResponse, \"POST\");\n      if (postResult) return postResult;\n\n      if ([404, 405, 406, 415].includes(postResponse.status)) {\n        let getRequest = HttpClientRequest.get(url.toString()).pipe(\n          HttpClientRequest.setHeader(\"accept\", \"text/event-stream\"),\n        );\n        for (const [name, value] of Object.entries(options.headers ?? {})) {\n          getRequest = HttpClientRequest.setHeader(getRequest, name, value);\n        }\n        const getResponse = yield* client\n          .execute(getRequest)\n          .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n        const getResult = yield* classify(getResponse, \"GET\");\n        if (getResult) return getResult;\n      }\n\n      return {\n        kind: \"not-mcp\",\n        category: \"wrong-shape\",\n        reason: `unexpected status ${postResponse.status} for initialize`,\n      } as const;\n    }).pipe(\n      Effect.provide(options.httpClientLayer ?? FetchHttpClient.layer),\n      Effect.mapError(\n        (cause) =>\n          new ProbeTransportError({\n            reason: reasonFromBoundaryCause(cause),\n            cause,\n          }),\n      ),\n      Effect.catch((cause) =>\n        Effect.succeed<McpShapeProbeResult>({\n          kind: \"unreachable\",\n          reason: cause.reason,\n        }),\n      ),\n    );\n\n    return outcome;\n  }).pipe(Effect.withSpan(\"mcp.plugin.probe_shape\"));\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,SAAS,QAAQ,QAAQ,cAAc;AAEvC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAaA,IAAM,YAAY,aAAa;AAAA,EACpC,YAAY;AAAA,IACV,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,MAAM,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKvC,QAAQ,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA;AAAA;AAAA,MAGvC,WAAW;AAAA,QACT,MAAM,CAAC,QAAQ,UAAU,QAAQ;AAAA,QACjC,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA;AAAA,MAEA,kBAAkB,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MACpD,kBAAkB,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MACpD,oBAAoB,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA;AAAA,MAEtD,sBAAsB,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MACxD,qBAAqB;AAAA,QACnB,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,MACA,yBAAyB;AAAA,QACvB,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,MACA,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C;AAAA,EACF;AAAA,EACA,mBAAmB;AAAA,IACjB,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,WAAW,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACzD,MAAM,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACvC,MAAM,EAAE,MAAM,CAAC,QAAQ,SAAS,GAAG,UAAU,KAAK;AAAA,MAClD,YAAY,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MAC9C,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MAC5C,QAAQ,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,IAC5C;AAAA,EACF;AAAA,EACA,wBAAwB;AAAA,IACtB,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,WAAW,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACzD,MAAM,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACvC,MAAM,EAAE,MAAM,CAAC,QAAQ,SAAS,GAAG,UAAU,KAAK;AAAA,MAClD,YAAY,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MAC9C,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,MAC5C,QAAQ,EAAE,MAAM,UAAU,UAAU,MAAM;AAAA,IAC5C;AAAA,EACF;AAAA,EACA,aAAa;AAAA,IACX,QAAQ;AAAA,MACN,IAAI,EAAE,MAAM,UAAU,UAAU,KAAK;AAAA,MACrC,UAAU,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACxD,WAAW,EAAE,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAAA,MACzD,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,MACxC,YAAY,EAAE,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7C;AAAA,EACF;AACF,CAAC;AASD,IAAM,mBAAmB,OAAO,kBAAkB,mBAAmB;AACrE,IAAM,mBAAmB,OAAO,WAAW,mBAAmB;AAE9D,IAAM,gBAAgB,OAAO,kBAAkB,cAAc;AAC7D,IAAM,gBAAgB,OAAO,WAAW,cAAc;AACtD,IAAM,aAAa,OAAO,oBAAoB,OAAO,eAAe,OAAO,OAAO,CAAC;AAEnF,IAAM,aAAa,CAAC,UAA4B;AAC9C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,SAAO,OAAO,UAAU,WAAW,KAAK,GAAG,MAAM,KAAK;AACxD;AAcA,IAAM,gBAAgB,CAAC,SAAyC;AAC9D,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,WAAW;AAAA,MACX,kBAAkB,KAAK;AAAA,MACvB,kBAAkB,KAAK;AAAA,MACvB,oBAAoB,KAAK;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,WAAW;AAAA,MACX,sBAAsB,KAAK;AAAA,MAC3B,qBAAqB,KAAK;AAAA,MAC1B,yBAAyB,KAAK;AAAA,IAChC;AAAA,EACF;AACA,SAAO,EAAE,WAAW,OAAO;AAC7B;AAEA,IAAM,gBAAgB,CAAC,QAAoD;AACzE,QAAM,OAAO,IAAI;AACjB,MAAI,SAAS,YAAY,OAAO,IAAI,qBAAqB,UAAU;AACjE,UAAM,SAAS,IAAI;AACnB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAa,IAAI,oBAAsC;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,SAAS,YAAY,OAAO,IAAI,yBAAyB,UAAU;AACrE,UAAM,MAAM,IAAI;AAChB,UAAM,OAAO,IAAI;AACjB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,gBAAgB,IAAI;AAAA,MACpB,GAAI,MAAM,EAAE,cAAc,IAAI,IAAI,CAAC;AAAA,MACnC,GAAI,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;AAAA,IAC3C;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;AAgBA,IAAM,iBAAiB,CACrB,UACA,OACA,WACuC;AACvC,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,SAAO,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;AACnD,UAAM,KAAK,KAAK,UAAU,CAAC,UAAU,IAAI,CAAC;AAC1C,QAAI,OAAO,UAAU,UAAU;AAC7B,aAAO;AAAA,QACL;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,MAAM;AAAA,QACN,YAAY;AAAA,MACd;AAAA,IACF;AACA,WAAO;AAAA,MACL;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,IAChB;AAAA,EACF,CAAC;AACH;AAEA,IAAM,iBAAiB,CACrB,SACiD;AACjD,QAAM,MAAoD,CAAC;AAC3D,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,IAAI,SAAS,SAAU;AAClC,UAAM,OAAO,IAAI;AACjB,QAAI,IAAI,SAAS,aAAa,OAAO,IAAI,aAAa,UAAU;AAC9D,YAAM,SAAS,IAAI;AACnB,UAAI,IAAI,IAAI,SACR,4BAA4B,KAAK,EAAE,MAAM,WAAW,MAAM,IAAI,UAAU,OAAO,CAAC,IAChF,4BAA4B,KAAK,EAAE,MAAM,WAAW,MAAM,IAAI,SAAS,CAAC;AAAA,IAC9E,WAAW,IAAI,SAAS,UAAU,OAAO,IAAI,eAAe,UAAU;AACpE,UAAI,IAAI,IAAI,IAAI;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAsFO,IAAM,eAAe,CAAC,EAAE,SAAS,GAAG,MAA+C;AACxF,SAAO;AAAA,IACL,sBAAsB,CAAC,WAAW,UAChC,OAAO,IAAI,aAAa;AACtB,YAAM,OAAO,OAAO,GAAG,SAAS;AAAA,QAC9B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,aAAO,KAAK,IAAI,CAAC,SAAS;AAAA,QACxB,QAAQ,IAAI;AAAA,QACZ,SAAS,cAAc,WAAW,IAAI,OAAO,CAAC;AAAA,MAChD,EAAE;AAAA,IACJ,CAAC;AAAA,IAEH,YAAY,CAAC,QAAQ,UACnB,OAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,OAAO;AAAA,UAC7B,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,UAAU,cAAc,WAAW,IAAI,OAAO,CAAC;AACrD,aAAO,EAAE,SAAS,WAAW,IAAI,UAAU;AAAA,IAC7C,CAAC;AAAA,IAEH,aAAa,CAAC,WAAW,OAAO,YAC9B,OAAO,IAAI,aAAa;AACtB,UAAI,QAAQ,WAAW,EAAG;AAC1B,YAAM,MAAM,oBAAI,KAAK;AACrB,aAAO,GAAG,WAAW;AAAA,QACnB,OAAO;AAAA,QACP,MAAM,QAAQ,IAAI,CAAC,OAAO;AAAA,UACxB,IAAI,EAAE;AAAA,UACN,UAAU;AAAA,UACV,WAAW;AAAA,UACX,SAAS,cAAc,EAAE,OAAO;AAAA,UAChC,YAAY;AAAA,QACd,EAAE;AAAA,QACF,cAAc;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,IAEH,2BAA2B,CAAC,WAAW,UACrC,GACG,WAAW;AAAA,MACV,OAAO;AAAA,MACP,OAAO;AAAA,QACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,QACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,MACpC;AAAA,IACF,CAAC,EACA,KAAK,OAAO,MAAM;AAAA,IAEvB,WAAW,CAAC,WAAW,UACrB,OAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO;AAAA,QACL,WAAW,IAAI;AAAA,QACf,OAAO,IAAI;AAAA,QACX,MAAM,IAAI;AAAA,QACV,QAAQ,OAAO,kBAAkB,KAAK,WAAW,KAAK;AAAA,MACxD;AAAA,IACF,CAAC;AAAA,IAEH,iBAAiB,CAAC,WAAW,UAC3B,OAAO,IAAI,aAAa;AACtB,YAAM,MAAM,OAAO,GAAG,QAAQ;AAAA,QAC5B,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO,OAAO,kBAAkB,KAAK,WAAW,KAAK;AAAA,IACvD,CAAC;AAAA,IAEH,WAAW,CAAC,WACV,OAAO,IAAI,aAAa;AACtB,YAAM,MAAM,oBAAI,KAAK;AAGrB,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,OAAO,MAAM;AAAA,QAC3C;AAAA,MACF,CAAC;AACD,aAAO,qBAAqB,OAAO,WAAW,OAAO,KAAK;AAE1D,YAAM,OACJ,OAAO,OAAO,cAAc,WAAW,OAAO,OAAO,OAAO,EAAE,MAAM,OAAO;AAC7E,YAAM,WAAW,cAAc,IAAI;AACnC,YAAM,UAAU,OAAO,OAAO,cAAc,WAAW,OAAO,OAAO,UAAU;AAC/E,YAAM,cACJ,OAAO,OAAO,cAAc,WAAW,OAAO,OAAO,cAAc;AAMrE,YAAM,gBAAgB;AAAA,QACpB,iBAAiB,OAAO,MAAM;AAAA,MAChC;AAEA,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,MAAM;AAAA,UACJ,IAAI,OAAO;AAAA,UACX,UAAU,OAAO;AAAA,UACjB,MAAM,OAAO;AAAA,UACb,QAAQ;AAAA,UACR,YAAY;AAAA,UACZ,GAAG;AAAA,QACL;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AAED,YAAM,aAAa,eAAe,OAAO,WAAW,OAAO,OAAO,OAAO;AACzE,UAAI,WAAW,SAAS,GAAG;AACzB,eAAO,GAAG,WAAW;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,cAAc;AAAA,QAChB,CAAC;AAAA,MACH;AACA,YAAM,YAAY,eAAe,OAAO,WAAW,OAAO,OAAO,WAAW;AAC5E,UAAI,UAAU,SAAS,GAAG;AACxB,eAAO,GAAG,WAAW;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,cAAc;AAAA,QAChB,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,IAEH,cAAc,CAAC,WAAW,UACxB,OAAO,IAAI,aAAa;AACtB,aAAO,GAAG,WAAW;AAAA,QACnB,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,aAAO,qBAAqB,WAAW,KAAK;AAC5C,aAAO,GAAG,OAAO;AAAA,QACf,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,MAAM,OAAO,UAAU;AAAA,UAChC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACL;AAMA,WAAS,qBAAqB,WAAmB,OAAe;AAC9D,WAAO,OAAO,IAAI,aAAa;AAC7B,iBAAW,SAAS,CAAC,qBAAqB,wBAAwB,GAAY;AAC5E,eAAO,GAAG,WAAW;AAAA,UACnB;AAAA,UACA,OAAO;AAAA,YACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,YACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,UACpC;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,kBACP,KACA,WACA,OACoD;AACpD,WAAO,OAAO,IAAI,aAAa;AAK7B,YAAM,UAAU,WAAW,IAAI,MAAM;AACrC,UAAI,QAAQ,cAAc,UAAU;AAElC,eAAO,iBAAiB,OAAO;AAAA,MACjC;AACA,YAAM,aAAa,OAAO,GAAG,SAAS;AAAA,QACpC,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,YAAM,YAAY,OAAO,GAAG,SAAS;AAAA,QACnC,OAAO;AAAA,QACP,OAAO;AAAA,UACL,EAAE,OAAO,aAAa,OAAO,UAAU;AAAA,UACvC,EAAE,OAAO,YAAY,OAAO,MAAM;AAAA,QACpC;AAAA,MACF,CAAC;AACD,YAAM,UAAU,eAAe,UAAU;AACzC,YAAM,cAAc,eAAe,SAAS;AAC5C,YAAM,cAAc;AAAA,QAClB,GAAG;AAAA,QACH,GAAI,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,QACrD,GAAI,OAAO,KAAK,WAAW,EAAE,SAAS,IAAI,EAAE,YAAY,IAAI,CAAC;AAAA,QAC7D,MAAM,cAAc,GAAG;AAAA,MACzB;AACA,aAAO,iBAAiB,WAAW;AAAA,IACrC,CAAC;AAAA,EACH;AACF;AAMA,IAAM,uBAAuB,CAAC,YAA8D;AAC1F,MAAI,QAAQ,cAAc,SAAU,QAAO;AAC3C,QAAM,EAAE,MAAM,SAAS,aAAa,GAAG,KAAK,IAAI;AAChD,OAAK;AACL,OAAK;AACL,OAAK;AACL,SAAO;AACT;;;AC3jBA;AAAA,EACE,YAAAA;AAAA,EACA,UAAAC;AAAA,EACA,QAAAC;AAAA,EAEA;AAAA,EACA,UAAAC;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAAC;AAAA,OACK;AAKP;AAAA,EACE,+BAAAC;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAG1B;AAAA,OAEK;;;AC7BP,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAC9C,SAAS,mCAAmC;AAC5C,SAAS,UAAAC,eAAc;AA8CvB,IAAM,mBAAmB,CAAC,UAAkB,gBAA6C;AACvF,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,SAAO;AACT;AAQA,IAAM,eAAe,MACnB,IAAI;AAAA,EACF,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,EACzC;AAAA,IACE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE;AAAA,IACnD,qBAAqB,IAAI,4BAA4B;AAAA,EACvD;AACF;AAEF,IAAM,uBAAuB,CAAC,YAAmC;AAAA,EAC/D;AAAA,EACA,OAAO,MAAM,OAAO,MAAM;AAC5B;AAEA,IAAM,gBAAgB,CAAC,UAIrBC,QAAO,IAAI,aAAa;AACtB,QAAM,SAAS,aAAa;AAC5B,QAAM,oBAAoB,MAAM,gBAAgB;AAEhD,SAAOA,QAAO,WAAW;AAAA,IACvB,KAAK,MAAM,OAAO,QAAQ,iBAAiB;AAAA,IAC3C,OAAO,MACL,IAAI,mBAAmB;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,SAAS,yBAAyB,MAAM,SAAS;AAAA,IACnD,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACDA,QAAO,SAAS,mCAAmC;AAAA,MACjD,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,IACxD,CAAC;AAAA,EACH;AAEA,SAAO,qBAAqB,MAAM;AACpC,CAAC;AAMI,IAAM,qBAAqB,CAAC,UAAwC;AACzE,MAAI,MAAM,cAAc,SAAS;AAC/B,UAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAI,CAAC,SAAS;AACZ,aAAOA,QAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAOA,QAAO,IAAI,aAAa;AAG7B,YAAM,EAAE,qBAAqB,IAAI,OAAOA,QAAO,WAAW;AAAA,QACxD,KAAK,MAAM,OAAO,+BAAmB;AAAA,QACrC,OAAO,MACL,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACL,CAAC;AAED,aAAO,OAAO,cAAc;AAAA,QAC1B,WAAW;AAAA,QACX,iBAAiB,MACf,qBAAqB;AAAA,UACnB;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,KAAK,MAAM;AAAA,UACX,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,MAAM,IAAI,KAAK,IAAI;AAAA,QACrD,CAAC;AAAA,MACL,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAGA,QAAM,UAAU,MAAM,WAAW,CAAC;AAClC,QAAM,kBAAkB,MAAM,mBAAmB;AACjD,QAAM,cAAc,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI;AAEpE,QAAM,WAAW,iBAAiB,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC;AAEzE,QAAM,wBAAwB,cAAc;AAAA,IAC1C,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,8BAA8B,UAAU;AAAA,MAC1C;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,QAAM,aAAa,cAAc;AAAA,IAC/B,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,mBAAmB,UAAU;AAAA,MAC/B;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,MAAI,oBAAoB,kBAAmB,QAAO;AAClD,MAAI,oBAAoB,MAAO,QAAO;AAGtC,SAAO,sBAAsB,KAAKA,QAAO,MAAM,MAAM,UAAU,CAAC;AAClE;;;AC1KA,SAAS,UAAAC,eAAc;;;ACJvB,SAAS,UAAAC,SAAQ,UAAAC,eAAc;AA+B/B,IAAM,aAAaC,QAAO,OAAO;AAAA,EAC/B,MAAMA,QAAO;AAAA,EACb,aAAaA,QAAO,SAASA,QAAO,OAAOA,QAAO,MAAM,CAAC;AAAA,EACzD,aAAaA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC3C,YAAYA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC1C,cAAcA,QAAO,SAASA,QAAO,OAAO;AAAA,EAC5C,aAAaA,QAAO,SAAS,kBAAkB;AACjD,CAAC;AAED,IAAM,kBAAkBA,QAAO,OAAO;AAAA,EACpC,OAAOA,QAAO,MAAM,UAAU;AAChC,CAAC;AAED,IAAM,aAAaA,QAAO,OAAO;AAAA,EAC/B,MAAMA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,SAASA,QAAO,SAASA,QAAO,MAAM;AACxC,CAAC;AAED,IAAM,wBAAwBA,QAAO,oBAAoB,eAAe;AACxE,IAAM,mBAAmBA,QAAO,oBAAoB,UAAU;AAEvD,IAAM,oBAAoB,CAAC,UAChCC,QAAO,OAAO,sBAAsB,KAAK,CAAC;AAM5C,IAAM,WAAW,CAAC,UAA0B;AAC1C,QAAM,IAAI,MACP,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK;AACd;AAEA,IAAM,WAAW,CAAC,OAAe,SAAsC;AACrE,QAAM,OAAO,SAAS,KAAK;AAC3B,QAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK;AAClC,OAAK,IAAI,MAAM,CAAC;AAChB,SAAO,MAAM,IAAI,OAAO,GAAG,IAAI,IAAI,CAAC;AACtC;AASO,IAAM,qCAAqC,CAChD,iBACA,aACoB;AACpB,QAAM,OAAO,oBAAI,IAAoB;AAErC,QAAM,SAAS,sBAAsB,eAAe,EAAE;AAAA,IACpDC,QAAO,IAAI,CAAC,WAAW,OAAO,KAAK;AAAA,IACnCA,QAAO,UAAU,MAAM,CAAC,CAAC;AAAA,EAC3B;AAEA,QAAM,SAAS,iBAAiB,UAAU,UAAU,EAAE;AAAA,IACpDA,QAAO;AAAA,MACL,CAAC,UAA6B;AAAA,QAC5B,MAAM,KAAK,QAAQ;AAAA,QACnB,SAAS,KAAK,WAAW;AAAA,MAC3B;AAAA,IACF;AAAA,IACAA,QAAO;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,QAAQ,CAAC,SAAiC;AAC7D,UAAM,WAAW,KAAK,KAAK,KAAK;AAChC,QAAI,CAAC,SAAU,QAAO,CAAC;AAEvB,WAAO;AAAA,MACL;AAAA,QACE,QAAQ,SAAS,UAAU,IAAI;AAAA,QAC/B;AAAA,QACA,aAAa,KAAK,eAAe;AAAA,QACjC,aAAa,KAAK,eAAe,KAAK;AAAA,QACtC,cAAc,KAAK;AAAA,QACnB,aAAa,KAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,MAAM;AACzB;AAMA,IAAM,UAAU,CAAC,UACf,MACG,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAE3B,IAAM,aAAa,CAAC,QAA+B;AACjD,MAAI,CAAC,IAAI,SAAS,GAAG,EAAG,QAAO;AAC/B,SAAO,IAAI,IAAI,GAAG,EAAE;AACtB;AAEA,IAAM,aAAa,CAAC,SAAyB,KAAK,KAAK,EAAE,MAAM,OAAO,EAAE,IAAI,KAAK,KAAK,KAAK;AAEpF,IAAM,qBAAqB,CAAC,UAIrB;AACZ,MAAI,MAAM,MAAM,KAAK,EAAG,QAAO,QAAQ,MAAM,IAAI,KAAK;AAEtD,QAAM,eAAe,MAAM,UAAU,KAAK,IAAI,WAAW,MAAM,QAAQ,IAAI;AAC3E,MAAI,aAAc,QAAO,QAAQ,YAAY,KAAK;AAElD,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO,QAAQ,WAAW,MAAM,OAAO,CAAC,KAAK;AAExE,SAAO;AACT;;;ADlIO,IAAM,gBAAgB,CAC3B,cAEAC,QAAO,IAAI,aAAa;AAEtB,QAAM,aAAa,OAAO,UAAU;AAAA,IAClCA,QAAO;AAAA,MACL,CAAC,EAAE,QAAQ,MACT,IAAI,sBAAsB;AAAA,QACxB,OAAO;AAAA,QACP,SAAS,oCAAoC,OAAO;AAAA,MACtD,CAAC;AAAA,IACL;AAAA,EACF;AAGA,QAAM,aAAa,OAAOA,QAAO,WAAW;AAAA,IAC1C,KAAK,MAAM,WAAW,OAAO,UAAU;AAAA,IACvC,OAAO,MACL,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC;AAED,MAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,WAAO,gBAAgB,UAAU;AACjC,WAAO,OAAO,IAAI,sBAAsB;AAAA,MACtC,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,mCAAmC,YAAY;AAAA,IAC9D,YAAY,WAAW,OAAO,mBAAmB;AAAA,EACnD,CAAC;AAGD,SAAO,gBAAgB,UAAU;AAEjC,SAAO;AACT,CAAC;AAEH,IAAM,kBAAkB,CAAC,eAGvBA,QAAO;AAAA,EACLA,QAAO,WAAW;AAAA,IAChB,KAAK,MAAM,WAAW,MAAM;AAAA,IAC5B,OAAO,MACL,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC;AACH;;;AEjEF,SAAS,OAAO,UAAAC,SAAQ,MAAM,UAAAC,SAAQ,WAAW,UAAAC,SAAQ,mBAAmB;AAE5E,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAUP,IAAM,aAAaC,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAC9D,IAAM,mBAAmBA,QAAO,oBAAoB,UAAU;AAE9D,IAAM,aAAa,CAAC,UAClBC,QAAO,UAAU,iBAAiB,KAAK,GAAG,OAAO,CAAC,EAAE;AAEtD,IAAM,aAAa,CAAC,UAA2B;AAC7C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,UAAU,EAAE,KAAK,GAAG,CAAC;AACpE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,IAAI,OAAO,QAAQ,KAAgC,EACvD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,WAAW,KAAK,CAAC,EAAE,EACnE,KAAK,GAAG,CAAC;AAAA,EACd;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,IAAM,cAAc,CAAC,UAA2B;AAC9C,QAAM,QAAQ,WAAW,KAAK;AAC9B,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAQ,MAAM,WAAW,CAAC;AAC1B,WAAO,KAAK,KAAK,MAAM,QAAU;AAAA,EACnC;AACA,UAAQ,SAAS,GAAG,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAClD;AAEA,IAAM,qBAAqB,CAAC,UAKd;AACZ,QAAM,KAAK,MAAM;AACjB,SAAO,GAAG,cAAc,UACpB,SAAS,YAAY;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,aAAa,MAAM;AAAA,IACnB,SAAS,GAAG;AAAA,IACZ,MAAM,GAAG,QAAQ,CAAC;AAAA,IAClB,KAAK,GAAG,OAAO,CAAC;AAAA,IAChB,KAAK,GAAG,OAAO;AAAA,EACjB,CAAC,CAAC,KACF,UAAU,YAAY;AAAA,IACpB,UAAU,MAAM;AAAA,IAChB,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,UAAU,GAAG;AAAA,IACb,iBAAiB,GAAG,mBAAmB;AAAA,IACvC,SAAS,GAAG,WAAW,CAAC;AAAA,IACxB,aAAa,GAAG,eAAe,CAAC;AAAA,IAChC,MAAM,GAAG;AAAA,EACX,CAAC,CAAC;AACR;AAOA,IAAM,kBAAkBD,QAAO,MAAM;AAAA,EACnCA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,QAAQ,KAAK;AAAA,IAC1B,SAASA,QAAO;AAAA,IAChB,KAAKA,QAAO;AAAA,IACZ,eAAeA,QAAO,SAASA,QAAO,MAAM;AAAA,IAC5C,IAAIA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,CAAC;AAAA,EACDA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,SAASA,QAAO,QAAQ,MAAM,CAAC;AAAA,IAC5C,SAASA,QAAO;AAAA,IAChB,iBAAiBA,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAAA,EAC9D,CAAC;AACH,CAAC;AAGD,IAAM,qBAAqBA,QAAO,kBAAkB,eAAe;AAEnE,IAAM,uBAAuB,CAAC,WAC5B,OAAO,SAAS,QACZ,eAAe,KAAK;AAAA,EAClB,SAAS,OAAO;AAAA,EAChB,KAAK,OAAO;AAAA,EACZ,eAAe,OAAO,iBAAiB,OAAO,MAAM;AACtD,CAAC,IACD,gBAAgB,KAAK;AAAA,EACnB,SAAS,OAAO;AAAA,EAChB,iBAAiB,OAAO;AAC1B,CAAC;AAEP,IAAM,4BAA4B,CAAC,QAAiC,WAAyB;AAC3F,SAAO,kBAAkB,qBAAqB,OAAO,YAAiC;AACpF,UAAM,SAAS,mBAAmB,QAAQ,MAAM;AAChD,UAAM,MAAM,qBAAqB,MAAM;AAKvC,UAAM,OAAO,MAAME,QAAO,eAAe,OAAO,GAAG,CAAC;AACpD,QAAI,KAAK,UAAU,IAAI,GAAG;AACxB,YAAM,WAAW,KAAK;AACtB,aAAO;AAAA,QACL,QAAQ,SAAS;AAAA,QACjB,GAAI,SAAS,WAAW,YAAY,SAAS,UAAU,EAAE,SAAS,SAAS,QAAQ,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,YAAY;AAC1D,QAAI,SAAS;AACX,YAAM,MAAM,QAAQ;AACpB,UAAI,UAAU,SAAS,KAAK,0BAA0B,GAAG;AACvD,cAAM,SACJ,UAAU,YAAY,KAAK,QAAQ,KAAK,IAAI,WAAW,WAAW,WAAW;AAC/E,eAAO,EAAE,OAAO;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,MAAM,OAAO,KAAK,KAAK;AAAA,EAC/B,CAAC;AACH;AAMA,IAAM,gBAAgB,CACpB,YACA,UACA,MACA,WAEAA,QAAO,IAAI,aAAa;AACtB,4BAA0B,WAAW,QAAQ,MAAM;AACnD,SAAO,OAAOA,QAAO,WAAW;AAAA,IAC9B,KAAK,MAAM,WAAW,OAAO,SAAS,EAAE,MAAM,UAAU,WAAW,KAAK,CAAC;AAAA,IACzE,OAAO,MACL,IAAI,mBAAmB;AAAA,MACrB;AAAA,MACA,SAAS,4BAA4B,QAAQ;AAAA,IAC/C,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACDA,QAAO,SAAS,+BAA+B;AAAA,MAC7C,YAAY,EAAE,iBAAiB,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AACF,CAAC;AAuBI,IAAM,gBAAgB,CAC3B,UACoE;AACpE,QAAM,YACJ,MAAM,WAAW,cAAc,UAAU,UAAW,MAAM,WAAW,mBAAmB;AAC1F,SAAOA,QAAO,IAAI,aAAa;AAC7B,UAAM,WAAW,mBAAmB,KAAK;AACzC,UAAM,OAAO,WAAW,MAAM,IAAI;AAIlC,UAAM,YAAY,MAAM,iBAAiB;AACzC,UAAM,kBAAkB,IAAI,UAAU,SAAS;AAO/C,UAAM,WAAW,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ;AAEvE,UAAM,kBAAkB,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ,EAAE;AAAA,MAC9EA,QAAO,SAAS,iCAAiC;AAAA,QAC/C,YAAY;AAAA,UACV,wBAAwB;AAAA,UACxB,wBAAwB;AAAA,UACxB,sBAAsB;AAAA,UACtB,wBAAwB;AAAA,QAC1B;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO,OAAO,cAAc,iBAAiB,MAAM,UAAU,MAAM,MAAM,MAAM,EAAE;AAAA;AAAA;AAAA,MAG/EA,QAAO;AAAA,QAAM,MACXA,QAAO,IAAI,aAAa;AACtB,iBAAO,YAAY,WAAW,MAAM,iBAAiB,QAAQ;AAC7D,gBAAM,kBAAkB,IAAI,UAAU,SAAS;AAC/C,gBAAM,QAAQ,OAAO,YAAY,IAAI,MAAM,iBAAiB,QAAQ;AACpE,iBAAO,OAAO,cAAc,OAAO,MAAM,UAAU,MAAM,MAAM,MAAM;AAAA,QACvE,CAAC,EAAE;AAAA,UACDA,QAAO,SAAS,2BAA2B;AAAA,YACzC,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB;AAAA,cACxB,iBAAiB,MAAM;AAAA,YACzB;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC,EAAE;AAAA,IACDA,QAAO;AAAA,IACPA,QAAO,SAAS,qBAAqB;AAAA,MACnC,YAAY;AAAA,QACV,iBAAiB,MAAM;AAAA,QACvB,sBAAsB,MAAM;AAAA,QAC5B,wBAAwB;AAAA,MAC1B;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;AChOA,SAAS,MAAM,UAAU,UAAAC,SAAe,UAAAC,SAAQ,UAAAC,eAAc;AAC9D,SAAS,iBAAiB,YAAY,yBAAyB;AAQ/D,IAAM,kBAAkB,KAAK,UAAU;AAAA,EACrC,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,QAAQ;AAAA,EACR,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,MAAM,kBAAkB,SAAS,IAAI;AAAA,EACrD;AACF,CAAC;AAKD,IAAM,aAAa,CAAC,SAA2C,SAAgC;AAC7F,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,QAAQ,KAAK,YAAY;AAC/B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,QAAI,EAAE,YAAY,MAAM,MAAO,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,sBAAN,cAAkC,KAAK,YAAY,qBAAqB,EAGrE;AAAC;AAEJ,IAAM,mBAAmBA,QAAO,oBAAoBA,QAAO,eAAeA,QAAO,OAAO,CAAC;AAEzF,IAAM,WAAW,CAAC,SAAiD;AACjE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,iBAAiB,IAAI;AACpC,MAAID,QAAO,OAAO,MAAM,EAAG,QAAO;AAClC,QAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,SAAO;AACT;AAOA,IAAM,oBAAoB,CAAC,SAA0B;AACnD,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,YAAY,MAAO,QAAO;AAClC,SAAO,YAAY,OAAO,WAAW,OAAO,YAAY;AAC1D;AAQA,IAAM,mBAAmB,CAAC,SAA0B;AAClD,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAG,QAAO;AACtC,SAAO,OAAO,IAAI,UAAU;AAC9B;AAMA,IAAM,4BAA4BC,QAAO,OAAO;AAAA,EAC9C,UAAUA,QAAO;AAAA,EACjB,uBAAuBA,QAAO,MAAMA,QAAO,MAAM;AACnD,CAAC;AACD,IAAM,kCAAkCA,QAAO;AAAA,EAC7CA,QAAO,eAAe,yBAAyB;AACjD;AAOA,IAAM,+BAA+B,CAAC,aAA0B;AAC9D,QAAM,OAAO,SAAS,aAAa,MAAM,KAAK,SAAS;AACvD,SAAO,GAAG,SAAS,MAAM,wCAAwC,IAAI;AACvE;AAOA,IAAM,0BAA0B,CAAC,UAAkB,aAA2B;AAC5E,MAAI,CAAC,IAAI,SAAS,QAAQ,EAAG,QAAO;AACpC,QAAM,SAAS,IAAI,IAAI,QAAQ;AAC/B,MAAI,OAAO,WAAW,SAAS,OAAQ,QAAO;AAC9C,QAAM,eAAe,OAAO,SAAS,QAAQ,QAAQ,EAAE;AACvD,QAAM,eAAe,SAAS,SAAS,QAAQ,QAAQ,EAAE;AACzD,SAAO,iBAAiB,gBAAgB,aAAa,WAAW,GAAG,YAAY,GAAG;AACpF;AAcA,IAAM,iCAAiC,CACrC,QACA,UACA,cAEAF,QAAO,IAAI,aAAa;AACtB,QAAM,WAAW,OAAO,OACrB;AAAA,IACC,kBAAkB,IAAI,6BAA6B,QAAQ,CAAC,EAAE;AAAA,MAC5D,kBAAkB,UAAU,UAAU,kBAAkB;AAAA,IAC1D;AAAA,EACF,EACC,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAClD,MAAI,SAAS,SAAS,OAAO,SAAS,UAAU,IAAK,QAAO;AAC5D,QAAM,OAAO,OAAO,SAAS,KAAK;AAAA,IAChCA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC;AAAA,IACzCA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,CAAC;AAAA,EACvC;AACA,QAAM,WAAW,gCAAgC,IAAI;AACrD,MAAIC,QAAO,OAAO,QAAQ,EAAG,QAAO;AACpC,MAAI,SAAS,MAAM,sBAAsB,WAAW,EAAG,QAAO;AAC9D,SAAO,wBAAwB,SAAS,MAAM,UAAU,QAAQ;AAClE,CAAC,EAAE,KAAKD,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC,CAAC;AAEnD,IAAM,oBAAoBE,QAAO,OAAO,EAAE,SAASA,QAAO,OAAO,CAAC;AAClE,IAAM,0BAA0BA,QAAO,oBAAoB,iBAAiB;AAE5E,IAAM,0BAA0B,CAAC,UAA2B;AAC1D,QAAM,eAAe,wBAAwB,KAAK;AAClD,MAAID,QAAO,OAAO,YAAY,EAAG,QAAO,aAAa,MAAM;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,GAAG,KAAK;AAAA,EACjB;AACA,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,eAAe;AAC3D,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,YAAa,QAAO;AACzC,SAAO;AACT;AAiDO,IAAM,wBAAwB,CACnC,UACA,UAAwB,CAAC,MAEzBD,QAAO,IAAI,aAAa;AACtB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,UAAU,OAAOA,QAAO,IAAI,aAAa;AAC7C,UAAM,SAAS,OAAO,WAAW;AAEjC,UAAM,WAAW,CAAC,aAGhB,SAAS,KAAK;AAAA,MACZA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC;AAAA,MACzCA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,CAAC;AAAA,IACvC;AAEF,UAAM,WAAW,CACf,UAKA,WAEAA,QAAO,IAAI,aAAa;AACtB,YAAM,cAAc,WAAW,SAAS,SAAS,cAAc,KAAK;AACpE,YAAM,QAAQ,4BAA4B,KAAK,WAAW;AAE1D,UAAI,SAAS,WAAW,KAAK;AAC3B,cAAM,UAAU,WAAW,SAAS,SAAS,kBAAkB;AAC/D,YAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAK9C,cAAI,OAAO,+BAA+B,QAAQ,KAAK,SAAS,GAAG;AACjE,mBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,UAC3C;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,UACV;AAAA,QACF;AAQA,YAAI,oCAAoC,KAAK,OAAO,GAAG;AACrD,iBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,QAC3C;AASA,YAAI,wBAAwB,KAAK,OAAO,GAAG;AACzC,iBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,QAC3C;AAGA,YAAI,MAAO,QAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAWpD,cAAM,OAAO,OAAO,SAAS,QAAQ;AACrC,YAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC,iBAAiB,IAAI,GAAG;AAGvD,cAAI,OAAO,+BAA+B,QAAQ,KAAK,SAAS,GAAG;AACjE,mBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,UAC3C;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QACE;AAAA,UACJ;AAAA,QACF;AACA,eAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,MAC3C;AAEA,UAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,YAAI,WAAW,OAAO;AACpB,cAAI,CAAC,OAAO;AACV,mBAAO;AAAA,cACL,MAAM;AAAA,cACN,UAAU;AAAA,cACV,QAAQ;AAAA,YACV;AAAA,UACF;AACA,iBAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,QAC5C;AAGA,YAAI,MAAO,QAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AACrD,cAAM,OAAO,OAAO,SAAS,QAAQ;AACrC,YAAI,CAAC,kBAAkB,IAAI,GAAG;AAC5B,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,UACV;AAAA,QACF;AACA,eAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,MAC5C;AAEA,aAAO;AAAA,IACT,CAAC;AAEH,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,eAAe,CAAC,CAAC,GAAG;AACpE,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,cAAc,kBAAkB,KAAK,IAAI,SAAS,CAAC,EAAE;AAAA,MACvD,kBAAkB,UAAU,gBAAgB,kBAAkB;AAAA,MAC9D,kBAAkB,UAAU,UAAU,qCAAqC;AAAA,MAC3E,kBAAkB,SAAS,iBAAiB,kBAAkB;AAAA,IAChE;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AACjE,oBAAc,kBAAkB,UAAU,aAAa,MAAM,KAAK;AAAA,IACpE;AAEA,UAAM,eAAe,OAAO,OACzB,QAAQ,WAAW,EACnB,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAElD,UAAM,aAAa,OAAO,SAAS,cAAc,MAAM;AACvD,QAAI,WAAY,QAAO;AAEvB,QAAI,CAAC,KAAK,KAAK,KAAK,GAAG,EAAE,SAAS,aAAa,MAAM,GAAG;AACtD,UAAI,aAAa,kBAAkB,IAAI,IAAI,SAAS,CAAC,EAAE;AAAA,QACrD,kBAAkB,UAAU,UAAU,mBAAmB;AAAA,MAC3D;AACA,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AACjE,qBAAa,kBAAkB,UAAU,YAAY,MAAM,KAAK;AAAA,MAClE;AACA,YAAM,cAAc,OAAO,OACxB,QAAQ,UAAU,EAClB,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAClD,YAAM,YAAY,OAAO,SAAS,aAAa,KAAK;AACpD,UAAI,UAAW,QAAO;AAAA,IACxB;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,qBAAqB,aAAa,MAAM;AAAA,IAClD;AAAA,EACF,CAAC,EAAE;AAAA,IACDA,QAAO,QAAQ,QAAQ,mBAAmB,gBAAgB,KAAK;AAAA,IAC/DA,QAAO;AAAA,MACL,CAAC,UACC,IAAI,oBAAoB;AAAA,QACtB,QAAQ,wBAAwB,KAAK;AAAA,QACrC;AAAA,MACF,CAAC;AAAA,IACL;AAAA,IACAA,QAAO;AAAA,MAAM,CAAC,UACZA,QAAO,QAA6B;AAAA,QAClC,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT,CAAC,EAAE,KAAKA,QAAO,SAAS,wBAAwB,CAAC;;;AL5WnD;AAAA,EACE;AAAA,OAMK;AA+EP,IAAM,qBAAqB,CACzB,QACA,sBAKwB;AACxB,MAAI,OAAO,cAAc,SAAS;AAChC,WAAO;AAAA,MACL,WAAW;AAAA,MACX,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C,aAAa,mBAAmB;AAAA,IAChC,SAAS,mBAAmB;AAAA,IAC5B,MAAM,mBAAmB,QAAQ,EAAE,MAAM,OAAO;AAAA,EAClD;AACF;AAEA,IAAM,qBAAqB,CAAC,WAC1B,OAAO,aACP,mBAAmB;AAAA,EACjB,MAAM,OAAO;AAAA,EACb,UAAU,OAAO,cAAc,WAAW,OAAO,WAAW;AAAA,EAC5D,SAAS,OAAO,cAAc,UAAU,OAAO,UAAU;AAC3D,CAAC;AAEH,IAAM,YAAY,CAAC,UACjB,eAAe,KAAK;AAAA,EAClB,QAAQ,MAAM;AAAA,EACd,UAAU,MAAM;AAAA,EAChB,aAAa,MAAM;AAAA,EACnB,aAAa,MAAM;AAAA,EACnB,cAAc,MAAM;AAAA,EACpB,aAAa,MAAM;AACrB,CAAC;AAEH,IAAM,gBAAgB;AAOtB,IAAM,kBAAkB,CAAC,KAAU,UAA2B;AAC5D,QAAM,KAAK,IAAI,OAAO,kBAAkB,KAAK,mBAAmB,GAAG;AACnE,SAAO,GAAG,KAAK,IAAI,QAAQ,KAAK,GAAG,KAAK,IAAI,QAAQ;AACtD;AAMO,IAAM,yBAAyB,CACpC,UACW;AACX,MAAI,MAAM,SAAS,eAAe;AAChC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,MAAM,MAAM,QAAQ,EAAE;AAAA,IACjC,MAAM;AAAA,MACJ;AAAA,MACA,MACE;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,MACE;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,EACR;AACF;AAEA,IAAM,aAAa,CAAC,QAClB,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,UAAU,CAAC,OAAO,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;AAErE,IAAM,YAAY,CAAC,OAAoC,YACrD,MAAM,IAAI,OAAO,KAAK;AAExB,IAAM,0BAA0B,CAAC,YAC/B,oBAAoB,KAAK;AAAA,EACvB,UAAU,QAAQ;AAAA,EAClB,eAAe,QAAQ;AAAA,EACvB,SAAS,QAAQ;AAAA,EACjB,MAAM,QAAQ;AAAA,EACd,OAAO,QAAQ;AAAA,EACf,WAAW,QAAQ;AAAA,EACnB,WAAW,QAAQ;AACrB,CAAC;AAEH,IAAM,wBAAwB,CAC5B,KACA,UACA,gBAEAG,QAAO,IAAI,aAAa;AACtB,QAAM,QAAQ,WAAW,GAAG;AAC5B,QAAM,mBAAmB,UAAU,OAAO,WAAW;AACrD,MAAI,qBAAqB,SAAU,QAAO,CAAC;AAC3C,QAAM,WAAW,OAAO,IAAI,mBAAmB,cAAc;AAAA,IAC3D,UAAU;AAAA,IACV;AAAA,IACA,aAAa,QAAQ,KAAK,WAAW;AAAA,EACvC,CAAC;AACD,SAAO,SACJ,OAAO,CAAC,YAAY,UAAU,OAAO,QAAQ,OAAO,KAAK,gBAAgB,EACzE,IAAI,uBAAuB;AAChC,CAAC;AAEH,IAAM,0BAA0B,CAC9B,KACA,UACA,aACA,SAEAA,QAAO,IAAI,aAAa;AACtB,QAAM,QAAQ,WAAW,GAAG;AAC5B,QAAM,mBAAmB,UAAU,OAAO,WAAW;AACrD,MAAI,qBAAqB,SAAU,QAAO;AAC1C,QAAM,WAAW,OAAO,IAAI,mBAAmB,cAAc;AAAA,IAC3D,UAAU;AAAA,IACV;AAAA,IACA,aAAa,QAAQ,KAAK,WAAW;AAAA,EACvC,CAAC;AACD,QAAM,UAAU,SACb;AAAA,IACC,CAAC,cACC,UAAU,YAAY,QAAQ,UAAU,OAAO,UAAU,OAAO,KAAK;AAAA,EACzE,EACC,KAAK,CAAC,GAAG,MAAM,UAAU,OAAO,EAAE,OAAO,IAAI,UAAU,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;AAC9E,SAAO,UAAU,wBAAwB,OAAO,IAAI;AACtD,CAAC;AAEH,IAAM,2BAA2B,CAC/B,KACA,UAMAA,QAAO,IAAI,aAAa;AACtB,QAAM,QAAQ,WAAW,GAAG;AAC5B,QAAM,mBAAmB,UAAU,OAAO,MAAM,WAAW;AAC3D,QAAM,aAAa,UAAU,OAAO,MAAM,WAAW;AACrD,QAAM,YAAY,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,IAAI,CAAC;AAC5D,MAAI,qBAAqB,UAAU;AACjC,WAAO,OAAO,IAAI,aAAa;AAAA,MAC7B,SACE,+CAA+C,MAAM,WAAW,gDAClB,SAAS;AAAA,MACzD,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,eAAe,UAAU;AAC3B,WAAO,OAAO,IAAI,aAAa;AAAA,MAC7B,SACE,qCAAqC,MAAM,WAAW,gDACrB,SAAS;AAAA,MAC5C,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,aAAa,kBAAkB;AACjC,WAAO,OAAO,IAAI,aAAa;AAAA,MAC7B,SACE,4BAA4B,MAAM,QAAQ,uCAC1B,MAAM,WAAW,uCAC7B,MAAM,WAAW;AAAA,MACvB,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF,CAAC;AAEH,IAAM,qBAAqB,CACzB,aACA,aAC0D;AAC1D,MAAI,SAAS,WAAW,EAAG,QAAOA,QAAO,QAAQ,MAAS;AAC1D,MAAI,YAAa,QAAOA,QAAO,QAAQ,WAAW;AAClD,SAAOA,QAAO;AAAA,IACZ,IAAI,mBAAmB;AAAA,MACrB,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,IAAM,wBAAwB,CAC5B,qBACA,YAC8C;AAC9C,QAAM,cAAc,QAAQ,eAAe;AAC3C,MAAI,YAAa,QAAOA,QAAO,QAAQ,WAAW;AAClD,SAAOA,QAAO;AAAA,IACZ,IAAI,mBAAmB;AAAA,MACrB,WAAW;AAAA,MACX,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAEA,IAAM,4BAA4B,CAChC,QACA,gBAQG;AACH,QAAM,aAA2D,CAAC;AAClE,QAAM,WAAwF,CAAC;AAC/F,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,UAAU,CAAC,CAAC,GAAG;AACxD,QAAI,OAAO,UAAU,UAAU;AAC7B,iBAAW,IAAI,IAAI;AACnB;AAAA,IACF;AACA,QAAI,UAAU,OAAO;AACnB,iBAAW,IAAI,IAAI;AACnB;AAAA,IACF;AACA,UAAM,OAAO,YAAY,IAAI;AAC7B,eAAW,IAAI,IAAIC,6BAA4B,KAAK;AAAA,MAClD,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,MAAM;AAAA,IAChB,CAAC;AACD,aAAS,KAAK;AAAA,MACZ;AAAA,MACA,aAAa,iBAAiB,QAAQ,MAAM,cAAc;AAAA,MAC1D,OAAO;AAAA,QACL,MAAM;AAAA,QACN,UAAU,SAAS,KAAK,MAAM,QAAQ;AAAA,QACtC,GAAI,mBAAmB,SAAS,MAAM,gBAClC,EAAE,eAAe,MAAM,cAAc,IACrC,CAAC;AAAA,MACP;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,EAAE,QAAQ,YAAY,SAAS;AACxC;AAEA,IAAM,mBAAmB,CACvB,SAQG;AACH,MAAI,CAAC,QAAQ,KAAK,SAAS,OAAQ,QAAO,EAAE,MAAM,EAAE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE;AACjF,MAAI,KAAK,SAAS,UAAU;AAC1B,QAAI,gBAAgB,KAAM,QAAO,EAAE,MAAM,UAAU,CAAC,EAAE;AACtD,WAAO;AAAA,MACL,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,YAAY,KAAK;AAAA,QACjB,YAAY;AAAA,QACZ,QAAQ,KAAK;AAAA,MACf;AAAA,MACA,UAAU;AAAA,QACR;AAAA,UACE,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,UAClB,OAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU,SAAS,KAAK,KAAK,QAAQ;AAAA,YACrC,GAAI,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,UACpE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,oBAAoB,KAAM,QAAO,EAAE,MAAM,UAAU,CAAC,EAAE;AAC1D,QAAM,WAAwF;AAAA,IAC5F;AAAA,MACE,MAAM;AAAA,MACN,OAAO;AAAA,QACL,MAAM;AAAA,QACN,cAAc,aAAa,KAAK,KAAK,YAAY;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,kBAAkB;AACzB,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,UAAU,UAAU,SAAS,KAAK,KAAK,gBAAgB,EAAE;AAAA,IAC1E,CAAC;AAAA,EACH;AACA,MAAI,KAAK,sBAAsB;AAC7B,aAAS,KAAK;AAAA,MACZ,MAAM;AAAA,MACN,OAAO,EAAE,MAAM,UAAU,UAAU,SAAS,KAAK,KAAK,oBAAoB,EAAE;AAAA,IAC9E,CAAC;AAAA,EACH;AACA,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,MAAM;AAAA,MACN,gBAAgB;AAAA,MAChB,GAAI,KAAK,mBAAmB,EAAE,cAAc,yBAAyB,IAAI,CAAC;AAAA,MAC1E,GAAI,KAAK,uBAAuB,EAAE,kBAAkB,6BAA6B,IAAI,CAAC;AAAA,IACxF;AAAA,IACA;AAAA,EACF;AACF;AAcA,IAAM,oBAAoB,CAAC,iBAA8C;AAAA,EACvE,IAAI,cAAc;AAChB,WAAO;AAAA,EACT;AAAA,EACA,IAAI,iBAAiB;AACnB,WAAO;AAAA,MACL,eAAe,CAAC,iCAAiC;AAAA,MACjD,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,mBAAmB,MAAM;AAAA,EACzB,uBAAuB,MAAM;AAAA,EAC7B,QAAQ,OAAO,EAAE,cAAc,aAAa,YAAY,SAAS;AAAA,EACjE,YAAY,MAAM;AAAA,EAClB,yBAAyB,YAAY;AAEnC,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAAA,EACA,kBAAkB,MAAM;AAAA,EACxB,cAAc,MAAM;AAElB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EACA,oBAAoB,MAAM;AAAA,EAC1B,gBAAgB,MAAM;AACxB;AAEA,IAAM,yBAAyB,CAC7B,QACA,QAEA,6BAA6B;AAAA,EAC3B;AAAA,EACA,WAAW,IAAI,QAAQ;AAAA,EACvB,WAAW,CAAC,OAAO,UACjB,IAAI,mBAAmB;AAAA,IACrB,WAAW;AAAA,IACX,SAAS,6BAA6B,MAAM,QAAQ;AAAA,EACtD,CAAC;AAAA,EACH,SAAS,CAAC,KAAK,OAAO,UACpBC,WAAU,SAAS,8BAA8B,EAAE,GAAG,IAClD,IAAI,mBAAmB;AAAA,IACrB,WAAW;AAAA,IACX,SAAS,6BAA6B,MAAM,QAAQ;AAAA,EACtD,CAAC,IACD;AACR,CAAC,EAAE;AAAA,EACDF,QAAO;AAAA,IAAS,CAAC,QACfE,WAAU,SAAS,8BAA8B,EAAE,GAAG,IAClD,IAAI,mBAAmB,EAAE,WAAW,UAAU,SAAS,2BAA2B,CAAC,IACnF;AAAA,EACN;AACF;AAEF,IAAM,iBAAiB,CACrB,WACuC;AACvC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,QAAQ,MAAM,EAAE;AAAA,IACrC,CAAC,UAAqC,OAAO,MAAM,CAAC,MAAM;AAAA,EAC5D;AACA,SAAO,QAAQ,SAAS,IAAI,OAAO,YAAY,OAAO,IAAI;AAC5D;AAEA,IAAM,4BAA4B,CAChC,KACA,QACA,WAOAF,QAAO,IAAI,aAAa;AACtB,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,WAAmC,CAAC;AAC1C,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,OAAO,UAAU,UAAU;AAC7B,eAAS,IAAI,IAAI;AACjB;AAAA,IACF;AACA,UAAM,UAAU,OAAO;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,MACP,MAAM;AAAA,IACR;AACA,QAAI,SAAS,MAAM,SAAS,UAAU;AACpC,YAAM,SAAS,OAAO,IAAI,QAAQ,WAAW,QAAQ,MAAM,UAAU,QAAQ,OAAO,EAAE;AAAA,QACpFA,QAAO;AAAA,UAAS;AAAA,UAAgC,MAC9CA,QAAO;AAAA,YACL,IAAI,mBAAmB;AAAA,cACrB,WAAW;AAAA,cACX,SAAS,gCAAgC,OAAO,YAAY,KAAK,IAAI;AAAA,YACvE,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,MAAM;AACnB,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SAAS,mBAAmB,QAAQ,MAAM,QAAQ,SAAS,OAAO,YAAY,KAAK,IAAI;AAAA,QACzF,CAAC;AAAA,MACH;AACA,eAAS,IAAI,IAAI,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG,MAAM,KAAK;AAC7D;AAAA,IACF;AACA,QAAI,SAAS,MAAM,SAAS,QAAQ;AAClC,eAAS,IAAI,IAAI,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG,QAAQ,MAAM,IAAI,KAAK,QAAQ,MAAM;AACvF;AAAA,IACF;AACA,WAAO,OAAO,IAAI,mBAAmB;AAAA,MACnC,WAAW;AAAA,MACX,SAAS,uBAAuB,OAAO,YAAY,KAAK,IAAI;AAAA,IAC9D,CAAC;AAAA,EACH;AACA,SAAO,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,WAAW;AACvD,CAAC;AAEH,IAAM,+BAA+B,CACnC,KACA,QACA,WAOAA,QAAO,IAAI,aAAa;AACtB,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,WAAmC,CAAC;AAC1C,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClD,QAAI,OAAO,UAAU,UAAU;AAC7B,eAAS,IAAI,IAAI;AACjB;AAAA,IACF;AACA,QAAI,UAAU,OAAO;AACnB,YAAM,eAAe,OAAO;AAAA,QAC1B;AAAA,QACA,EAAE,CAAC,IAAI,GAAG,MAAM;AAAA,QAChB;AAAA,UACE,UAAU,OAAO;AAAA,UACjB,aAAa,OAAO;AAAA,UACpB,cAAc,OAAO;AAAA,QACvB;AAAA,MACF;AACA,UAAI,eAAe,IAAI,MAAM,OAAW,UAAS,IAAI,IAAI,aAAa,IAAI;AAC1E;AAAA,IACF;AACA,UAAM,cACJ,mBAAmB,QACd,MAAM,iBAAiB,MAAM,cAC7B,OAAO,eAAe,OAAO;AACpC,UAAM,SAAS,OAAO,IAAI,QAAQ,WAAW,SAAS,KAAK,MAAM,QAAQ,GAAG,WAAW,EAAE;AAAA,MACvFA,QAAO;AAAA,QAAS;AAAA,QAAgC,MAC9CA,QAAO;AAAA,UACL,IAAI,mBAAmB;AAAA,YACrB,WAAW;AAAA,YACX,SAAS,gCAAgC,OAAO,YAAY,KAAK,IAAI;AAAA,UACvE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,MAAM;AACnB,aAAO,OAAO,IAAI,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,SAAS,mBAAmB,MAAM,QAAQ,SAAS,OAAO,YAAY,KAAK,IAAI;AAAA,MACjF,CAAC;AAAA,IACH;AACA,aAAS,IAAI,IAAI,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG,MAAM,KAAK;AAAA,EAC/D;AACA,SAAO,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,WAAW;AACvD,CAAC;AAEH,IAAM,uBAAuB,CAC3B,KACA,UACA,aACA,SAEAA,QAAO,IAAI,aAAa;AACtB,MAAI,KAAK,SAAS,SAAU,QAAO,CAAC;AACpC,QAAM,UAAU,OAAO,wBAAwB,KAAK,UAAU,aAAa,KAAK,UAAU;AAC1F,MAAI,SAAS,MAAM,SAAS,UAAU;AACpC,UAAM,SAAS,OAAO,IAAI,QAAQ,WAAW,QAAQ,MAAM,UAAU,QAAQ,OAAO,EAAE;AAAA,MACpFA,QAAO;AAAA,QAAS;AAAA,QAAgC,MAC9CA,QAAO;AAAA,UACL,IAAI,mBAAmB;AAAA,YACrB,WAAW;AAAA,YACX,SAAS,0CAA0C,KAAK,UAAU;AAAA,UACpE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,MAAM;AACnB,aAAO,OAAO,IAAI,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,SAAS,2CAA2C,KAAK,UAAU;AAAA,MACrE,CAAC;AAAA,IACH;AACA,WAAO,EAAE,CAAC,KAAK,UAAU,GAAG,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,MAAM,KAAK,OAAO;AAAA,EAC/E;AACA,MAAI,SAAS,MAAM,SAAS,QAAQ;AAClC,WAAO;AAAA,MACL,CAAC,KAAK,UAAU,GAAG,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,QAAQ,MAAM,IAAI,KAAK,QAAQ,MAAM;AAAA,IACzF;AAAA,EACF;AACA,SAAO,OAAO,IAAI,mBAAmB;AAAA,IACnC,WAAW;AAAA,IACX,SAAS,gCAAgC,KAAK,UAAU;AAAA,EAC1D,CAAC;AACH,CAAC;AAEH,IAAM,gCAAgC,CACpC,KACA,UACA,aACA,SAEAA,QAAO,IAAI,aAAa;AACtB,MAAI,KAAK,SAAS,SAAU,QAAO;AACnC,QAAM,UAAU,OAAO,wBAAwB,KAAK,UAAU,aAAa,KAAK,cAAc;AAC9F,MAAI,SAAS,MAAM,SAAS,cAAc;AACxC,WAAO,OAAO,IAAI,mBAAmB;AAAA,MACnC,WAAW;AAAA,MACX,SAAS,oDAAoD,QAAQ;AAAA,IACvE,CAAC;AAAA,EACH;AACA,QAAM,eAAe,QAAQ,MAAM;AACnC,QAAM,cAAc,OAAO,IAAI,YAC5B,mBAAmB,cAAc,QAAQ,OAAO,EAChD;AAAA,IACCA,QAAO;AAAA,MACL,CAAC,EAAE,QAAQ,MACT,IAAI,mBAAmB;AAAA,QACrB,WAAW;AAAA,QACX,SAAS,uCAAuC,YAAY,MAAM,OAAO;AAAA,MAC3E,CAAC;AAAA,IACL;AAAA,EACF;AACF,SAAO,kBAAkB,WAAW;AACtC,CAAC;AAEH,IAAM,sBAAsB,CAC1B,KACA,UACA,aACA,aACA,SAKAA,QAAO,IAAI,aAAa;AACtB,MAAI,CAAC,QAAQ,KAAK,SAAS,OAAQ,QAAO,EAAE,SAAS,CAAC,EAAE;AACxD,MAAI,KAAK,SAAS,UAAU;AAC1B,QAAI,gBAAgB,MAAM;AACxB,YAAM,UAAU,OAAO,qBAAqB,KAAK,UAAU,aAAa,IAAI;AAC5E,aAAO,EAAE,QAAQ;AAAA,IACnB;AACA,UAAM,cAAc,KAAK,iBAAiB,KAAK,eAAe,eAAe;AAC7E,UAAM,SAAS,OAAO,IAAI,QAAQ,WAAW,SAAS,KAAK,KAAK,QAAQ,GAAG,WAAW,EAAE;AAAA,MACtFA,QAAO;AAAA,QAAS;AAAA,QAAgC,MAC9CA,QAAO;AAAA,UACL,IAAI,mBAAmB;AAAA,YACrB,WAAW;AAAA,YACX,SAAS,6BAA6B,KAAK,QAAQ;AAAA,UACrD,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,QAAI,WAAW,MAAM;AACnB,aAAO,OAAO,IAAI,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,SAAS,6BAA6B,KAAK,QAAQ;AAAA,MACrD,CAAC;AAAA,IACH;AACA,WAAO;AAAA,MACL,SAAS,EAAE,CAAC,KAAK,UAAU,GAAG,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,MAAM,KAAK,OAAO;AAAA,IACjF;AAAA,EACF;AACA,QAAM,aACJ,kBAAkB,OACd,EAAE,IAAI,aAAa,KAAK,KAAK,YAAY,GAAG,OAAO,eAAe,YAAY,IAC9E,OAAOA,QAAO,IAAI,aAAa;AAC7B,UAAM,UAAU,OAAO;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP;AACA,WAAO,SAAS,MAAM,SAAS,eAC3B,EAAE,IAAI,QAAQ,MAAM,cAAc,OAAO,QAAQ,QAAQ,IACzD;AAAA,EACN,CAAC;AACP,MAAI,eAAe,MAAM;AACvB,WAAO,OAAO,IAAI,mBAAmB;AAAA,MACnC,WAAW;AAAA,MACX,SAAS,oDAAoD,QAAQ;AAAA,IACvE,CAAC;AAAA,EACH;AACA,QAAM,cAAc,OAAO,IAAI,YAC5B,mBAAmB,WAAW,IAAI,WAAW,KAAK,EAClD;AAAA,IACCA,QAAO;AAAA,MACL,CAAC,EAAE,QAAQ,MACT,IAAI,mBAAmB;AAAA,QACrB,WAAW;AAAA,QACX,SAAS,uCAAuC,WAAW,EAAE,MAAM,OAAO;AAAA,MAC5E,CAAC;AAAA,IACL;AAAA,EACF;AACF,SAAO,EAAE,SAAS,CAAC,GAAG,cAAc,kBAAkB,WAAW,EAAE;AACrE,CAAC;AAMH,IAAM,wBAAwB,CAC5B,UACA,aACA,IACA,KACA,eACuE;AACvE,MAAI,GAAG,cAAc,SAAS;AAC5B,QAAI,CAAC,YAAY;AACf,aAAOA,QAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAOA,QAAO,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,SAAS,GAAG;AAAA,MACZ,MAAM,GAAG;AAAA,MACT,KAAK,GAAG;AAAA,MACR,KAAK,GAAG;AAAA,IACV,CAAC;AAAA,EACH;AAEA,SAAOA,QAAO,IAAI,aAAa;AAC7B,UAAM,kBAAkB,OAAO,0BAA0B,KAAK,GAAG,SAAS;AAAA,MACxE;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,sBAAsB,OAAO,0BAA0B,KAAK,GAAG,aAAa;AAAA,MAChF;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,UAAkC,EAAE,GAAI,mBAAmB,CAAC,EAAG;AAErE,UAAM,OAAO,GAAG;AAChB,QAAI,KAAK,SAAS,UAAU;AAC1B,aAAO,OAAO,SAAS,OAAO,qBAAqB,KAAK,UAAU,aAAa,IAAI,CAAC;AAAA,IACtF;AACA,UAAM,eAAe,OAAO,8BAA8B,KAAK,UAAU,aAAa,IAAI;AAE1F,WAAO;AAAA,MACL,WAAW;AAAA,MACX,UAAU,GAAG;AAAA,MACb,iBAAiB,GAAG;AAAA,MACpB,aAAa;AAAA,MACb,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AAAA,MACrD;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAcA,IAAM,cAAc,MAClBA,QAAO,IAAI,aAAa;AACtB,QAAM,aAAa,OAAO,MAAM,KAAK;AACrC,QAAM,oBAAoB,oBAAI,IAA8D;AAC5F,QAAM,kBAAkB,OAAOG,aAAY,KAAK;AAAA,IAC9C,QAAQ,CAAC,QACPH,QAAO;AAAA,MACLA,QAAO,QAAQ,MAAM;AACnB,cAAM,YAAY,kBAAkB,IAAI,GAAG;AAC3C,YAAI,CAAC,WAAW;AACd,iBAAOA,QAAO;AAAA,YACZ,IAAI,mBAAmB;AAAA,cACrB,WAAW;AAAA,cACX,SAAS,iCAAiC,GAAG;AAAA,YAC/C,CAAC;AAAA,UACH;AAAA,QACF;AACA,eAAO;AAAA,MACT,CAAC;AAAA,MACD,CAAC,eACCA,QAAO;AAAA,QACLA,QAAO,WAAW;AAAA,UAChB,KAAK,MAAM,WAAW,MAAM;AAAA,UAC5B,OAAO,MACL,IAAI,mBAAmB;AAAA,YACrB,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AAAA,QACL,CAAC;AAAA,MACH;AAAA,IACJ;AAAA,IACF,UAAU;AAAA,IACV,YAAYI,UAAS,QAAQ,CAAC;AAAA,EAChC,CAAC,EAAE,KAAK,MAAM,QAAQ,UAAU,CAAC;AAEjC,SAAO,EAAE,iBAAiB,mBAAmB,WAAW;AAC1D,CAAC;AAoBH,IAAM,YAAY,CAAC,OAAuB,GAAG,iBAAiB,GAAG,EAAE;AAEnE,IAAM,eAAe,CAAC,SAAwE;AAC5F,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAS,OAAQ,QAAO,EAAE,MAAM,OAAO;AAChD,MAAI,KAAK,SAAS,UAAU;AAC1B,QAAI,EAAE,cAAc,MAAO,QAAO;AAClC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,QAAQ,UAAU,KAAK,QAAQ;AAAA,MAC/B,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AACA,MAAI,EAAE,kBAAkB,MAAO,QAAO;AACtC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,KAAK;AAAA,EACrB;AACF;AAcA,IAAM,oBAAoB,CACxB,QACA,eACmC;AACnC,MAAI,OAAO,eAAe,SAAU,QAAO;AAC3C,QAAM,QAAQ,OAAO,IAAI,WAAW,IAAI;AACxC,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,SAAS,UAAU;AAC3B,WAAO;AAAA,MACL,UAAU,MAAM;AAAA,MAChB,GAAI,WAAW,SAAS,EAAE,QAAQ,WAAW,OAAO,IAAI,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,MAAI,MAAM,SAAS,OAAQ,QAAO,MAAM;AAExC,SAAO;AACT;AAEA,IAAM,uBAAuB,CAC3B,QACA,WACmD;AACnD,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,MAA0C,CAAC;AACjD,aAAW,CAAC,MAAM,UAAU,KAAK,OAAO,QAAQ,MAAM,GAAG;AACvD,UAAM,QAAQ,kBAAkB,QAAQ,UAAU;AAClD,QAAI,UAAU,OAAW,KAAI,IAAI,IAAI;AAAA,EACvC;AACA,SAAO,OAAO,KAAK,GAAG,EAAE,SAAS,IAAI,MAAM;AAC7C;AAEA,IAAM,cAAc,CAClB,QACA,SACuC;AACvC,MAAI,KAAK,SAAS,OAAQ,QAAO,EAAE,MAAM,OAAO;AAChD,MAAI,KAAK,SAAS,UAAU;AAC1B,UAAM,QAAQ,OAAO,IAAI,KAAK,UAAU;AACxC,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,UAAU,MAAM;AAAA,MAChB,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AACA,QAAM,aAAa,OAAO,IAAI,KAAK,cAAc;AACjD,MAAI,YAAY,SAAS,aAAc,QAAO;AAC9C,SAAO,EAAE,MAAM,UAAU,cAAc,WAAW,aAAa;AACjE;AAEA,IAAM,sBAAsB,CAC1B,UACA,QACA,OACA,YACA,cACoB;AACpB,MAAI,OAAO,cAAc,SAAS;AAChC,WAAO;AAAA,MACL,WAAW;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO,OAAO,CAAC,GAAG,OAAO,IAAI,IAAI;AAAA,MACvC,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AAAA,EACF;AACA,QAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AACzE,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,MAAM;AAAA,IACN;AAAA,IACA,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,SAAS,qBAAqB,QAAQ,OAAO,OAAO;AAAA,IACpD,aAAa,qBAAqB,QAAQ,OAAO,WAAW;AAAA,IAC5D,MAAM,YAAY,QAAQ,OAAO,IAAI;AAAA,EACvC;AACF;AAEA,IAAM,mBAAmB,CACvB,WACA,YACA,WACiB;AACjB,MAAI,OAAO,cAAc,SAAS;AAChC,UAAMC,SAA6B;AAAA,MACjC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,MAAM;AAAA,MACN,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,MACZ;AAAA,IACF;AACA,WAAOA;AAAA,EACT;AACA,QAAM,QAA8B;AAAA,IAClC,MAAM;AAAA,IACN,WAAW;AAAA,IACX,MAAM;AAAA,IACN,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO;AAAA,IACxB,aAAa,eAAe,OAAO,WAAW;AAAA,IAC9C,SAAS,eAAe,OAAO,OAAO;AAAA,IACtC;AAAA,IACA,MAAM,aAAa,OAAO,IAAI;AAAA,EAChC;AACA,SAAO;AACT;AAEO,IAAM,YAAY,aAAa,CAAC,YAA+B;AACpE,QAAM,aAAa,SAAS,4BAA4B;AAIxD,QAAM,aAA6C,EAAE,SAAS,KAAK;AAEnE,QAAM,gBAAgB,MACpB,WAAW,UACPL,QAAO,QAAQ,WAAW,OAAO,IACjC,YAAY,EAAE;AAAA,IACZA,QAAO;AAAA,MAAI,CAAC,OACVA,QAAO,KAAK,MAAM;AAChB,mBAAW,UAAU;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AAEN,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMb,cAAc,EAAE,WAAW;AAAA,IAC3B,QAAQ;AAAA,IACR,SAAS,CAAC,SAA0B,aAAa,IAAI;AAAA,IAErD,WAAW,CAAC,QAAQ;AAClB,YAAM,kBAAkB,SAAS,mBAAmB,IAAI;AACxD,YAAM,gBAAgB,CAAC,UACrBA,QAAO,IAAI,aAAa;AACtB,cAAM,WAAW,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC3D,cAAM,UAAU,SAAS,KAAK;AAC9B,YAAI,CAAC,SAAS;AACZ,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,OAAO,OAAOA,QAAO,IAAI;AAAA,UAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;AAAA,UAC5B,OAAO,MAAM;AAAA,QACf,CAAC,EAAE,KAAKA,QAAO,cAAc,MAAM,KAAK,CAAC;AACzC,cAAM,YAAY,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAE1D,cAAM,eACJ,OAAO,UAAU,WACb,SACA,OAAO,uBAAuB,MAAM,SAAS,GAAG;AACtD,cAAM,mBACJ,OAAO,UAAU,WACb,SACA,OAAO,uBAAuB,MAAM,aAAa,GAAG;AAE1D,cAAM,YAAY,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AAED,cAAM,SAAS,OAAO,cAAc,SAAS,EAAE;AAAA,UAC7CA,QAAO,IAAI,CAAC,OAAO,EAAE,IAAI,MAAe,UAAU,EAAE,EAAE;AAAA,UACtDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,UAAU,KAAK,CAAC,CAAC;AAAA,UACzEA,QAAO,SAAS,2BAA2B;AAAA,QAC7C;AAEA,YAAI,OAAO,MAAM,OAAO,UAAU;AAChC,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,eAAe;AAAA,YACf,6BAA6B;AAAA,YAC7B,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,YACtC;AAAA,YACA,WAAW,OAAO,SAAS,MAAM;AAAA,YACjC,YAAY,OAAO,SAAS,QAAQ,QAAQ;AAAA,UAC9C;AAAA,QACF;AAQA,cAAM,QAAQ,OAAO,sBAAsB,SAAS;AAAA,UAClD;AAAA,UACA,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AACD,YAAI,MAAM,SAAS,OAAO;AACxB,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS,uBAAuB,KAAK;AAAA,UACvC,CAAC;AAAA,QACH;AAEA,cAAM,cAAc,OAAO,IAAI,MAC5B,MAAM;AAAA,UACL,UAAU;AAAA,UACV,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC,EACA;AAAA,UACCA,QAAO,IAAI,CAAC,WAAW,EAAE,IAAI,MAAe,MAAM,EAAE;AAAA,UACpDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,OAAO,KAAK,CAAC,CAAC;AAAA,UACtEA,QAAO,SAAS,wBAAwB;AAAA,QAC1C;AAEF,YAAI,YAAY,IAAI;AAClB,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,eAAe;AAAA,YACf,6BAA6B,YAAY,MAAM;AAAA,YAC/C;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,YAAY;AAAA,UACd;AAAA,QACF;AAEA,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,gBAAgB,OAAO,UAAU,WAAW,QAAQ,MAAM,SAAS;AAAA,QACnF,CAAC;AAAA,MACH;AAEF,YAAM,aAAa,SAAS;AAE5B,YAAM,YAAY,CAAC,WACjBA,QAAO,IAAI,aAAa;AACtB,cAAM,YAAY,mBAAmB,MAAM;AAC3C,cAAM,kBACJ,OAAO,cAAc,WACjB;AAAA,UACE,SAAS,0BAA0B,OAAO,SAAS,aAAa;AAAA,UAChE,aAAa,0BAA0B,OAAO,aAAa,iBAAiB;AAAA,UAC5E,MAAM,iBAAiB,OAAO,IAAI;AAAA,QACpC,IACA;AACN,cAAM,iBAAiB,kBACnB;AAAA,UACE,GAAG,gBAAgB,QAAQ;AAAA,UAC3B,GAAG,gBAAgB,YAAY;AAAA,UAC/B,GAAG,gBAAgB,KAAK;AAAA,QAC1B,IACA,CAAC;AACL,mBAAW,WAAW,gBAAgB;AACpC,gBAAMM,sBAAqB,OAAO;AAAA,YAChC,OAAO,cAAc,WAAW,OAAO,wBAAwB;AAAA,YAC/D;AAAA,UACF;AACA,iBAAO,yBAAyB,KAAK;AAAA,YACnC,UAAU;AAAA,YACV,aAAa,OAAO;AAAA,YACpB,aAAaA;AAAA,UACf,CAAC;AAAA,QACH;AACA,cAAM,cACJ,OAAO,cAAc,YAAY,eAAe,CAAC,IAC7C,OAAO,sBAAsB,OAAO,uBAAuB,eAAe,CAAC,CAAC,IAC5E;AACN,cAAM,KAAK;AAAA,UACT;AAAA,UACA,kBACI;AAAA,YACE,SAAS,gBAAgB,QAAQ;AAAA,YACjC,aAAa,gBAAgB,YAAY;AAAA,YACzC,MAAM,gBAAgB,KAAK;AAAA,UAC7B,IACA;AAAA,QACN;AASA,cAAM,WAAW,QACf,OAAO,cAAc,WACjBN,QAAO,IAAI,aAAa;AACtB,gBAAM,kBAAkB,OAAO,6BAA6B,KAAK,OAAO,SAAS;AAAA,YAC/E,UAAU;AAAA,YACV,aAAa,OAAO;AAAA,YACpB;AAAA,YACA,cAAc;AAAA,UAChB,CAAC;AACD,gBAAM,sBAAsB,OAAO;AAAA,YACjC;AAAA,YACA,OAAO;AAAA,YACP;AAAA,cACE,UAAU;AAAA,cACV,aAAa,OAAO;AAAA,cACpB;AAAA,cACA,cAAc;AAAA,YAChB;AAAA,UACF;AACA,gBAAM,eAAe,OAAO;AAAA,YAC1B;AAAA,YACA;AAAA,YACA,OAAO;AAAA,YACP;AAAA,YACA,OAAO;AAAA,UACT;AACA,gBAAM,UAAU;AAAA,YACd,GAAI,mBAAmB,CAAC;AAAA,YACxB,GAAG,aAAa;AAAA,UAClB;AACA,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,UAAU,OAAO;AAAA,YACjB,iBAAiB,OAAO,mBAAmB;AAAA,YAC3C,aAAa;AAAA,YACb,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AAAA,YACrD,cAAc,aAAa;AAAA,UAC7B;AAAA,QACF,CAAC,IACD,sBAAsB,WAAW,OAAO,OAAO,IAAI,KAAK,UAAU,GACtE;AAAA,UACAA,QAAO;AAAA,UACPA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,OAAO,UAAU,QAAQ,KAAK,GAAG,cAAc,SAAS;AAC1D,iBAAO,OAAOA,QAAO,KAAK,SAAS,OAAO;AAAA,QAC5C;AAMA,cAAM,YAGF,OAAO,UAAU,QAAQ,IACzB,OAAO,cAAc,mBAAmB,SAAS,OAAO,CAAC,EAAE;AAAA,UACzDA,QAAO;AAAA,YACL,CAAC,EAAE,QAAQ,MACT,IAAI,sBAAsB;AAAA,cACxB,OAAO;AAAA,cACP,SAAS,yBAAyB,OAAO;AAAA,YAC3C,CAAC;AAAA,UACL;AAAA,UACAA,QAAO;AAAA,UACPA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH,IACA,OAAO,KAAK,SAAS,OAAO;AAChC,cAAM,WAAW,OAAO,UAAU,SAAS,IACvC,UAAU,UACV,EAAE,QAAQ,QAAW,OAAO,CAAC,EAAW;AAE5C,cAAM,aAAa,OAAO,QAAQ,SAAS,QAAQ,QAAQ;AAE3D,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AAItB,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,OAAO,KAAK;AACpE,mBAAO,IAAI,QAAQ,aAAa,WAAW,OAAO,KAAK;AAEvD,mBAAO,IAAI,QAAQ,UAAU;AAAA,cAC3B;AAAA,cACA,OAAO,OAAO;AAAA,cACd,MAAM;AAAA,cACN,QAAQ;AAAA,YACV,CAAC;AAED,mBAAO,IAAI,QAAQ;AAAA,cACjB;AAAA,cACA,OAAO;AAAA,cACP,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBACzB,QAAQ,GAAG,SAAS,IAAI,EAAE,MAAM;AAAA,gBAChC,SAAS,UAAU,CAAC;AAAA,cACtB,EAAE;AAAA,YACJ;AAEA,mBAAO,IAAI,KAAK,QAAQ,SAAS;AAAA,cAC/B,IAAI;AAAA,cACJ,OAAO,OAAO;AAAA,cACd,MAAM;AAAA,cACN,MAAM;AAAA,cACN,KAAK,GAAG,cAAc,WAAW,GAAG,WAAW;AAAA,cAC/C,WAAW;AAAA,cACX,YAAY;AAAA,cACZ,SAAS,GAAG,cAAc;AAAA,cAC1B,OAAO,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBAChC,MAAM,EAAE;AAAA,gBACR,aAAa,EAAE,eAAe,aAAa,EAAE,QAAQ;AAAA,gBACrD,aAAa,EAAE;AAAA,gBACf,cAAc,EAAE;AAAA,cAClB,EAAE;AAAA,YACJ,CAAC;AAED,gBAAI,eAAe,SAAS,GAAG;AAC7B,yBAAW,WAAW,gBAAgB;AACpC,sBAAMM,sBAAqB,OAAO;AAAA,kBAChC,OAAO,cAAc,WAAW,OAAO,wBAAwB;AAAA,kBAC/D;AAAA,gBACF;AACA,uBAAO,IAAI,mBAAmB,IAAI;AAAA,kBAChC,aAAa,QAAQ,KAAKA,mBAAkB;AAAA,kBAC5C,UAAU;AAAA,kBACV,UAAU;AAAA,kBACV,aAAa,QAAQ,KAAK,OAAO,KAAK;AAAA,kBACtC,SAAS,QAAQ;AAAA,kBACjB,OAAO,QAAQ;AAAA,gBACjB,CAAC;AAAA,cACH;AAAA,YACF;AAAA,UACF,CAAC;AAAA,QACH,EACC;AAAA,UACCN,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,yBAAyB,SAAS,MAAM;AAAA,YAC1C;AAAA,UACF,CAAC;AAAA,QACH;AAEF,YAAI,YAAY;AACd,iBAAO,WACJ,aAAa,iBAAiB,WAAW,YAAY,MAAM,CAAC,EAC5D,KAAKA,QAAO,SAAS,+BAA+B,CAAC;AAAA,QAC1D;AAEA,YAAI,OAAO,UAAU,SAAS,GAAG;AAC/B,iBAAO,OAAOA,QAAO,KAAK,UAAU,OAAO;AAAA,QAC7C;AACA,eAAO,EAAE,WAAW,SAAS,MAAM,QAAQ,UAAU;AAAA,MACvD,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY;AAAA,YACV,wBAAwB,OAAO;AAAA,YAC/B,mBAAmB,OAAO;AAAA,UAC5B;AAAA,QACF,CAAC;AAAA,MACH;AAEF,YAAM,eAAe,CAAC,WAAmB,UACvCA,QAAO,IAAI,aAAa;AACtB,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AACtB,mBAAO,IAAI,mBAAmB,gBAAgB;AAAA,cAC5C,UAAU;AAAA,cACV,UAAU;AAAA,cACV,aAAa,QAAQ,KAAK,KAAK;AAAA,YACjC,CAAC;AACD,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,KAAK;AAC7D,mBAAO,IAAI,QAAQ,aAAa,WAAW,KAAK;AAChD,mBAAO,IAAI,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,aAAa,MAAM,CAAC;AAAA,UAC1E,CAAC;AAAA,QACH,EACC,KAAKA,QAAO,SAAS,2BAA2B,CAAC;AACpD,YAAI,YAAY;AACd,iBAAO,WACJ,aAAa,SAAS,EACtB,KAAKA,QAAO,SAAS,+BAA+B,CAAC;AAAA,QAC1D;AAAA,MACF,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,4BAA4B;AAAA,UAC1C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,gBAAgB,CAAC,WAAmB,UACxCA,QAAO,IAAI,aAAa;AACtB,cAAM,KAAK,OAAO,IAAI,QAAQ,gBAAgB,WAAW,KAAK,EAAE;AAAA,UAC9DA,QAAO,SAAS,iCAAiC;AAAA,YAC/C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH;AACA,YAAI,CAAC,IAAI;AACP,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS,oCAAoC,SAAS;AAAA,UACxD,CAAC;AAAA,QACH;AAEA,cAAM,KAAK,OAAO,sBAAsB,WAAW,OAAO,IAAI,KAAK,UAAU,EAAE;AAAA,UAC7EA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,WAAW,OAAO,cAAc,mBAAmB,EAAE,CAAC,EAAE;AAAA,UAC5DA,QAAO;AAAA,YACL,CAAC,EAAE,QAAQ,MACT,IAAI,sBAAsB;AAAA,cACxB,OAAO;AAAA,cACP,SAAS,uBAAuB,OAAO;AAAA,YACzC,CAAC;AAAA,UACL;AAAA,UACAA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,UAClD,CAAC;AAAA,QACH;AAEA,cAAM,WAAW,OAAO,IAAI,QAAQ,UAAU,WAAW,KAAK;AAC9D,cAAM,aAAa,SAAS,QAAQ,QAAQ,UAAU,QAAQ;AAE9D,eAAO,IACJ;AAAA,UACCA,QAAO,IAAI,aAAa;AACtB,mBAAO,IAAI,QAAQ,0BAA0B,WAAW,KAAK;AAC7D,mBAAO,IAAI,KAAK,QAAQ,WAAW,EAAE,IAAI,WAAW,aAAa,MAAM,CAAC;AAExE,mBAAO,IAAI,QAAQ;AAAA,cACjB;AAAA,cACA;AAAA,cACA,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBACzB,QAAQ,GAAG,SAAS,IAAI,EAAE,MAAM;AAAA,gBAChC,SAAS,UAAU,CAAC;AAAA,cACtB,EAAE;AAAA,YACJ;AACA,mBAAO,IAAI,KAAK,QAAQ,SAAS;AAAA,cAC/B,IAAI;AAAA,cACJ;AAAA,cACA,MAAM;AAAA,cACN,MAAM;AAAA,cACN,KAAK,GAAG,cAAc,WAAW,GAAG,WAAW;AAAA,cAC/C,WAAW;AAAA,cACX,YAAY;AAAA,cACZ,SAAS,GAAG,cAAc;AAAA,cAC1B,OAAO,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,gBAChC,MAAM,EAAE;AAAA,gBACR,aAAa,EAAE,eAAe,aAAa,EAAE,QAAQ;AAAA,gBACrD,aAAa,EAAE;AAAA,gBACf,cAAc,EAAE;AAAA,cAClB,EAAE;AAAA,YACJ,CAAC;AAAA,UACH,CAAC;AAAA,QACH,EACC;AAAA,UACCA,QAAO,SAAS,6BAA6B;AAAA,YAC3C,YAAY;AAAA,cACV,wBAAwB;AAAA,cACxB,yBAAyB,SAAS,MAAM;AAAA,YAC1C;AAAA,UACF,CAAC;AAAA,QACH;AAEF,eAAO,EAAE,WAAW,SAAS,MAAM,OAAO;AAAA,MAC5C,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,eAAe,CAAC,WAAmB,OAAe,UACtDA,QAAO,IAAI,aAAa;AACtB,cAAM,WAAW,OAAO,IAAI,QAAQ,UAAU,WAAW,KAAK;AAC9D,YAAI,CAAC,YAAY,SAAS,OAAO,cAAc,SAAU;AAEzD,cAAM,mBACJ,MAAM,YAAY,SACd,0BAA0B,MAAM,SAAS,aAAa,IACtD;AACN,cAAM,uBACJ,MAAM,gBAAgB,SAClB,0BAA0B,MAAM,aAAa,iBAAiB,IAC9D;AACN,cAAM,gBAAgB,MAAM,SAAS,SAAY,iBAAiB,MAAM,IAAI,IAAI;AAChF,cAAM,iBAAiB;AAAA,UACrB,GAAI,kBAAkB,YAAY,CAAC;AAAA,UACnC,GAAI,sBAAsB,YAAY,CAAC;AAAA,UACvC,GAAI,eAAe,YAAY,CAAC;AAAA,QAClC;AACA,cAAM,cAAc,OAAO;AAAA,UACzB,MAAM;AAAA,UACN;AAAA,QACF;AACA,YAAI,aAAa;AACf,iBAAO,yBAAyB,KAAK;AAAA,YACnC,UAAU;AAAA,YACV,aAAa;AAAA,YACb;AAAA,UACF,CAAC;AAAA,QACH;AAEA,cAAM,SAAS,SAAS;AACxB,cAAM,gBAAqC;AAAA,UACzC,GAAG;AAAA,UACH,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,UACnE,GAAI,mBAAmB,EAAE,SAAS,iBAAiB,OAAO,IAAI,CAAC;AAAA,UAC/D,GAAI,gBAAgB,EAAE,MAAM,cAAc,KAAK,IAAI,CAAC;AAAA,UACpD,GAAI,uBAAuB,EAAE,aAAa,qBAAqB,OAAO,IAAI,CAAC;AAAA,QAC7E;AACA,cAAM,aAAa,MAAM,MAAM,KAAK,KAAK,SAAS;AAElD,cAAM,mBAAmB;AAAA,UACvB,GAAI,MAAM,YAAY,SAAY,CAAC,SAAS,IAAI,CAAC;AAAA,UACjD,GAAI,MAAM,gBAAgB,SAAY,CAAC,cAAc,IAAI,CAAC;AAAA,UAC1D,GAAI,MAAM,SAAS,SAAY,CAAC,OAAO,IAAI,CAAC;AAAA,QAC9C;AACA,cAAM,yBAAyB,eAAe,MAAM,yBAAyB;AAC7E,eAAO,IAAI;AAAA,UACTA,QAAO,IAAI,aAAa;AACtB,mBAAO,IAAI,QAAQ,UAAU;AAAA,cAC3B;AAAA,cACA;AAAA,cACA,MAAM;AAAA,cACN,QAAQ;AAAA,YACV,CAAC;AACD,gBAAI,iBAAiB,SAAS,KAAK,eAAe,SAAS,GAAG;AAC5D,qBAAO,IAAI,mBAAmB,iBAAiB;AAAA,gBAC7C,aAAa,QAAQ,KAAK,sBAAsB;AAAA,gBAChD,UAAU;AAAA,gBACV,UAAU;AAAA,gBACV,aAAa,QAAQ,KAAK,KAAK;AAAA,gBAC/B,cAAc;AAAA,gBACd,UAAU,eAAe,IAAI,CAAC,aAAa;AAAA,kBACzC,SAAS,QAAQ;AAAA,kBACjB,OAAO,QAAQ;AAAA,gBACjB,EAAE;AAAA,cACJ,CAAC;AAAA,YACH;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,YAAY;AACd,gBAAM,WAAW,OAAO,IAAI,mBAAmB,cAAc;AAAA,YAC3D,UAAU;AAAA,YACV,UAAU;AAAA,YACV,aAAa,QAAQ,KAAK,KAAK;AAAA,UACjC,CAAC;AACD,gBAAM,YAAY;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,iBAAO,WACJ,aAAa,iBAAiB,WAAW,YAAY,SAAS,CAAC,EAC/D,KAAKA,QAAO,SAAS,+BAA+B,CAAC;AAAA,QAC1D;AAAA,MACF,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,4BAA4B;AAAA,UAC1C,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,YAAM,YAAY,CAAC,WAAmB,UACpC,IAAI,QAAQ,UAAU,WAAW,KAAK,EAAE;AAAA,QACtCA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY,EAAE,wBAAwB,UAAU;AAAA,QAClD,CAAC;AAAA,MACH;AAEF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,oBAAoB,CAAC,UAAkB,gBACrC,sBAAsB,KAAK,UAAU,WAAW;AAAA,QAClD,kBAAkB,CAAC,UACjBA,QAAO,IAAI,aAAa;AACtB,iBAAO,yBAAyB,KAAK;AAAA,YACnC,UAAU,MAAM;AAAA,YAChB,aAAa,MAAM;AAAA,YACnB,aAAa,MAAM;AAAA,UACrB,CAAC;AACD,gBAAM,UAAU,OAAO,IAAI,mBAAmB,IAAI;AAAA,YAChD,aAAa,MAAM;AAAA,YACnB,UAAU;AAAA,YACV,UAAU,MAAM;AAAA,YAChB,aAAa,MAAM;AAAA,YACnB,SAAS,MAAM;AAAA,YACf,OAAO,MAAM;AAAA,UACf,CAAC;AACD,iBAAO,wBAAwB,OAAO;AAAA,QACxC,CAAC;AAAA,QACH,qBAAqB,CAAC,UAAkB,aAAqB,MAAc,UACzEA,QAAO,IAAI,aAAa;AACtB,iBAAO,yBAAyB,KAAK;AAAA,YACnC;AAAA,YACA;AAAA,YACA,aAAa;AAAA,UACf,CAAC;AACD,iBAAO,IAAI,mBAAmB,OAAO;AAAA,YACnC,aAAa,QAAQ,KAAK,KAAK;AAAA,YAC/B,UAAU;AAAA,YACV;AAAA,YACA,aAAa,QAAQ,KAAK,WAAW;AAAA,YACrC,SAAS;AAAA,UACX,CAAC;AAAA,QACH,CAAC;AAAA,MACL;AAAA,IACF;AAAA,IAEA,YAAY,CAAC,EAAE,KAAK,SAAS,MAAM,OAAO,MACxCA,QAAO,IAAI,aAAa;AACtB,YAAM,UAAU,OAAO,cAAc;AAOrC,YAAM,YAAY,QAAQ;AAC1B,YAAM,QAAQ,OAAO,IAAI,QAAQ,WAAW,QAAQ,IAAI,SAAS,EAAE;AAAA,QACjEA,QAAO,SAAS,2BAA2B;AAAA,UACzC,YAAY,EAAE,iBAAiB,QAAQ,GAAG;AAAA,QAC5C,CAAC;AAAA,MACH;AACA,UAAI,CAAC,OAAO;AACV,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,UAAU,QAAQ;AAAA,UAClB,SAAS,kCAAkC,QAAQ,EAAE;AAAA,QACvD,CAAC;AAAA,MACH;AAEA,YAAM,KAAK,OAAO,IAAI,QAAQ,gBAAgB,MAAM,WAAW,SAAS,EAAE;AAAA,QACxEA,QAAO,SAAS,iCAAiC;AAAA,UAC/C,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,QACxD,CAAC;AAAA,MACH;AACA,UAAI,CAAC,IAAI;AACP,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SAAS,uCAAuC,MAAM,SAAS;AAAA,QACjE,CAAC;AAAA,MACH;AAEA,aAAO,OAAO,cAAc;AAAA,QAC1B,QAAQ,QAAQ;AAAA,QAChB,UAAU,MAAM,QAAQ;AAAA,QACxB;AAAA,QACA,YAAY;AAAA,QACZ,UAAU,MAAM;AAAA,QAChB,aAAa;AAAA,QACb,cAAc,IAAI,OAAO,CAAC,EAAG;AAAA,QAC7B,kBAAkB,MAChB,sBAAsB,MAAM,WAAW,WAAW,IAAI,KAAK,UAAU,EAAE;AAAA,UACrEA,QAAO,UAAU;AAAA,YACf,cAAc,MACZA,QAAO;AAAA,cACL,IAAI,mBAAmB;AAAA,gBACrB,WAAW,GAAG;AAAA,gBACd,SAAS;AAAA,cACX,CAAC;AAAA,YACH;AAAA,YACF,sBAAsB,MACpBA,QAAO;AAAA,cACL,IAAI,mBAAmB;AAAA,gBACrB,WAAW,GAAG;AAAA,gBACd,SAAS;AAAA,cACX,CAAC;AAAA,YACH;AAAA,UACJ,CAAC;AAAA,UACDA,QAAO,QAAQ,CAAC,OAAO,mBAAmB,EAAE,CAAC;AAAA,UAC7CA,QAAO,SAAS,gCAAgC;AAAA,YAC9C,YAAY;AAAA,cACV,wBAAwB,MAAM;AAAA,cAC9B,wBAAwB,GAAG;AAAA,YAC7B;AAAA,UACF,CAAC;AAAA,QACH;AAAA,QACF,iBAAiB,QAAQ;AAAA,QACzB,mBAAmB,QAAQ;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH,CAAC,EAAE;AAAA,MACDA,QAAO,SAAS,0BAA0B;AAAA,QACxC,YAAY;AAAA,UACV,iBAAiB,QAAQ;AAAA,UACzB,sBAAsB,QAAQ;AAAA,QAChC;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEF,QAAQ,CAAC,EAAE,KAAK,IAAI,MAClBA,QAAO,IAAI,aAAa;AACtB,YAAM,kBAAkB,SAAS,mBAAmB,IAAI;AACxD,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,SAAS,OAAOA,QAAO,IAAI;AAAA,QAC/B,KAAK,MAAM,IAAI,IAAI,OAAO;AAAA,QAC1B,OAAO,CAAC,UAAU;AAAA,MACpB,CAAC,EAAE,KAAKA,QAAO,MAAM;AACrB,UAAIO,QAAO,OAAO,MAAM,EAAG,QAAO;AAElC,YAAM,OAAO,OAAO,MAAM,YAAY;AACtC,YAAM,YAAY,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAE1D,YAAM,YAAY,mBAAmB;AAAA,QACnC,WAAW;AAAA,QACX,UAAU;AAAA,MACZ,CAAC;AAED,YAAM,YAAY,OAAO,cAAc,SAAS,EAAE;AAAA,QAChDP,QAAO,IAAI,MAAM,IAAI;AAAA,QACrBA,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC;AAAA,QACxCA,QAAO,SAAS,2BAA2B;AAAA,MAC7C;AAEA,UAAI,WAAW;AACb,eAAO,sBAAsB,KAAK;AAAA,UAChC,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAUA,YAAM,QAAQ,OAAO,sBAAsB,SAAS,EAAE,gBAAgB,CAAC;AACvE,UAAI,MAAM,SAAS,OAAO;AACxB,eAAO,sBAAsB,KAAK;AAAA,UAChC,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAOA,UAAI,gBAAgB,OAAO,OAAO,KAAK,GAAG;AACxC,eAAO,sBAAsB,KAAK;AAAA,UAChC,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT,CAAC,EAAE;AAAA,MACDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,IAAI,CAAC;AAAA,MACvCA,QAAO,SAAS,qBAAqB;AAAA,QACnC,YAAY,EAAE,gBAAgB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOF,oBAAoB,CAAC,EAAE,KAAK,UAAU,SAAS,MAC7CA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,IAAI,IAAI,SAAS,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;AAC1D,YAAM,UAAU,OAAOA,QAAO;AAAA,QAC5B,CAAC,GAAG,MAAM;AAAA,QACV,CAAC,UACCA,QAAO,IAAI,aAAa;AACtB,gBAAM,OAAO,OAAO,IAAI,QAAQ,qBAAqB,UAAU,KAAK;AACpE,gBAAM,OAAO,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC3D,iBAAO,CAAC,OAAO,IAAI;AAAA,QACrB,CAAC;AAAA,QACH,EAAE,aAAa,YAAY;AAAA,MAC7B;AACA,YAAM,UAAU,IAAI,IAAI,OAAO;AAE/B,YAAM,MAAuC,CAAC;AAC9C,iBAAW,OAAO,UAAU;AAC1B,cAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ,GAAG,IAAI,IAAI,EAAE;AACrD,cAAM,MAAM,SAAS;AACrB,YAAI,KAAK,oBAAoB,MAAM;AACjC,cAAI,IAAI,EAAE,IAAI;AAAA,YACZ,kBAAkB;AAAA,YAClB,qBAAqB,IAAI,SAAS,SAAS,YAAY,IAAI;AAAA,UAC7D;AAAA,QACF,OAAO;AACL,cAAI,IAAI,EAAE,IAAI,EAAE,kBAAkB,MAAM;AAAA,QAC1C;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,cAAc,CAAC,EAAE,KAAK,UAAU,MAAM,MACpCA,QAAO,IAAI,aAAa;AACtB,aAAO,IAAI;AAAA,QACTA,QAAO,IAAI,aAAa;AACtB,iBAAO,IAAI,mBAAmB,gBAAgB;AAAA,YAC5C,UAAU;AAAA,YACV;AAAA,YACA,aAAa,QAAQ,KAAK,KAAK;AAAA,UACjC,CAAC;AACD,iBAAO,IAAI,QAAQ,0BAA0B,UAAU,KAAK;AAC5D,iBAAO,IAAI,QAAQ,aAAa,UAAU,KAAK;AAAA,QACjD,CAAC;AAAA,MACH;AACA,UAAI,SAAS,YAAY;AACvB,eAAO,QAAQ,WAAW,aAAa,QAAQ;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,IAEH,iBAAiB,MAAMA,QAAO,QAAQ,CAAC,CAAC;AAAA,IAExC,qBAAqB,MAAMA,QAAO,QAAQ,CAAC,CAAC;AAAA,IAE5C,eAAe,MAAMA,QAAO;AAAA;AAAA;AAAA;AAAA,IAM5B,OAAO,MACLA,QAAO,IAAI,aAAa;AACtB,YAAM,UAAU,WAAW;AAC3B,UAAI,SAAS;AACX,gBAAQ,kBAAkB,MAAM;AAChC,eAAOG,aAAY,cAAc,QAAQ,eAAe;AACxD,eAAO,MAAM,MAAM,QAAQ,YAAYK,MAAK,IAAI;AAChD,mBAAW,UAAU;AAAA,MACvB;AAAA,IACF,CAAC,EAAE,KAAKR,QAAO,SAAS,kBAAkB,CAAC;AAAA,EAC/C;AAKF,CAAC;","names":["Duration","Effect","Exit","Option","Predicate","ScopedCache","ConfiguredCredentialBinding","Effect","Effect","Effect","Option","Schema","Schema","Option","Option","Effect","Effect","Option","Schema","Schema","Option","Effect","Effect","Option","Schema","Effect","ConfiguredCredentialBinding","Predicate","ScopedCache","Duration","entry","bindingTargetScope","Option","Exit"]}

package/dist/client.js

@@ -9,7 +9,7 @@ import { defineClientPlugin } from "@executor-js/sdk/client";
 import { lazy } from "react";
 import { jsx } from "react/jsx-runtime";
 var importAdd = () => import("./AddMcpSource-TLAL463B.js");
-var importEdit = () => import("./EditMcpSource-CWN6HIC4.js");
+var importEdit = () => import("./EditMcpSource-FAWEECNU.js");
 var importSummary = () => import("./McpSourceSummary-257JNETP.js");
 var LazyAddMcpSource = lazy(importAdd);
 var LazyEditMcpSource = lazy(importEdit);

package/dist/core.js

@@ -2,7 +2,7 @@ import {
   makeMcpStore,
   mcpPlugin,
   mcpSchema
-} from "./chunk-NQT7NAGE.js";
+} from "./chunk-2DOCEPYN.js";
 import {
   ConfiguredMcpCredentialValue,
   MCP_HEADER_AUTH_SLOT,

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   mcpPlugin
-} from "./chunk-NQT7NAGE.js";
+} from "./chunk-2DOCEPYN.js";
 import "./chunk-M6REVU6O.js";
 export {
   mcpPlugin

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/plugin-mcp",
-  "version": "1.4.27",
+  "version": "1.4.29",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/mcp",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
@@ -54,15 +54,15 @@
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "@effect/platform-node": "4.0.0-beta.59",
-    "@executor-js/config": "1.4.27",
-    "@executor-js/sdk": "1.4.27",
+    "@executor-js/config": "1.4.29",
+    "@executor-js/sdk": "1.4.29",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "effect": "4.0.0-beta.59"
   },
   "devDependencies": {
     "@effect/atom-react": "4.0.0-beta.59",
     "@effect/vitest": "4.0.0-beta.59",
-    "@executor-js/storage-core": "1.4.27",
+    "@executor-js/storage-core": "1.4.29",
     "@types/node": "^24.3.1",
     "@types/react": "^19.1.0",
     "bun-types": "^1.2.22",