@executor-js/plugin-mcp 1.5.4 → 1.5.6

package/dist/{chunk-2TXHTMKM.js → chunk-HSJWIVME.js}

@@ -99,7 +99,7 @@ import {
   tool,
   ToolResult,
   ToolName
-} from "@executor-js/sdk";
+} from "@executor-js/sdk/core";
 
 // src/sdk/connection.ts
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -242,7 +242,7 @@ import {
   ElicitationId,
   FormElicitation,
   UrlElicitation
-} from "@executor-js/sdk";
+} from "@executor-js/sdk/core";
 var ArgsRecord = Schema2.Record(Schema2.String, Schema2.Unknown);
 var decodeArgsRecord = Schema2.decodeUnknownOption(ArgsRecord);
 var argsRecord = (value) => Option2.getOrElse(decodeArgsRecord(value), () => ({}));
@@ -1295,4 +1295,4 @@ export {
   userFacingProbeMessage,
   mcpPlugin
 };
-//# sourceMappingURL=chunk-2TXHTMKM.js.map
+//# sourceMappingURL=chunk-HSJWIVME.js.map

package/dist/chunk-HSJWIVME.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sdk/manifest.ts","../src/sdk/plugin.ts","../src/sdk/connection.ts","../src/sdk/discover.ts","../src/sdk/invoke.ts","../src/sdk/probe-shape.ts"],"sourcesContent":["import { Option, Schema } from \"effect\";\n\nimport { McpToolAnnotations } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Output types\n// ---------------------------------------------------------------------------\n\nexport interface McpToolManifestEntry {\n  readonly toolId: string;\n  readonly toolName: string;\n  readonly description: string | null;\n  readonly inputSchema?: unknown;\n  readonly outputSchema?: unknown;\n  readonly annotations?: McpToolAnnotations;\n}\n\nexport interface McpServerMetadata {\n  readonly name: string | null;\n  readonly version: string | null;\n}\n\nexport interface McpToolManifest {\n  readonly server: McpServerMetadata | null;\n  readonly tools: readonly McpToolManifestEntry[];\n}\n\n// ---------------------------------------------------------------------------\n// Schemas\n// ---------------------------------------------------------------------------\n\nconst ListedTool = Schema.Struct({\n  name: Schema.String,\n  description: Schema.optional(Schema.NullOr(Schema.String)),\n  inputSchema: Schema.optional(Schema.Unknown),\n  parameters: Schema.optional(Schema.Unknown),\n  outputSchema: Schema.optional(Schema.Unknown),\n  annotations: Schema.optional(McpToolAnnotations),\n});\n\nconst ListToolsResult = Schema.Struct({\n  tools: Schema.Array(ListedTool),\n});\n\nconst ServerInfo = Schema.Struct({\n  name: Schema.optional(Schema.String),\n  version: Schema.optional(Schema.String),\n});\n\nconst decodeListToolsResult = Schema.decodeUnknownOption(ListToolsResult);\nconst decodeServerInfo = Schema.decodeUnknownOption(ServerInfo);\n\nexport const isListToolsResult = (value: unknown): boolean =>\n  Option.isSome(decodeListToolsResult(value));\n\n// ---------------------------------------------------------------------------\n// Tool ID sanitization\n// ---------------------------------------------------------------------------\n\nconst sanitize = (value: string): string => {\n  const s = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return s || \"tool\";\n};\n\nconst uniqueId = (value: string, seen: Map<string, number>): string => {\n  const base = sanitize(value);\n  const n = (seen.get(base) ?? 0) + 1;\n  seen.set(base, n);\n  return n === 1 ? base : `${base}_${n}`;\n};\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport const joinToolPath = (namespace: string | undefined, toolId: string): string =>\n  namespace?.trim() ? `${namespace}.${toolId}` : toolId;\n\nexport const extractManifestFromListToolsResult = (\n  listToolsResult: unknown,\n  metadata?: { serverInfo?: unknown },\n): McpToolManifest => {\n  const seen = new Map<string, number>();\n\n  const listed = decodeListToolsResult(listToolsResult).pipe(\n    Option.map((result) => result.tools),\n    Option.getOrElse(() => []),\n  );\n\n  const server = decodeServerInfo(metadata?.serverInfo).pipe(\n    Option.map(\n      (info): McpServerMetadata => ({\n        name: info.name ?? null,\n        version: info.version ?? null,\n      }),\n    ),\n    Option.getOrNull,\n  );\n\n  const tools = listed.flatMap((tool): McpToolManifestEntry[] => {\n    const toolName = tool.name.trim();\n    if (!toolName) return [];\n\n    return [\n      {\n        toolId: uniqueId(toolName, seen),\n        toolName,\n        description: tool.description ?? null,\n        inputSchema: tool.inputSchema ?? tool.parameters,\n        outputSchema: tool.outputSchema,\n        annotations: tool.annotations,\n      },\n    ];\n  });\n\n  return { server, tools };\n};\n\n// ---------------------------------------------------------------------------\n// Namespace derivation\n// ---------------------------------------------------------------------------\n\nconst slugify = (value: string): string =>\n  value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n\nconst hostnameOf = (url: string): string | null => {\n  if (!URL.canParse(url)) return null;\n  return new URL(url).hostname;\n};\n\nconst basenameOf = (path: string): string => path.trim().split(/[\\\\/]/).pop() ?? path.trim();\n\nexport const deriveMcpNamespace = (input: {\n  name?: string | null;\n  endpoint?: string | null;\n  command?: string | null;\n}): string => {\n  if (input.name?.trim()) return slugify(input.name) || \"mcp\";\n\n  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;\n  if (fromEndpoint) return slugify(fromEndpoint) || \"mcp\";\n\n  if (input.command?.trim()) return slugify(basenameOf(input.command)) || \"mcp\";\n\n  return \"mcp\";\n};\n","import { Effect, Layer, Match, Option, Result, Schema } from \"effect\";\nimport type { HttpClient } from \"effect/unstable/http\";\n\nimport type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport { CallToolResultSchema } from \"@modelcontextprotocol/sdk/types.js\";\nimport * as z from \"zod/v4\";\n\nimport {\n  authToolFailure,\n  definePlugin,\n  IntegrationAlreadyExistsError,\n  IntegrationSlug,\n  OAuthClientSlug,\n  tool,\n  ToolResult,\n  type AuthMethodDescriptor,\n  type Integration,\n  type IntegrationConfig,\n  type IntegrationRecord,\n  type OAuthClientSummary,\n  type Owner,\n  type PluginCtx,\n  type StaticToolSchema,\n  type StorageFailure,\n  type ToolAnnotations,\n  type ToolDef,\n  ToolName,\n} from \"@executor-js/sdk/core\";\n\nimport { createMcpConnector, type ConnectorInput, type McpConnector } from \"./connection\";\nimport { discoverTools } from \"./discover\";\nimport { McpConnectionError, McpToolDiscoveryError } from \"./errors\";\nimport { invokeMcpTool } from \"./invoke\";\nimport { deriveMcpNamespace, type McpToolManifestEntry } from \"./manifest\";\nimport { mcpPresets } from \"./presets\";\nimport { probeMcpEndpointShape, type McpShapeProbeResult } from \"./probe-shape\";\nimport {\n  McpAuthTemplate,\n  McpRemoteTransport,\n  type McpToolAnnotations,\n  parseMcpIntegrationConfig,\n  type McpIntegrationConfig as McpIntegrationConfigType,\n  type McpStdioIntegrationConfig,\n} from \"./types\";\n\nconst MCP_PLUGIN_ID = \"mcp\" as const;\n\nconst legacyOAuthClientSlugCandidate = (value: string): string | null => {\n  const slug = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug.length > 0 ? slug : null;\n};\n\nconst legacyOAuthClientSlugCandidates = (\n  slug: string,\n  integration: (Integration & { readonly config: IntegrationConfig }) | null,\n): ReadonlySet<string> => {\n  const candidates = new Set<string>();\n  const fromSlug = legacyOAuthClientSlugCandidate(slug);\n  if (fromSlug) candidates.add(fromSlug);\n  const fromDescription =\n    integration == null ? null : legacyOAuthClientSlugCandidate(integration.description);\n  if (fromDescription) candidates.add(fromDescription);\n  return candidates;\n};\n\nconst oauthClientKey = (owner: Owner, slug: OAuthClientSlug): string => `${owner}:${String(slug)}`;\n\nconst legacyMcpClientMatches = (\n  client: OAuthClientSummary,\n  candidates: ReadonlySet<string>,\n  config: McpIntegrationConfigType | null,\n): boolean => {\n  if (!candidates.has(String(client.slug))) return false;\n  if (!config || config.transport !== \"remote\" || config.auth.kind !== \"oauth2\") return false;\n  return client.grant === \"authorization_code\" && (client.resource ?? null) === config.endpoint;\n};\n\n// ---------------------------------------------------------------------------\n// Tool annotations carry an `mcp` envelope alongside the executor's policy\n// hints. The executor persists `ToolDef.annotations` verbatim into the tool\n// row's JSON column, so the real MCP tool name + upstream annotations survive\n// to `invokeTool` / `resolveAnnotations` with no plugin-side store (resolveTools\n// has no ctx to write one anyway). The envelope is opaque to core.\n// ---------------------------------------------------------------------------\n\ninterface McpToolStamp {\n  readonly toolName: string;\n  readonly upstream?: McpToolAnnotations;\n}\n\ntype StampedAnnotations = ToolAnnotations & { readonly mcp: McpToolStamp };\n\nconst McpStampSchema = Schema.Struct({\n  toolName: Schema.String,\n  upstream: Schema.optional(\n    Schema.Struct({\n      title: Schema.optional(Schema.String),\n      readOnlyHint: Schema.optional(Schema.Boolean),\n      destructiveHint: Schema.optional(Schema.Boolean),\n      idempotentHint: Schema.optional(Schema.Boolean),\n      openWorldHint: Schema.optional(Schema.Boolean),\n    }),\n  ),\n});\nconst AnnotationsWithStamp = Schema.Struct({ mcp: McpStampSchema });\nconst decodeStamp = Schema.decodeUnknownOption(AnnotationsWithStamp);\n\nconst readStamp = (annotations: unknown): McpToolStamp | null =>\n  Option.match(decodeStamp(annotations), {\n    onNone: () => null,\n    onSome: (decoded) => decoded.mcp,\n  });\n\n// ---------------------------------------------------------------------------\n// Extension input shapes — `addServer` registers an MCP integration. A\n// connection (the credential) is then created against it via\n// `executor.connections.create` / `oauth.start`.\n// ---------------------------------------------------------------------------\n\nconst McpRemoteServerInputSchema = Schema.Struct({\n  transport: Schema.optional(Schema.Literal(\"remote\")),\n  name: Schema.String,\n  endpoint: Schema.String,\n  remoteTransport: Schema.optional(McpRemoteTransport),\n  headers: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  queryParams: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  slug: Schema.optional(Schema.String),\n  /** How a connection's value is applied to requests. Defaults to none. */\n  auth: Schema.optional(McpAuthTemplate),\n});\n\nconst McpStdioServerInputSchema = Schema.Struct({\n  transport: Schema.Literal(\"stdio\"),\n  name: Schema.String,\n  command: Schema.String,\n  args: Schema.optional(Schema.Array(Schema.String)),\n  env: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  cwd: Schema.optional(Schema.String),\n  slug: Schema.optional(Schema.String),\n});\n\nconst McpAddServerInputSchema = Schema.Union([\n  McpRemoteServerInputSchema,\n  McpStdioServerInputSchema,\n]);\n\nconst McpAddServerOutputSchema = Schema.Struct({\n  slug: Schema.String,\n});\n\nconst McpProbeEndpointInputSchema = Schema.Struct({\n  endpoint: Schema.String,\n  headers: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  queryParams: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n});\n\nconst McpProbeEndpointOutputSchema = Schema.Struct({\n  connected: Schema.Boolean,\n  requiresAuthentication: Schema.Boolean,\n  requiresOAuth: Schema.Boolean,\n  supportsDynamicRegistration: Schema.Boolean,\n  name: Schema.String,\n  slug: Schema.String,\n  toolCount: Schema.NullOr(Schema.Number),\n  serverName: Schema.NullOr(Schema.String),\n});\n\n// ---------------------------------------------------------------------------\n// Extension input/output shapes — `addServer` registers an MCP integration. A\n// connection (the credential) is then created against it via\n// `executor.connections.create` / `oauth.start`. Types are inferred from the\n// schemas above so the wire shape and the TS surface can't drift.\n// ---------------------------------------------------------------------------\n\nexport type McpRemoteServerInput = typeof McpRemoteServerInputSchema.Type;\nexport type McpStdioServerInput = typeof McpStdioServerInputSchema.Type;\nexport type McpServerInput = typeof McpAddServerInputSchema.Type;\nexport type McpProbeResult = typeof McpProbeEndpointOutputSchema.Type;\nexport type McpProbeEndpointInput = typeof McpProbeEndpointInputSchema.Type;\n\nconst McpGetServerInputSchema = Schema.Struct({\n  slug: Schema.String,\n});\n\nconst McpGetServerOutputSchema = Schema.Struct({\n  integration: Schema.NullOr(Schema.Unknown),\n});\n\nconst schemaToStaticToolSchema = <A, I>(schema: Schema.Decoder<A, I>): StaticToolSchema<A, I> =>\n  Schema.toStandardSchemaV1(Schema.toStandardJSONSchemaV1(schema) as never) as StaticToolSchema<\n    A,\n    I\n  >;\n\nconst McpAddServerInputStandardSchema = schemaToStaticToolSchema(McpAddServerInputSchema);\nconst McpAddServerOutputStandardSchema = schemaToStaticToolSchema(McpAddServerOutputSchema);\nconst McpProbeEndpointInputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointInputSchema);\nconst McpProbeEndpointOutputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointOutputSchema);\nconst McpGetServerInputStandardSchema = schemaToStaticToolSchema(McpGetServerInputSchema);\nconst McpGetServerOutputStandardSchema = schemaToStaticToolSchema(McpGetServerOutputSchema);\n\nconst mcpToolFailure = (code: string, message: string, details?: unknown) =>\n  ToolResult.fail({\n    code,\n    message,\n    ...(details === undefined ? {} : { details }),\n  });\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst slugFrom = (slug: string): IntegrationSlug => IntegrationSlug.make(slug);\n\nconst normalizeSlug = (input: McpServerInput): string =>\n  input.slug ??\n  deriveMcpNamespace({\n    name: input.name,\n    endpoint: input.transport === \"stdio\" ? undefined : input.endpoint,\n    command: input.transport === \"stdio\" ? input.command : undefined,\n  });\n\nconst toIntegrationConfig = (input: McpServerInput): McpIntegrationConfigType => {\n  if (input.transport === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: input.command,\n      args: input.args ? [...input.args] : undefined,\n      env: input.env,\n      cwd: input.cwd,\n    };\n  }\n  return {\n    transport: \"remote\",\n    endpoint: input.endpoint,\n    remoteTransport: input.remoteTransport ?? \"auto\",\n    queryParams: input.queryParams,\n    headers: input.headers,\n    auth: input.auth ?? { kind: \"none\" },\n  };\n};\n\ntype JsonSchemaObject = Record<string, unknown> & {\n  readonly properties?: Record<string, unknown>;\n};\n\nconst McpCallToolResultJsonSchema = z.toJSONSchema(CallToolResultSchema) as JsonSchemaObject;\n\nconst mcpCallToolResultOutputSchema = (structuredContentSchema?: unknown): JsonSchemaObject => {\n  const defaultStructuredContentSchema =\n    McpCallToolResultJsonSchema.properties?.structuredContent ?? {};\n\n  return {\n    ...McpCallToolResultJsonSchema,\n    properties: {\n      ...McpCallToolResultJsonSchema.properties,\n      structuredContent:\n        structuredContentSchema === undefined\n          ? defaultStructuredContentSchema\n          : structuredContentSchema,\n      isError: { const: false },\n    },\n    required:\n      structuredContentSchema === undefined ? [\"content\"] : [\"content\", \"structuredContent\"],\n  };\n};\n\n/** Build the executor-facing ToolDef for one discovered MCP tool, stamping the\n *  real MCP tool name + upstream annotations into the persisted annotations so\n *  they survive to invokeTool with no plugin-side store. */\nconst toToolDef = (entry: McpToolManifestEntry): ToolDef => {\n  const destructive = entry.annotations?.destructiveHint === true;\n  const stamp: McpToolStamp = {\n    toolName: entry.toolName,\n    ...(entry.annotations ? { upstream: entry.annotations } : {}),\n  };\n  const annotations: StampedAnnotations = {\n    requiresApproval: destructive,\n    ...(destructive ? { approvalDescription: entry.annotations?.title ?? entry.toolName } : {}),\n    mcp: stamp,\n  };\n  return {\n    name: ToolName.make(entry.toolId),\n    description: entry.description ?? `MCP tool: ${entry.toolName}`,\n    inputSchema: entry.inputSchema,\n    outputSchema: mcpCallToolResultOutputSchema(entry.outputSchema),\n    annotations: annotations as ToolAnnotations,\n  };\n};\n\nconst McpTextContent = Schema.Struct({ type: Schema.Literal(\"text\"), text: Schema.String });\nconst McpToolCallEnvelope = Schema.Struct({\n  isError: Schema.optional(Schema.Boolean),\n  content: Schema.optional(Schema.Array(Schema.Unknown)),\n});\n\nconst decodeMcpTextContent = Schema.decodeUnknownOption(McpTextContent);\nconst decodeMcpToolCallEnvelope = Schema.decodeUnknownOption(McpToolCallEnvelope);\n\nconst extractMcpErrorMessage = (content: unknown): string => {\n  if (Array.isArray(content)) {\n    for (const item of content) {\n      const decoded = Option.getOrUndefined(decodeMcpTextContent(item));\n      if (decoded !== undefined && decoded.text.length > 0) return decoded.text;\n    }\n  }\n  return \"MCP tool returned an error\";\n};\n\n/** Match `token` as a separator-bounded run inside a URL hostname or path,\n *  used as a low-confidence detection hint when wire-shape detection fails. */\nconst urlMatchesToken = (url: URL, token: string): boolean => {\n  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, \"i\");\n  return re.test(url.hostname) || re.test(url.pathname);\n};\n\n/** Translate a non-MCP probe outcome into a message a user can act on.\n *  Exported for tests. */\nexport const userFacingProbeMessage = (\n  shape: Extract<McpShapeProbeResult, { kind: \"not-mcp\" } | { kind: \"unreachable\" }>,\n): string => {\n  if (shape.kind === \"unreachable\") {\n    return \"Couldn't reach this URL. Check the address, your network, and that the server is running.\";\n  }\n  return Match.value(shape.category).pipe(\n    Match.when(\n      \"auth-required\",\n      () =>\n        \"This server requires authentication. Add credentials (Authorization header, query parameter, or API key) below and retry.\",\n    ),\n    Match.when(\n      \"wrong-shape\",\n      () =>\n        \"This URL doesn't appear to host an MCP server. Double-check the address, including the path.\",\n    ),\n    Match.exhaustive,\n  );\n};\n\n// ---------------------------------------------------------------------------\n// MCP-SDK OAuth provider adapter — wraps a pre-resolved access token so the\n// transport sends it as a Bearer header. Refresh is core's responsibility\n// (the connection row carries the OAuth grant); this adapter never initiates\n// a new flow and fails loudly if the SDK tries to.\n// ---------------------------------------------------------------------------\n\nconst makeOAuthProvider = (accessToken: string): OAuthClientProvider => ({\n  get redirectUrl() {\n    return \"http://localhost/oauth/callback\";\n  },\n  get clientMetadata() {\n    return {\n      redirect_uris: [\"http://localhost/oauth/callback\"],\n      grant_types: [\"authorization_code\", \"refresh_token\"] as string[],\n      response_types: [\"code\"] as string[],\n      token_endpoint_auth_method: \"none\" as const,\n      client_name: \"Executor\",\n    };\n  },\n  clientInformation: () => undefined,\n  saveClientInformation: () => undefined,\n  tokens: () => ({ access_token: accessToken, token_type: \"Bearer\" }),\n  saveTokens: () => undefined,\n  redirectToAuthorization: async () => {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: MCP SDK OAuthClientProvider callback can only signal reauthorization by throwing\n    throw new Error(\"MCP OAuth re-authorization required\");\n  },\n  saveCodeVerifier: () => undefined,\n  codeVerifier: () => {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: MCP SDK OAuthClientProvider callback requires a thrown verifier failure\n    throw new Error(\"No active PKCE verifier\");\n  },\n  saveDiscoveryState: () => undefined,\n  discoveryState: () => undefined,\n});\n\n// ---------------------------------------------------------------------------\n// Connector input — render the integration config + the connection's resolved\n// value through the auth template into a live `ConnectorInput`.\n// ---------------------------------------------------------------------------\n\nconst buildConnectorInput = (\n  config: McpIntegrationConfigType,\n  value: string | null,\n  allowStdio: boolean,\n): Effect.Effect<ConnectorInput, McpConnectionError> => {\n  if (config.transport === \"stdio\") {\n    if (!allowStdio) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message:\n            \"MCP stdio transport is disabled. Enable it by passing `dangerouslyAllowStdioMCP: true` to mcpPlugin() — only safe for trusted local contexts.\",\n        }),\n      );\n    }\n    return Effect.succeed({\n      transport: \"stdio\" as const,\n      command: config.command,\n      args: config.args,\n      env: config.env,\n      cwd: config.cwd,\n    } satisfies McpStdioIntegrationConfig);\n  }\n\n  const headers: Record<string, string> = { ...(config.headers ?? {}) };\n  let authProvider: OAuthClientProvider | undefined;\n\n  const auth = config.auth;\n  if (auth.kind === \"header\" && value !== null) {\n    headers[auth.headerName] = auth.prefix ? `${auth.prefix}${value}` : value;\n  } else if (auth.kind === \"oauth2\" && value !== null) {\n    authProvider = makeOAuthProvider(value);\n  }\n\n  return Effect.succeed({\n    transport: \"remote\" as const,\n    endpoint: config.endpoint,\n    remoteTransport: config.remoteTransport ?? \"auto\",\n    queryParams:\n      config.queryParams && Object.keys(config.queryParams).length > 0\n        ? config.queryParams\n        : undefined,\n    headers: Object.keys(headers).length > 0 ? headers : undefined,\n    authProvider,\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Declared auth methods — project the stored MCP config into the catalog's\n// plugin-agnostic `AuthMethodDescriptor[]`. Pure and tolerant of a malformed or\n// foreign config blob (returns `[]`). Exported for tests.\n//\n//   open (`none`)        → one none method carrying no credential inputs\n//   stdio                → []          (no remote connection to configure)\n//   header               → one apikey method carrying the header placement\n//   oauth2               → one oauth method carrying the MCP endpoint to probe\n//                          (`discoveryUrl`); endpoints are discovered live at\n//                          connect time, so they are NOT pre-resolved here. We\n//                          mark `supportsDynamicRegistration: true` because MCP\n//                          OAuth servers are expected to support RFC 7591 DCR;\n//                          the connect flow probes to confirm and falls back.\n// ---------------------------------------------------------------------------\n\nexport const describeMcpAuthMethods = (\n  record: IntegrationRecord,\n): readonly AuthMethodDescriptor[] => {\n  const config = parseMcpIntegrationConfig(record.config);\n  if (!config || config.transport === \"stdio\") return [];\n\n  const auth = config.auth;\n  if (auth.kind === \"none\") {\n    return [\n      {\n        id: \"none\",\n        label: \"No authentication\",\n        kind: \"none\",\n        template: \"none\",\n      },\n    ];\n  }\n  if (auth.kind === \"header\") {\n    return [\n      {\n        id: \"header\",\n        label: \"API key (header)\",\n        kind: \"apikey\",\n        template: \"header\",\n        placements: [{ carrier: \"header\", name: auth.headerName, prefix: auth.prefix ?? \"\" }],\n      },\n    ];\n  }\n  if (auth.kind === \"oauth2\") {\n    return [\n      {\n        id: \"oauth2\",\n        label: \"OAuth\",\n        kind: \"oauth\",\n        template: \"oauth2\",\n        oauth: { discoveryUrl: config.endpoint, supportsDynamicRegistration: true },\n      },\n    ];\n  }\n  return [];\n};\n\nexport const describeMcpIntegrationDisplay = (\n  record: IntegrationRecord,\n): { readonly url?: string } => {\n  const config = parseMcpIntegrationConfig(record.config);\n  if (!config || config.transport === \"stdio\") return {};\n  return { url: config.endpoint };\n};\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\nexport interface McpPluginOptions {\n  /**\n   * Allow configuring stdio-transport MCP servers. Off by default.\n   *\n   * Stdio servers spawn a local subprocess that inherits the parent\n   * `process.env`. Only enable for trusted single-user contexts.\n   */\n  readonly dangerouslyAllowStdioMCP?: boolean;\n  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;\n}\n\nexport const mcpPlugin = definePlugin((options?: McpPluginOptions) => {\n  const allowStdio = options?.dangerouslyAllowStdioMCP ?? false;\n\n  const presetEntries = (\n    allowStdio\n      ? mcpPresets\n      : mcpPresets.filter((preset) => !(\"transport\" in preset && preset.transport === \"stdio\"))\n  ).map((preset) => ({\n    id: preset.id,\n    name: preset.name,\n    summary: preset.summary,\n    ...(\"url\" in preset && preset.url ? { url: preset.url } : {}),\n    ...(\"endpoint\" in preset && preset.endpoint ? { endpoint: preset.endpoint } : {}),\n    ...(preset.icon ? { icon: preset.icon } : {}),\n    ...(preset.featured ? { featured: preset.featured } : {}),\n    transport: (\"transport\" in preset && preset.transport === \"stdio\" ? \"stdio\" : \"remote\") as\n      | \"stdio\"\n      | \"remote\",\n    ...(\"command\" in preset ? { command: preset.command } : {}),\n    ...(\"args\" in preset && preset.args ? { args: [...preset.args] } : {}),\n    ...(\"env\" in preset && preset.env ? { env: preset.env } : {}),\n  }));\n\n  return {\n    id: MCP_PLUGIN_ID,\n    packageName: \"@executor-js/plugin-mcp\",\n    integrationPresets: presetEntries,\n    // Surfaced to the client bundle via the Vite plugin. The MCP `./client`\n    // factory reads `allowStdio` and gates the stdio tab + presets.\n    clientConfig: { allowStdio },\n    storage: () => ({}),\n\n    extension: (ctx: PluginCtx) => {\n      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;\n\n      const probeEndpoint = (input: string | McpProbeEndpointInput) =>\n        Effect.gen(function* () {\n          const endpoint = typeof input === \"string\" ? input : input.endpoint;\n          const trimmed = endpoint.trim();\n          if (!trimmed) {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: \"Endpoint URL is required\",\n            });\n          }\n\n          const name = yield* Effect.try({\n            try: () => new URL(trimmed).hostname,\n            catch: () => \"mcp\",\n          }).pipe(Effect.orElseSucceed(() => \"mcp\"));\n          const slug = deriveMcpNamespace({ endpoint: trimmed });\n\n          const probeHeaders = typeof input === \"string\" ? undefined : input.headers;\n          const probeQueryParams = typeof input === \"string\" ? undefined : input.queryParams;\n\n          const connector = createMcpConnector({\n            transport: \"remote\",\n            endpoint: trimmed,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n\n          const result = yield* discoverTools(connector).pipe(\n            Effect.map((m) => ({ ok: true as const, manifest: m })),\n            Effect.catch(() => Effect.succeed({ ok: false as const, manifest: null })),\n            Effect.withSpan(\"mcp.plugin.discover_tools\"),\n          );\n\n          if (result.ok && result.manifest) {\n            return {\n              connected: true,\n              requiresAuthentication: false,\n              requiresOAuth: false,\n              supportsDynamicRegistration: false,\n              name: result.manifest.server?.name ?? name,\n              slug,\n              toolCount: result.manifest.tools.length,\n              serverName: result.manifest.server?.name ?? null,\n            } satisfies McpProbeResult;\n          }\n\n          // Confirm the endpoint actually speaks MCP before classifying it as\n          // OAuth-protected (an OAuth-protected non-MCP service would\n          // otherwise be misclassified).\n          const shape = yield* probeMcpEndpointShape(trimmed, {\n            httpClientLayer,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n          if (shape.kind !== \"mcp\") {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: userFacingProbeMessage(shape),\n            });\n          }\n\n          const probeResult = yield* ctx.oauth.probe({ url: trimmed }).pipe(\n            Effect.map((oauth) => ({ ok: true as const, oauth })),\n            Effect.catch(() => Effect.succeed({ ok: false as const, oauth: null })),\n            Effect.withSpan(\"mcp.plugin.probe_oauth\"),\n          );\n\n          if (probeResult.ok) {\n            return {\n              connected: false,\n              requiresAuthentication: true,\n              requiresOAuth: true,\n              supportsDynamicRegistration: probeResult.oauth.registrationEndpoint != null,\n              name,\n              slug,\n              toolCount: null,\n              serverName: null,\n            } satisfies McpProbeResult;\n          }\n\n          if (shape.requiresAuth) {\n            return {\n              connected: false,\n              requiresAuthentication: true,\n              requiresOAuth: false,\n              supportsDynamicRegistration: false,\n              name,\n              slug,\n              toolCount: null,\n              serverName: null,\n            } satisfies McpProbeResult;\n          }\n\n          return yield* new McpConnectionError({\n            transport: \"remote\",\n            message:\n              \"This endpoint looks like MCP, but Executor couldn't discover tools from it. Check the URL and try again.\",\n          });\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.probe_endpoint\", {\n            attributes: { \"mcp.endpoint\": typeof input === \"string\" ? input : input.endpoint },\n          }),\n        );\n\n      const addServer = (input: McpServerInput) =>\n        Effect.gen(function* () {\n          const slug = normalizeSlug(input);\n          const config = toIntegrationConfig(input);\n\n          // Block re-adding an existing slug. The core `integrations.register`\n          // primitive upserts (so boot re-registration is idempotent), but an\n          // explicit add must NOT silently clobber an existing integration's\n          // tools, connections, and policies. To add more auth, update the\n          // existing integration instead.\n          const existing = yield* ctx.core.integrations.get(slugFrom(slug));\n          if (existing) {\n            return yield* new IntegrationAlreadyExistsError({ slug: slugFrom(slug) });\n          }\n\n          yield* ctx.core.integrations\n            .register({\n              slug: slugFrom(slug),\n              description: input.name,\n              config,\n              canRemove: true,\n              canRefresh: true,\n            })\n            .pipe(\n              Effect.withSpan(\"mcp.plugin.register_integration\", {\n                attributes: { \"mcp.integration.slug\": slug },\n              }),\n            );\n          return { slug };\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.add_server\", {\n            attributes: {\n              \"mcp.server.transport\": input.transport ?? \"remote\",\n              \"mcp.server.name\": input.name,\n            },\n          }),\n        );\n\n      const removeServer = (slug: string) =>\n        Effect.gen(function* () {\n          const integration = slugFrom(slug);\n          const record = yield* ctx.core.integrations.get(integration);\n          const config = record ? parseMcpIntegrationConfig(record.config) : null;\n          const legacyCandidates = legacyOAuthClientSlugCandidates(slug, record);\n          const connections = yield* ctx.connections.list({ integration });\n          const allConnections = yield* ctx.connections.list();\n          const oauthClientSummaries = yield* ctx.oauth.listClients();\n          const usedElsewhere = new Set(\n            allConnections\n              .filter((connection) => String(connection.integration) !== String(integration))\n              .flatMap((connection) =>\n                connection.oauthClient == null\n                  ? []\n                  : [\n                      oauthClientKey(\n                        connection.oauthClientOwner ?? connection.owner,\n                        connection.oauthClient,\n                      ),\n                    ],\n              ),\n          );\n          const oauthClientsByKey = new Map(\n            oauthClientSummaries.map((client) => [\n              oauthClientKey(client.owner, client.slug),\n              client,\n            ]),\n          );\n          const clientsToRemove = new Map<\n            string,\n            { readonly owner: Owner; readonly slug: OAuthClientSlug }\n          >();\n\n          for (const connection of connections) {\n            if (connection.oauthClient == null) continue;\n            const owner = connection.oauthClientOwner ?? connection.owner;\n            const key = oauthClientKey(owner, connection.oauthClient);\n            const client = oauthClientsByKey.get(key);\n            if (client?.origin.kind !== \"dynamic_client_registration\") continue;\n            clientsToRemove.set(key, {\n              owner,\n              slug: connection.oauthClient,\n            });\n          }\n          for (const client of oauthClientSummaries) {\n            const key = oauthClientKey(client.owner, client.slug);\n            if (usedElsewhere.has(key)) continue;\n            if (\n              client.origin.kind === \"dynamic_client_registration\" &&\n              (client.origin.integration == null || String(client.origin.integration) === slug)\n            ) {\n              clientsToRemove.set(key, { owner: client.owner, slug: client.slug });\n              continue;\n            }\n            if (legacyMcpClientMatches(client, legacyCandidates, config)) {\n              clientsToRemove.set(key, { owner: client.owner, slug: client.slug });\n            }\n          }\n\n          yield* ctx.core.integrations\n            .remove(integration)\n            .pipe(Effect.catchTag(\"IntegrationRemovalNotAllowedError\", () => Effect.void));\n\n          yield* Effect.forEach(\n            clientsToRemove.values(),\n            (client) => ctx.oauth.removeClient(client.owner, client.slug),\n            { discard: true },\n          );\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.remove_server\", {\n            attributes: { \"mcp.integration.slug\": slug },\n          }),\n        );\n\n      const getServer = (slug: string) =>\n        ctx.core.integrations.get(slugFrom(slug)).pipe(\n          Effect.withSpan(\"mcp.plugin.get_server\", {\n            attributes: { \"mcp.integration.slug\": slug },\n          }),\n        );\n\n      const configureServer = (slug: string, config: McpIntegrationConfigType) =>\n        ctx.core.integrations.update(slugFrom(slug), { config }).pipe(\n          Effect.withSpan(\"mcp.plugin.configure_server\", {\n            attributes: { \"mcp.integration.slug\": slug },\n          }),\n        );\n\n      return {\n        probeEndpoint,\n        addServer,\n        removeServer,\n        getServer,\n        configureServer,\n      };\n    },\n\n    // -----------------------------------------------------------------------\n    // Per-connection tool production. Dial the server using the connection's\n    // resolved value (rendered through the integration's auth template) and\n    // list its tools. The real MCP tool name + upstream annotations are\n    // stamped into each ToolDef's annotations so invokeTool can recover them.\n    // Discovery failures (auth not ready, server down) yield an empty tool set\n    // rather than failing — the connection still lands and can be refreshed.\n    // -----------------------------------------------------------------------\n    resolveTools: ({ config, connection, getValue }) =>\n      Effect.gen(function* () {\n        const parsed = parseMcpIntegrationConfig(config);\n        if (!parsed) return { tools: [] as readonly ToolDef[] };\n\n        const value = yield* getValue().pipe(Effect.orElseSucceed(() => null));\n\n        const built = yield* buildConnectorInput(parsed, value, allowStdio).pipe(\n          Effect.map((ci) => createMcpConnector(ci)),\n          Effect.result,\n        );\n\n        const manifest = Result.isSuccess(built)\n          ? yield* discoverTools(built.success).pipe(\n              Effect.map((m) => ({ ok: true as const, manifest: m })),\n              Effect.catch(() => Effect.succeed({ ok: false as const, manifest: null })),\n              Effect.withSpan(\"mcp.plugin.discover_tools\", {\n                attributes: { \"mcp.connection.name\": String(connection.name) },\n              }),\n            )\n          : { ok: false as const, manifest: null };\n\n        const entries = manifest.ok && manifest.manifest ? manifest.manifest.tools : [];\n        return { tools: entries.map(toToolDef) };\n      }).pipe(\n        Effect.withSpan(\"mcp.plugin.resolve_tools\", {\n          attributes: { \"mcp.connection.name\": String(connection.name) },\n        }),\n      ) as Effect.Effect<{ readonly tools: readonly ToolDef[] }, StorageFailure>,\n\n    invokeTool: ({ toolRow, credential, args, elicit }) =>\n      Effect.gen(function* () {\n        const parsed = parseMcpIntegrationConfig(credential.config);\n        if (!parsed) {\n          return yield* new McpConnectionError({\n            transport: \"auto\",\n            message: `MCP integration \"${toolRow.integration}\" has no usable config`,\n          });\n        }\n\n        const stamp = readStamp(toolRow.annotations);\n        if (!stamp) {\n          return yield* new McpToolDiscoveryError({\n            stage: \"list_tools\",\n            message: `Tool \"${toolRow.name}\" is missing its MCP binding — refresh the connection`,\n          });\n        }\n\n        const transport: string =\n          parsed.transport === \"stdio\" ? \"stdio\" : (parsed.remoteTransport ?? \"auto\");\n\n        const connector: McpConnector = yield* buildConnectorInput(\n          parsed,\n          credential.value,\n          allowStdio,\n        ).pipe(Effect.map((ci) => createMcpConnector(ci)));\n\n        const raw = yield* invokeMcpTool({\n          toolId: String(toolRow.name),\n          toolName: stamp.toolName,\n          args,\n          transport,\n          connector,\n          elicit,\n        });\n\n        const envelope = Option.getOrUndefined(decodeMcpToolCallEnvelope(raw));\n        if (envelope?.isError === true) {\n          return ToolResult.fail({\n            code: \"mcp_tool_error\",\n            message: extractMcpErrorMessage(envelope.content),\n            details: { content: envelope.content },\n          });\n        }\n        return ToolResult.ok(raw);\n      }).pipe(\n        Effect.catchTag(\"McpConnectionError\", ({ message }) =>\n          Effect.succeed(\n            authToolFailure({\n              code: \"connection_rejected\",\n              message,\n              source: { id: String(credential.integration) },\n              credential: { kind: \"upstream\", label: String(credential.connection) },\n            }),\n          ),\n        ),\n        Effect.withSpan(\"mcp.plugin.invoke_tool\", {\n          attributes: {\n            \"mcp.tool.name\": String(toolRow.name),\n            \"mcp.integration.slug\": String(toolRow.integration),\n          },\n        }),\n      ),\n\n    detect: ({ ctx, url }: { readonly ctx: PluginCtx; readonly url: string }) =>\n      Effect.gen(function* () {\n        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;\n        const trimmed = url.trim();\n        if (!trimmed) return null;\n\n        const parsed = yield* Effect.try({\n          try: () => new URL(trimmed),\n          catch: (cause) => cause,\n        }).pipe(Effect.option);\n        if (Option.isNone(parsed)) return null;\n\n        const name = parsed.value.hostname || \"mcp\";\n        const slug = deriveMcpNamespace({ endpoint: trimmed });\n\n        const connector = createMcpConnector({ transport: \"remote\", endpoint: trimmed });\n\n        const connected = yield* discoverTools(connector).pipe(\n          Effect.map(() => true),\n          Effect.catch(() => Effect.succeed(false)),\n          Effect.withSpan(\"mcp.plugin.discover_tools\"),\n        );\n\n        if (connected) {\n          return {\n            kind: MCP_PLUGIN_ID,\n            confidence: \"high\" as const,\n            endpoint: trimmed,\n            name,\n            slug,\n          };\n        }\n\n        const shape = yield* probeMcpEndpointShape(trimmed, { httpClientLayer });\n        if (shape.kind === \"mcp\") {\n          return {\n            kind: MCP_PLUGIN_ID,\n            confidence: \"high\" as const,\n            endpoint: trimmed,\n            name,\n            slug,\n          };\n        }\n\n        // Low-confidence URL-token fallback when wire-shape detection can't\n        // confirm MCP but the URL itself is a strong hint.\n        if (urlMatchesToken(parsed.value, \"mcp\")) {\n          return {\n            kind: MCP_PLUGIN_ID,\n            confidence: \"low\" as const,\n            endpoint: trimmed,\n            name,\n            slug,\n          };\n        }\n\n        return null;\n      }).pipe(\n        Effect.catch(() => Effect.succeed(null)),\n        Effect.withSpan(\"mcp.plugin.detect\", {\n          attributes: { \"mcp.endpoint\": url },\n        }),\n      ),\n\n    // Honour upstream destructiveHint from MCP ToolAnnotations using the stamp\n    // persisted in each tool row's annotations.\n    resolveAnnotations: ({ toolRows }) =>\n      Effect.sync(() => {\n        const out: Record<string, ToolAnnotations> = {};\n        for (const row of toolRows) {\n          const stamp = readStamp(row.annotations);\n          const ann = stamp?.upstream;\n          if (ann?.destructiveHint === true) {\n            out[String(row.name)] = {\n              requiresApproval: true,\n              approvalDescription: ann.title ?? stamp?.toolName ?? String(row.name),\n            };\n          } else {\n            out[String(row.name)] = { requiresApproval: false };\n          }\n        }\n        return out;\n      }),\n\n    describeAuthMethods: describeMcpAuthMethods,\n    describeIntegrationDisplay: describeMcpIntegrationDisplay,\n\n    integrationConfigure: {\n      type: \"mcp\",\n      configure: ({ ctx, integration, config }) =>\n        Effect.gen(function* () {\n          const next = parseMcpIntegrationConfig(config);\n          if (!next) return;\n          yield* ctx.core.integrations.update(integration, { config: next });\n        }),\n    },\n\n    staticSources: (self) => [\n      {\n        id: \"mcp\",\n        kind: \"executor\",\n        name: \"MCP\",\n        tools: [\n          tool({\n            name: \"probeEndpoint\",\n            description:\n              \"Probe a remote MCP endpoint before adding it. If the result requires OAuth, run the core OAuth handoff (`oauth.probe`, `oauth.start`) to mint a connection; otherwise create a connection with `connections.create` carrying the API key or header value.\",\n            inputSchema: McpProbeEndpointInputStandardSchema,\n            outputSchema: McpProbeEndpointOutputStandardSchema,\n            execute: (input) =>\n              self.probeEndpoint(input as McpProbeEndpointInput).pipe(\n                Effect.map(ToolResult.ok),\n                Effect.catchTag(\"McpConnectionError\", ({ message, transport }) =>\n                  Effect.succeed(mcpToolFailure(\"mcp_connection_failed\", message, { transport })),\n                ),\n              ),\n          }),\n          tool({\n            name: \"getServer\",\n            description:\n              \"Inspect a registered MCP integration, including transport, endpoint/command, and auth template. Use this before creating a connection (`connections.create` / `oauth.start`).\",\n            inputSchema: McpGetServerInputStandardSchema,\n            outputSchema: McpGetServerOutputStandardSchema,\n            execute: (input) => {\n              const args = input as typeof McpGetServerInputSchema.Type;\n              return Effect.map(self.getServer(args.slug), (integration) =>\n                ToolResult.ok({ integration }),\n              );\n            },\n          }),\n          tool({\n            name: \"addServer\",\n            description:\n              \"Register an MCP server in the catalog as an integration. Returns its `slug`. Then create a connection against it: for header/API-key auth call `connections.create` with the value; for OAuth-protected servers run `oauth.probe` + `oauth.start`. Tools are produced per-connection at connection create / refresh.\",\n            annotations: {\n              requiresApproval: true,\n              approvalDescription: \"Add an MCP server\",\n            },\n            inputSchema: McpAddServerInputStandardSchema,\n            outputSchema: McpAddServerOutputStandardSchema,\n            execute: (rawInput) => {\n              const input = rawInput as typeof McpAddServerInputSchema.Type;\n              return self.addServer(input as McpServerInput).pipe(\n                Effect.map(ToolResult.ok),\n                Effect.catchTag(\n                  \"IntegrationAlreadyExistsError\",\n                  ({ slug }: IntegrationAlreadyExistsError) =>\n                    Effect.succeed(\n                      mcpToolFailure(\n                        \"integration_already_exists\",\n                        `Integration ${slug} already exists; update it instead of re-adding.`,\n                      ),\n                    ),\n                ),\n              );\n            },\n          }),\n        ],\n      },\n    ],\n  };\n});\n\n// ---------------------------------------------------------------------------\n// McpPluginExtension — shape of `executor.mcp` for consumers (api/, react/).\n// ---------------------------------------------------------------------------\n\nexport type McpExtensionFailure = McpConnectionError | McpToolDiscoveryError | StorageFailure;\n\nexport interface McpPluginExtension {\n  readonly probeEndpoint: (\n    input: string | McpProbeEndpointInput,\n  ) => Effect.Effect<McpProbeResult, McpExtensionFailure>;\n  readonly addServer: (\n    input: McpServerInput,\n  ) => Effect.Effect<\n    { readonly slug: string },\n    McpExtensionFailure | IntegrationAlreadyExistsError\n  >;\n  readonly removeServer: (slug: string) => Effect.Effect<void, McpExtensionFailure>;\n  readonly getServer: (\n    slug: string,\n  ) => Effect.Effect<\n    (Integration & { readonly config: IntegrationConfig }) | null,\n    McpExtensionFailure\n  >;\n  readonly configureServer: (\n    slug: string,\n    config: McpIntegrationConfigType,\n  ) => Effect.Effect<void, McpExtensionFailure>;\n}\n","import type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { SSEClientTransport } from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { CfWorkerJsonSchemaValidator } from \"@modelcontextprotocol/sdk/validation/cfworker\";\nimport { Effect } from \"effect\";\n\n// NOTE: `StdioClientTransport` is NOT imported eagerly. The upstream module\n// (`@modelcontextprotocol/sdk/client/stdio.js`) touches `node:child_process`\n// at evaluation time, which crashes workerd (incl. vitest-pool-workers) at\n// SIGSEGV on module instantiation. Cloud callers set\n// `dangerouslyAllowStdioMCP: false` and never reach the stdio branch below;\n// prod bundles that DO use stdio load it via a dynamic import inside the\n// stdio branch of `createMcpConnector`.\n\nimport type { McpRemoteIntegrationConfig, McpStdioIntegrationConfig } from \"./types\";\nimport { McpConnectionError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Connection type\n// ---------------------------------------------------------------------------\n\nexport type McpConnection = {\n  readonly client: Client;\n  readonly close: () => Promise<void>;\n};\n\nexport type McpConnector = Effect.Effect<McpConnection, McpConnectionError>;\n\n// ---------------------------------------------------------------------------\n// Connector input — extends stored source data with resolved auth\n// ---------------------------------------------------------------------------\n\nexport type RemoteConnectorInput = Omit<\n  McpRemoteIntegrationConfig,\n  \"auth\" | \"remoteTransport\" | \"headers\" | \"queryParams\"\n> & {\n  readonly remoteTransport?: McpRemoteIntegrationConfig[\"remoteTransport\"];\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n  readonly authProvider?: OAuthClientProvider;\n};\n\nexport type StdioConnectorInput = McpStdioIntegrationConfig;\n\nexport type ConnectorInput = RemoteConnectorInput | StdioConnectorInput;\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst buildEndpointUrl = (endpoint: string, queryParams: Record<string, string>): URL => {\n  const url = new URL(endpoint);\n  for (const [key, value] of Object.entries(queryParams)) {\n    url.searchParams.set(key, value);\n  }\n  return url;\n};\n\n// Use the cfworker JSON Schema validator instead of the SDK's default\n// (Ajv). Ajv compiles schemas via `new Function(...)`, which throws\n// `Code generation from strings disallowed for this context` when the\n// MCP plugin runs inside a Cloudflare Worker (executor.sh). The\n// cfworker validator does not use code generation and works in every\n// runtime we ship to.\nconst createClient = (): Client =>\n  new Client(\n    { name: \"executor-mcp\", version: \"0.1.0\" },\n    {\n      capabilities: { elicitation: { form: {}, url: {} } },\n      jsonSchemaValidator: new CfWorkerJsonSchemaValidator(),\n    },\n  );\n\nconst connectionFromClient = (client: Client): McpConnection => ({\n  client,\n  close: () => client.close(),\n});\n\nconst connectClient = (input: {\n  transport: string;\n  createTransport: () => Parameters<Client[\"connect\"]>[0];\n}): Effect.Effect<McpConnection, McpConnectionError> =>\n  Effect.gen(function* () {\n    const client = createClient();\n    const transportInstance = input.createTransport();\n\n    yield* Effect.tryPromise({\n      try: () => client.connect(transportInstance),\n      catch: () =>\n        new McpConnectionError({\n          transport: input.transport,\n          message: `Failed connecting via ${input.transport}`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.connection.handshake\", {\n        attributes: { \"plugin.mcp.transport\": input.transport },\n      }),\n    );\n\n    return connectionFromClient(client);\n  });\n\n// ---------------------------------------------------------------------------\n// Public factory\n// ---------------------------------------------------------------------------\n\nexport const createMcpConnector = (input: ConnectorInput): McpConnector => {\n  if (input.transport === \"stdio\") {\n    const command = input.command.trim();\n    if (!command) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message: \"MCP stdio transport requires a command\",\n        }),\n      );\n    }\n\n    return Effect.gen(function* () {\n      // Dynamic import so the underlying module (which evaluates\n      // `node:child_process`) is only loaded when stdio is actually used.\n      const { createStdioTransport } = yield* Effect.tryPromise({\n        try: () => import(\"./stdio-connector\"),\n        catch: () =>\n          new McpConnectionError({\n            transport: \"stdio\",\n            message: \"Failed to load stdio transport module\",\n          }),\n      });\n\n      return yield* connectClient({\n        transport: \"stdio\",\n        createTransport: () =>\n          createStdioTransport({\n            command,\n            args: input.args,\n            env: input.env,\n            cwd: input.cwd?.trim().length ? input.cwd.trim() : undefined,\n          }),\n      });\n    });\n  }\n\n  // Remote transport\n  const headers = input.headers ?? {};\n  const remoteTransport = input.remoteTransport ?? \"auto\";\n  const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;\n\n  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});\n\n  const connectStreamableHttp = connectClient({\n    transport: \"streamable-http\",\n    createTransport: () =>\n      new StreamableHTTPClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  const connectSse = connectClient({\n    transport: \"sse\",\n    createTransport: () =>\n      new SSEClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  if (remoteTransport === \"streamable-http\") return connectStreamableHttp;\n  if (remoteTransport === \"sse\") return connectSse;\n\n  // auto — try streamable-http first, fall back to SSE\n  return connectStreamableHttp.pipe(Effect.catch(() => connectSse));\n};\n","// ---------------------------------------------------------------------------\n// MCP tool discovery — connect to an MCP server and list its tools\n// ---------------------------------------------------------------------------\n\nimport { Effect } from \"effect\";\n\nimport type { McpConnector } from \"./connection\";\nimport { McpToolDiscoveryError } from \"./errors\";\nimport {\n  extractManifestFromListToolsResult,\n  isListToolsResult,\n  type McpToolManifest,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Connect to an MCP server and discover all available tools.\n * Returns the parsed manifest containing server metadata and tool entries.\n */\nexport const discoverTools = (\n  connector: McpConnector,\n): Effect.Effect<McpToolManifest, McpToolDiscoveryError> =>\n  Effect.gen(function* () {\n    // Acquire connection\n    const connection = yield* connector.pipe(\n      Effect.mapError(\n        ({ message }) =>\n          new McpToolDiscoveryError({\n            stage: \"connect\",\n            message: `Failed connecting to MCP server: ${message}`,\n          }),\n      ),\n    );\n\n    // List tools\n    const listResult = yield* Effect.tryPromise({\n      try: () => connection.client.listTools(),\n      catch: () =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"Failed listing MCP tools\",\n        }),\n    });\n\n    if (!isListToolsResult(listResult)) {\n      yield* closeConnection(connection);\n      return yield* new McpToolDiscoveryError({\n        stage: \"list_tools\",\n        message: \"MCP listTools response did not match the expected schema\",\n      });\n    }\n\n    const manifest = extractManifestFromListToolsResult(listResult, {\n      serverInfo: connection.client.getServerVersion?.(),\n    });\n\n    // Close the connection after discovery\n    yield* closeConnection(connection);\n\n    return manifest;\n  });\n\nconst closeConnection = (connection: {\n  readonly close: () => Promise<void>;\n}): Effect.Effect<void, never> =>\n  Effect.ignore(\n    Effect.tryPromise({\n      try: () => connection.close(),\n      catch: () =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"Failed closing MCP connection\",\n        }),\n    }),\n  );\n","// ---------------------------------------------------------------------------\n// MCP tool invocation — shared helper called from plugin.invokeTool.\n//\n// Responsible for:\n//   1. Dialing a fresh MCP client connection for the call (no DB-connection\n//      caching — request-scoped per the Hyperdrive rule; each invoke acquires\n//      and releases its own connection).\n//   2. Installing a per-invocation `ElicitRequestSchema` handler that bridges\n//      MCP's elicit capability into the host's elicit function threaded via\n//      `InvokeToolInput.elicit`.\n//   3. Calling `client.callTool({ name, arguments })`.\n// ---------------------------------------------------------------------------\n\nimport { Cause, Effect, Exit, Option, Predicate, Schema } from \"effect\";\n\nimport { ElicitRequestSchema } from \"@modelcontextprotocol/sdk/types.js\";\n\nimport {\n  ElicitationId,\n  FormElicitation,\n  UrlElicitation,\n  type Elicit,\n  type ElicitationRequest,\n} from \"@executor-js/sdk/core\";\n\nimport { McpConnectionError, McpInvocationError } from \"./errors\";\nimport type { McpConnection, McpConnector } from \"./connection\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst ArgsRecord = Schema.Record(Schema.String, Schema.Unknown);\nconst decodeArgsRecord = Schema.decodeUnknownOption(ArgsRecord);\n\nconst argsRecord = (value: unknown): Record<string, unknown> =>\n  Option.getOrElse(decodeArgsRecord(value), () => ({}));\n\n// ---------------------------------------------------------------------------\n// Elicitation bridge — decode incoming MCP ElicitRequest, route through\n// the host's elicit function, marshal the response back to MCP shape.\n// ---------------------------------------------------------------------------\n\nconst McpElicitParams = Schema.Union([\n  Schema.Struct({\n    mode: Schema.Literal(\"url\"),\n    message: Schema.String,\n    url: Schema.String,\n    elicitationId: Schema.optional(Schema.String),\n    id: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    mode: Schema.optional(Schema.Literal(\"form\")),\n    message: Schema.String,\n    requestedSchema: Schema.Record(Schema.String, Schema.Unknown),\n  }),\n]);\ntype McpElicitParams = typeof McpElicitParams.Type;\n\nconst decodeElicitParams = Schema.decodeUnknownSync(McpElicitParams);\n\nconst toElicitationRequest = (params: McpElicitParams): ElicitationRequest =>\n  params.mode === \"url\"\n    ? UrlElicitation.make({\n        message: params.message,\n        url: params.url,\n        elicitationId: ElicitationId.make(params.elicitationId ?? params.id ?? \"\"),\n      })\n    : FormElicitation.make({\n        message: params.message,\n        requestedSchema: params.requestedSchema,\n      });\n\nconst installElicitationHandler = (client: McpConnection[\"client\"], elicit: Elicit): void => {\n  client.setRequestHandler(ElicitRequestSchema, async (request: { params: unknown }) => {\n    const params = decodeElicitParams(request.params);\n    const req = toElicitationRequest(params);\n    // Use runPromiseExit so we can inspect typed failures — `elicit`\n    // fails with `ElicitationDeclinedError` on decline/cancel, which\n    // we translate into the equivalent MCP elicit response instead of\n    // surfacing as a JSON-RPC error.\n    const exit = await Effect.runPromiseExit(elicit(req));\n    if (Exit.isSuccess(exit)) {\n      const response = exit.value;\n      return {\n        action: response.action,\n        ...(response.action === \"accept\" && response.content ? { content: response.content } : {}),\n      };\n    }\n    const failure = exit.cause.reasons.find(Cause.isFailReason);\n    if (failure) {\n      const err = failure.error;\n      if (Predicate.isTagged(err, \"ElicitationDeclinedError\")) {\n        const action =\n          Predicate.hasProperty(err, \"action\") && err.action === \"cancel\" ? \"cancel\" : \"decline\";\n        return { action };\n      }\n    }\n    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: MCP SDK async request handlers signal unexpected failures by rejecting\n    throw Cause.squash(exit.cause);\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Single tool call — install handler, callTool, return raw result\n// ---------------------------------------------------------------------------\n\nconst useConnection = (\n  connection: McpConnection,\n  toolName: string,\n  args: Record<string, unknown>,\n  elicit: Elicit,\n): Effect.Effect<unknown, McpInvocationError> =>\n  Effect.gen(function* () {\n    installElicitationHandler(connection.client, elicit);\n    return yield* Effect.tryPromise({\n      try: () => connection.client.callTool({ name: toolName, arguments: args }),\n      catch: () =>\n        new McpInvocationError({\n          toolName,\n          message: `MCP tool call failed for ${toolName}`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.client.call_tool\", {\n        attributes: { \"mcp.tool.name\": toolName },\n      }),\n    );\n  });\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport interface InvokeMcpToolInput {\n  readonly toolId: string;\n  /** The real MCP tool name advertised by the server. */\n  readonly toolName: string;\n  readonly args: unknown;\n  readonly transport: string;\n  /** Dials a fresh connection. The connection is closed after the call. */\n  readonly connector: McpConnector;\n  readonly elicit: Elicit;\n}\n\nexport const invokeMcpTool = (\n  input: InvokeMcpToolInput,\n): Effect.Effect<unknown, McpConnectionError | McpInvocationError> =>\n  Effect.gen(function* () {\n    const args = argsRecord(input.args);\n\n    const connection = yield* Effect.acquireRelease(\n      input.connector.pipe(\n        Effect.withSpan(\"plugin.mcp.connection.acquire\", {\n          attributes: { \"plugin.mcp.transport\": input.transport },\n        }),\n      ),\n      (conn) =>\n        Effect.ignore(\n          Effect.tryPromise({\n            try: () => conn.close(),\n            catch: () =>\n              new McpConnectionError({\n                transport: input.transport,\n                message: \"Failed to close MCP connection\",\n              }),\n          }),\n        ),\n    );\n\n    return yield* useConnection(connection, input.toolName, args, input.elicit);\n  }).pipe(\n    Effect.scoped,\n    Effect.withSpan(\"plugin.mcp.invoke\", {\n      attributes: {\n        \"mcp.tool.name\": input.toolName,\n        \"plugin.mcp.tool_id\": input.toolId,\n        \"plugin.mcp.transport\": input.transport,\n      },\n    }),\n  );\n","// ---------------------------------------------------------------------------\n// MCP endpoint shape probe — decide whether an unknown HTTP endpoint is\n// actually speaking MCP before we try to classify it as such.\n//\n// Background:\n//\n//   `discoverTools` (via the MCP SDK's StreamableHTTP / SSE transport)\n//   fails for every non-MCP endpoint too — 200-with-HTML, 400-GraphQL,\n//   404, etc. all surface as the same opaque transport error. We need\n//   our own classifier that distinguishes \"real MCP\" from\n//   \"OAuth-protected non-MCP service\" without relying on RFC 9728/8414\n//   metadata, since (a) plenty of non-MCP APIs publish that metadata,\n//   and (b) plenty of real MCP servers authenticate with static API\n//   keys and publish no OAuth metadata at all (e.g. cubic.dev).\n//\n// The probe issues an unauth JSON-RPC `initialize` POST and accepts\n// only the wire shapes a real MCP server can return:\n//\n//   - 2xx with `Content-Type: text/event-stream` — streamable HTTP\n//     transport, body is an SSE stream we don't consume.\n//   - 2xx with `Content-Type: application/json` whose body parses as a\n//     JSON-RPC 2.0 envelope (`{jsonrpc:\"2.0\", result|error|method,...}`).\n//   - 401 with `WWW-Authenticate: Bearer` AND a JSON-RPC error envelope\n//     in the body. The body shape is what separates a real MCP server\n//     from an unrelated OAuth-protected API: GraphQL/REST/HTML 401s\n//     don't shape themselves as JSON-RPC.\n//\n// When POST returns 404/405/406/415 we retry with GET + `Accept:\n// text/event-stream` to support legacy SSE-only servers; that path\n// only accepts 2xx with `text/event-stream` or the same 401+Bearer\n// shape.\n//\n// One `fetch` (occasionally two), no MCP-SDK session state, no OAuth\n// round-trip, no DCR — every non-MCP endpoint exits here.\n// ---------------------------------------------------------------------------\n\nimport { Data, Duration, Effect, Layer, Option, Schema } from \"effect\";\nimport { FetchHttpClient, HttpClient, HttpClientRequest } from \"effect/unstable/http\";\n\n/** MCP initialize request body used as the shape probe. Any real MCP\n *  server either answers it (unauth-OK server) or returns the spec-\n *  mandated 401 + WWW-Authenticate pair. A non-MCP endpoint hit with\n *  this body will respond with whatever it does for unknown JSON\n *  payloads — 400, 404, HTML, a GraphQL error envelope, etc. — none of\n *  which match the gate below. */\nconst INITIALIZE_BODY = JSON.stringify({\n  jsonrpc: \"2.0\",\n  id: 1,\n  method: \"initialize\",\n  params: {\n    protocolVersion: \"2025-06-18\",\n    capabilities: {},\n    clientInfo: { name: \"executor-probe\", version: \"0\" },\n  },\n});\n\n/** Header-name lookup is case-insensitive per RFC 7230. `fetch`'s\n *  `Response.headers` already lower-cases, but we normalise explicitly\n *  to stay robust against test mocks that construct `Headers` loosely. */\nconst readHeader = (headers: Readonly<Record<string, string>>, name: string): string | null => {\n  const direct = headers[name];\n  if (direct !== undefined) return direct;\n  const lower = name.toLowerCase();\n  for (const [k, v] of Object.entries(headers)) {\n    if (k.toLowerCase() === lower) return v;\n  }\n  return null;\n};\n\nclass ProbeTransportError extends Data.TaggedError(\"ProbeTransportError\")<{\n  readonly reason: string;\n  readonly cause: unknown;\n}> {}\n\nconst decodeJsonString = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown));\n\nconst asObject = (body: string): Record<string, unknown> | null => {\n  if (!body) return null;\n  const parsed = decodeJsonString(body);\n  if (Option.isNone(parsed)) return null;\n  const value = parsed.value;\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return null;\n  return value as Record<string, unknown>;\n};\n\n/** Quick check that a body parses as a JSON-RPC 2.0 envelope. The MCP wire\n *  protocol is JSON-RPC 2.0, so a real MCP server's response to `initialize`\n *  (whether 2xx with the result, or a 401 error envelope) carries this\n *  shape. Non-MCP services don't — GraphQL APIs return `{errors:[...]}`,\n *  REST APIs return their own envelope, marketing pages return HTML. */\nconst isJsonRpcEnvelope = (body: string): boolean => {\n  const obj = asObject(body);\n  if (!obj) return false;\n  if (obj.jsonrpc !== \"2.0\") return false;\n  return \"result\" in obj || \"error\" in obj || \"method\" in obj;\n};\n\n/** Quick check that a body parses as an RFC 6750 OAuth Bearer error\n *  envelope (`{error: \"invalid_token\", error_description?: ..., ...}`).\n *  Real MCP servers like Atlassian return this shape on unauth requests\n *  even when their WWW-Authenticate omits `resource_metadata=`. The\n *  GraphQL `{errors: [...]}` envelope, which a non-MCP OAuth-protected\n *  GraphQL API would return, is explicitly excluded. */\nconst isOAuthErrorBody = (body: string): boolean => {\n  const obj = asObject(body);\n  if (!obj) return false;\n  if (Array.isArray(obj.errors)) return false;\n  return typeof obj.error === \"string\";\n};\n\n/** RFC 9728 protected-resource-metadata document. We only need the two\n *  fields that prove the document genuinely describes an OAuth-protected\n *  resource: `resource` (the resource identifier) and a non-empty\n *  `authorization_servers` list. */\nconst ProtectedResourceMetadata = Schema.Struct({\n  resource: Schema.String,\n  authorization_servers: Schema.Array(Schema.String),\n});\nconst decodeProtectedResourceMetadata = Schema.decodeUnknownOption(\n  Schema.fromJsonString(ProtectedResourceMetadata),\n);\n\n/** RFC 9728 §3.1 path-scoped well-known URL: insert\n *  `/.well-known/oauth-protected-resource` before the resource's path\n *  component. `https://host/api/mcp` → `https://host/.well-known/oauth-\n *  protected-resource/api/mcp`. This is exactly the URL the MCP\n *  authorization spec tells clients to construct. */\nconst protectedResourceMetadataUrl = (endpoint: URL): string => {\n  const path = endpoint.pathname === \"/\" ? \"\" : endpoint.pathname;\n  return `${endpoint.origin}/.well-known/oauth-protected-resource${path}`;\n};\n\n/** The RFC 9728 `resource` value must actually describe this endpoint\n *  before we trust the document — an exact URL match, or a same-origin\n *  parent whose path is a prefix of the endpoint's. Guards against a\n *  shared host serving protected-resource metadata for some unrelated\n *  resource. */\nconst resourceMatchesEndpoint = (resource: string, endpoint: URL): boolean => {\n  if (!URL.canParse(resource)) return false;\n  const parsed = new URL(resource);\n  if (parsed.origin !== endpoint.origin) return false;\n  const resourcePath = parsed.pathname.replace(/\\/+$/, \"\");\n  const endpointPath = endpoint.pathname.replace(/\\/+$/, \"\");\n  return endpointPath === resourcePath || endpointPath.startsWith(`${resourcePath}/`);\n};\n\n/** Workaround for MCP servers that omit (or under-specify) the\n *  `WWW-Authenticate` challenge on their 401 — e.g. Datadog's\n *  `mcp.datadoghq.com` returns a bare `401 {\"errors\":[\"Unauthorized\"]}`\n *  with no header at all, so the wire-shape gate above can't tell it\n *  apart from an unrelated OAuth-protected API and the user lands on the\n *  manual-credentials prompt instead of an OAuth sign-in.\n *\n *  The MCP authorization spec still requires such servers to publish\n *  RFC 9728 metadata at the path-scoped well-known URL. A document there\n *  whose `resource` matches this endpoint is a deliberate, MCP-spec-\n *  specific signal a generic OAuth API would not emit — strong enough to\n *  classify the endpoint as MCP so the OAuth flow can start. */\nconst probeProtectedResourceMetadata = (\n  client: HttpClient.HttpClient,\n  endpoint: URL,\n  timeoutMs: number,\n): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    const response = yield* client\n      .execute(\n        HttpClientRequest.get(protectedResourceMetadataUrl(endpoint)).pipe(\n          HttpClientRequest.setHeader(\"accept\", \"application/json\"),\n        ),\n      )\n      .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n    if (response.status < 200 || response.status >= 300) return false;\n    const body = yield* response.text.pipe(\n      Effect.timeout(Duration.millis(timeoutMs)),\n      Effect.catch(() => Effect.succeed(\"\")),\n    );\n    const metadata = decodeProtectedResourceMetadata(body);\n    if (Option.isNone(metadata)) return false;\n    if (metadata.value.authorization_servers.length === 0) return false;\n    return resourceMatchesEndpoint(metadata.value.resource, endpoint);\n  }).pipe(Effect.catch(() => Effect.succeed(false)));\n\nconst ErrorMessageShape = Schema.Struct({ message: Schema.String });\nconst decodeErrorMessageShape = Schema.decodeUnknownOption(ErrorMessageShape);\n\nconst reasonFromBoundaryCause = (cause: unknown): string => {\n  const messageShape = decodeErrorMessageShape(cause);\n  if (Option.isSome(messageShape)) return messageShape.value.message;\n  if (typeof cause === \"string\") return cause;\n  if (typeof cause === \"number\" || typeof cause === \"boolean\" || typeof cause === \"bigint\") {\n    return `${cause}`;\n  }\n  if (typeof cause === \"symbol\") return cause.description ?? \"symbol\";\n  if (cause === null) return \"null\";\n  if (typeof cause === \"undefined\") return \"undefined\";\n  return \"fetch failed\";\n};\n\n/** Why the probe rejected an endpoint as not-MCP.\n *\n *  - `auth-required` — server returned 401. We don't know for sure it's\n *    an MCP server (no spec-compliant Bearer challenge or the body\n *    isn't JSON-RPC), but the right next step for the user is the same\n *    either way: provide credentials and retry. This is what\n *    misclassifies real MCP servers like cubic.dev (no\n *    resource_metadata) or ref.tools (no WWW-Authenticate at all)\n *    without the URL-token fallback at the detect layer.\n *  - `wrong-shape` — endpoint responded but with a body or status that\n *    doesn't match any MCP shape (200 HTML, 400 GraphQL, 404 from a\n *    static host, etc.). User action: this URL probably isn't MCP. */\nexport type McpProbeRejectCategory = \"auth-required\" | \"wrong-shape\";\n\nexport type McpShapeProbeResult =\n  /** Server answered initialize successfully — either a 2xx with a\n   *  JSON-RPC payload, or a 401 + WWW-Authenticate: Bearer (RFC 6750\n   *  challenge) that the MCP auth spec requires. */\n  | { readonly kind: \"mcp\"; readonly requiresAuth: boolean }\n  /** Endpoint is reachable but the response does not look like MCP. */\n  | {\n      readonly kind: \"not-mcp\";\n      readonly reason: string;\n      readonly category: McpProbeRejectCategory;\n    }\n  /** Transport-level failure (DNS, TLS, timeout, abort, ...). */\n  | { readonly kind: \"unreachable\"; readonly reason: string };\n\nexport interface ProbeOptions {\n  /** Abort the request after this many ms. Default 8000. */\n  readonly timeoutMs?: number;\n  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n}\n\n/**\n * Hit `endpoint` with a JSON-RPC `initialize` POST and classify the\n * response according to the MCP authorization spec.\n *\n * Returns `{kind: \"mcp\"}` only when the endpoint either:\n *   - answers with 2xx (unauth-OK MCP server), or\n *   - responds 401 with a `Bearer` WWW-Authenticate challenge.\n *\n * Anything else (400, 404, 200-with-HTML, 200-with-GraphQL-errors, ...)\n * is classified `not-mcp`. Transport errors surface as `unreachable`.\n */\nexport const probeMcpEndpointShape = (\n  endpoint: string,\n  options: ProbeOptions = {},\n): Effect.Effect<McpShapeProbeResult> =>\n  Effect.gen(function* () {\n    const timeoutMs = options.timeoutMs ?? 8_000;\n    const outcome = yield* Effect.gen(function* () {\n      const client = yield* HttpClient.HttpClient;\n\n      const readBody = (response: {\n        readonly text: Effect.Effect<string, unknown>;\n      }): Effect.Effect<string> =>\n        response.text.pipe(\n          Effect.timeout(Duration.millis(timeoutMs)),\n          Effect.catch(() => Effect.succeed(\"\")),\n        );\n\n      const classify = (\n        response: {\n          readonly status: number;\n          readonly headers: Readonly<Record<string, string>>;\n          readonly text: Effect.Effect<string, unknown>;\n        },\n        method: \"GET\" | \"POST\",\n      ): Effect.Effect<McpShapeProbeResult | null> =>\n        Effect.gen(function* () {\n          const contentType = readHeader(response.headers, \"content-type\") ?? \"\";\n          const isSse = /^\\s*text\\/event-stream\\b/i.test(contentType);\n\n          if (response.status === 401) {\n            const wwwAuth = readHeader(response.headers, \"www-authenticate\");\n            if (!wwwAuth || !/^\\s*bearer\\b/i.test(wwwAuth)) {\n              // Spec-non-compliant 401 (no `Bearer` challenge). Before\n              // giving up, check whether the server still publishes\n              // RFC 9728 protected-resource metadata for this path —\n              // some real MCP servers (Datadog) do exactly this.\n              if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {\n                return { kind: \"mcp\", requiresAuth: true } as const;\n              }\n              return {\n                kind: \"not-mcp\",\n                category: \"auth-required\",\n                reason: \"401 without Bearer WWW-Authenticate — not an MCP auth challenge\",\n              } as const;\n            }\n            // Spec-compliant MCP signal: the auth spec mandates a\n            // `resource_metadata=` attribute pointing at the server's\n            // RFC 9728 document. Real OAuth-protected MCP servers\n            // (sentry.dev, etc.) include it. This attribute is rare on\n            // unrelated OAuth services and is the cleanest accept signal\n            // we have when the 401 body is RFC 6750 OAuth-shape rather\n            // than JSON-RPC.\n            if (/(?:^|[\\s,])resource_metadata\\s*=/i.test(wwwAuth)) {\n              return { kind: \"mcp\", requiresAuth: true } as const;\n            }\n            // Looser RFC 6750 §3.1 signal: the Bearer challenge carries\n            // `error=` / `error_description=` auth-params. Real MCP\n            // servers (Supabase, GitHub Copilot, Vercel, Neon, Tavily,\n            // Replicate, ...) include this even when they omit\n            // `resource_metadata=`. The body alone isn't enough for\n            // those — Supabase, e.g., returns `{\"message\":\"Unauthorized\"}`\n            // which is neither JSON-RPC nor RFC 6750. The `error=`\n            // auth-param is the tiebreaker.\n            if (/(?:^|[\\s,])error\\s*=/i.test(wwwAuth)) {\n              return { kind: \"mcp\", requiresAuth: true } as const;\n            }\n            // SSE responses can't carry a JSON-RPC error envelope; accept the\n            // Bearer challenge alone in that case (rare but spec-permissible).\n            if (isSse) return { kind: \"mcp\", requiresAuth: true } as const;\n            // Fallback for MCP servers whose 401 omits\n            // `resource_metadata=`. Two body shapes count:\n            //   - JSON-RPC error (cubic.dev: API-key auth, JSON-RPC\n            //     errors end-to-end).\n            //   - RFC 6750 OAuth Bearer error envelope `{error:\n            //     \"invalid_token\", ...}` without GraphQL `{errors:[...]}`\n            //     (Atlassian).\n            // Non-MCP OAuth-protected services that issue bare Bearer\n            // challenges (Railway-style GraphQL, etc.) return `errors`\n            // arrays or other shapes that fail both checks.\n            const body = yield* readBody(response);\n            if (!isJsonRpcEnvelope(body) && !isOAuthErrorBody(body)) {\n              // Bearer challenge with no usable accept signal. Same\n              // RFC 9728 fallback as the no-`Bearer` case above.\n              if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {\n                return { kind: \"mcp\", requiresAuth: true } as const;\n              }\n              return {\n                kind: \"not-mcp\",\n                category: \"auth-required\",\n                reason:\n                  \"401 + Bearer without resource_metadata, JSON-RPC body, or OAuth error body\",\n              } as const;\n            }\n            return { kind: \"mcp\", requiresAuth: true } as const;\n          }\n\n          if (response.status >= 200 && response.status < 300) {\n            if (method === \"GET\") {\n              if (!isSse) {\n                return {\n                  kind: \"not-mcp\",\n                  category: \"wrong-shape\",\n                  reason: \"GET response is not an SSE stream\",\n                } as const;\n              }\n              return { kind: \"mcp\", requiresAuth: false } as const;\n            }\n            // POST 2xx: SSE body is opaque to us; otherwise require a\n            // JSON-RPC envelope so we don't accept HTML/REST 200 responses.\n            if (isSse) return { kind: \"mcp\", requiresAuth: false } as const;\n            const body = yield* readBody(response);\n            if (!isJsonRpcEnvelope(body)) {\n              return {\n                kind: \"not-mcp\",\n                category: \"wrong-shape\",\n                reason: \"2xx POST body is not a JSON-RPC envelope\",\n              } as const;\n            }\n            return { kind: \"mcp\", requiresAuth: false } as const;\n          }\n\n          return null;\n        });\n\n      const url = new URL(endpoint);\n      for (const [key, value] of Object.entries(options.queryParams ?? {})) {\n        url.searchParams.set(key, value);\n      }\n\n      let postRequest = HttpClientRequest.post(url.toString()).pipe(\n        HttpClientRequest.setHeader(\"content-type\", \"application/json\"),\n        HttpClientRequest.setHeader(\"accept\", \"application/json, text/event-stream\"),\n        HttpClientRequest.bodyText(INITIALIZE_BODY, \"application/json\"),\n      );\n      for (const [name, value] of Object.entries(options.headers ?? {})) {\n        postRequest = HttpClientRequest.setHeader(postRequest, name, value);\n      }\n\n      const postResponse = yield* client\n        .execute(postRequest)\n        .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n\n      const postResult = yield* classify(postResponse, \"POST\");\n      if (postResult) return postResult;\n\n      if ([404, 405, 406, 415].includes(postResponse.status)) {\n        let getRequest = HttpClientRequest.get(url.toString()).pipe(\n          HttpClientRequest.setHeader(\"accept\", \"text/event-stream\"),\n        );\n        for (const [name, value] of Object.entries(options.headers ?? {})) {\n          getRequest = HttpClientRequest.setHeader(getRequest, name, value);\n        }\n        const getResponse = yield* client\n          .execute(getRequest)\n          .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n        const getResult = yield* classify(getResponse, \"GET\");\n        if (getResult) return getResult;\n      }\n\n      return {\n        kind: \"not-mcp\",\n        category: \"wrong-shape\",\n        reason: `unexpected status ${postResponse.status} for initialize`,\n      } as const;\n    }).pipe(\n      Effect.provide(options.httpClientLayer ?? FetchHttpClient.layer),\n      Effect.mapError(\n        (cause) =>\n          new ProbeTransportError({\n            reason: reasonFromBoundaryCause(cause),\n            cause,\n          }),\n      ),\n      Effect.catch((cause) =>\n        Effect.succeed<McpShapeProbeResult>({\n          kind: \"unreachable\",\n          reason: cause.reason,\n        }),\n      ),\n    );\n\n    return outcome;\n  }).pipe(Effect.withSpan(\"mcp.plugin.probe_shape\"));\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,QAAQ,cAAc;AA+B/B,IAAM,aAAa,OAAO,OAAO;AAAA,EAC/B,MAAM,OAAO;AAAA,EACb,aAAa,OAAO,SAAS,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EACzD,aAAa,OAAO,SAAS,OAAO,OAAO;AAAA,EAC3C,YAAY,OAAO,SAAS,OAAO,OAAO;AAAA,EAC1C,cAAc,OAAO,SAAS,OAAO,OAAO;AAAA,EAC5C,aAAa,OAAO,SAAS,kBAAkB;AACjD,CAAC;AAED,IAAM,kBAAkB,OAAO,OAAO;AAAA,EACpC,OAAO,OAAO,MAAM,UAAU;AAChC,CAAC;AAED,IAAM,aAAa,OAAO,OAAO;AAAA,EAC/B,MAAM,OAAO,SAAS,OAAO,MAAM;AAAA,EACnC,SAAS,OAAO,SAAS,OAAO,MAAM;AACxC,CAAC;AAED,IAAM,wBAAwB,OAAO,oBAAoB,eAAe;AACxE,IAAM,mBAAmB,OAAO,oBAAoB,UAAU;AAEvD,IAAM,oBAAoB,CAAC,UAChC,OAAO,OAAO,sBAAsB,KAAK,CAAC;AAM5C,IAAM,WAAW,CAAC,UAA0B;AAC1C,QAAM,IAAI,MACP,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK;AACd;AAEA,IAAM,WAAW,CAAC,OAAe,SAAsC;AACrE,QAAM,OAAO,SAAS,KAAK;AAC3B,QAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK;AAClC,OAAK,IAAI,MAAM,CAAC;AAChB,SAAO,MAAM,IAAI,OAAO,GAAG,IAAI,IAAI,CAAC;AACtC;AAMO,IAAM,eAAe,CAAC,WAA+B,WAC1D,WAAW,KAAK,IAAI,GAAG,SAAS,IAAI,MAAM,KAAK;AAE1C,IAAM,qCAAqC,CAChD,iBACA,aACoB;AACpB,QAAM,OAAO,oBAAI,IAAoB;AAErC,QAAM,SAAS,sBAAsB,eAAe,EAAE;AAAA,IACpD,OAAO,IAAI,CAAC,WAAW,OAAO,KAAK;AAAA,IACnC,OAAO,UAAU,MAAM,CAAC,CAAC;AAAA,EAC3B;AAEA,QAAM,SAAS,iBAAiB,UAAU,UAAU,EAAE;AAAA,IACpD,OAAO;AAAA,MACL,CAAC,UAA6B;AAAA,QAC5B,MAAM,KAAK,QAAQ;AAAA,QACnB,SAAS,KAAK,WAAW;AAAA,MAC3B;AAAA,IACF;AAAA,IACA,OAAO;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,QAAQ,CAACA,UAAiC;AAC7D,UAAM,WAAWA,MAAK,KAAK,KAAK;AAChC,QAAI,CAAC,SAAU,QAAO,CAAC;AAEvB,WAAO;AAAA,MACL;AAAA,QACE,QAAQ,SAAS,UAAU,IAAI;AAAA,QAC/B;AAAA,QACA,aAAaA,MAAK,eAAe;AAAA,QACjC,aAAaA,MAAK,eAAeA,MAAK;AAAA,QACtC,cAAcA,MAAK;AAAA,QACnB,aAAaA,MAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,MAAM;AACzB;AAMA,IAAM,UAAU,CAAC,UACf,MACG,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAE3B,IAAM,aAAa,CAAC,QAA+B;AACjD,MAAI,CAAC,IAAI,SAAS,GAAG,EAAG,QAAO;AAC/B,SAAO,IAAI,IAAI,GAAG,EAAE;AACtB;AAEA,IAAM,aAAa,CAAC,SAAyB,KAAK,KAAK,EAAE,MAAM,OAAO,EAAE,IAAI,KAAK,KAAK,KAAK;AAEpF,IAAM,qBAAqB,CAAC,UAIrB;AACZ,MAAI,MAAM,MAAM,KAAK,EAAG,QAAO,QAAQ,MAAM,IAAI,KAAK;AAEtD,QAAM,eAAe,MAAM,UAAU,KAAK,IAAI,WAAW,MAAM,QAAQ,IAAI;AAC3E,MAAI,aAAc,QAAO,QAAQ,YAAY,KAAK;AAElD,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO,QAAQ,WAAW,MAAM,OAAO,CAAC,KAAK;AAExE,SAAO;AACT;;;ACxJA,SAAS,UAAAC,SAAe,OAAO,UAAAC,SAAQ,QAAQ,UAAAC,eAAc;AAI7D,SAAS,4BAA4B;AACrC,YAAY,OAAO;AAEnB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAYA;AAAA,OACK;;;AC1BP,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAC9C,SAAS,mCAAmC;AAC5C,SAAS,cAAc;AA8CvB,IAAM,mBAAmB,CAAC,UAAkB,gBAA6C;AACvF,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,SAAO;AACT;AAQA,IAAM,eAAe,MACnB,IAAI;AAAA,EACF,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,EACzC;AAAA,IACE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE;AAAA,IACnD,qBAAqB,IAAI,4BAA4B;AAAA,EACvD;AACF;AAEF,IAAM,uBAAuB,CAAC,YAAmC;AAAA,EAC/D;AAAA,EACA,OAAO,MAAM,OAAO,MAAM;AAC5B;AAEA,IAAM,gBAAgB,CAAC,UAIrB,OAAO,IAAI,aAAa;AACtB,QAAM,SAAS,aAAa;AAC5B,QAAM,oBAAoB,MAAM,gBAAgB;AAEhD,SAAO,OAAO,WAAW;AAAA,IACvB,KAAK,MAAM,OAAO,QAAQ,iBAAiB;AAAA,IAC3C,OAAO,MACL,IAAI,mBAAmB;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,SAAS,yBAAyB,MAAM,SAAS;AAAA,IACnD,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACD,OAAO,SAAS,mCAAmC;AAAA,MACjD,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,IACxD,CAAC;AAAA,EACH;AAEA,SAAO,qBAAqB,MAAM;AACpC,CAAC;AAMI,IAAM,qBAAqB,CAAC,UAAwC;AACzE,MAAI,MAAM,cAAc,SAAS;AAC/B,UAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAI,CAAC,SAAS;AACZ,aAAO,OAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO,OAAO,IAAI,aAAa;AAG7B,YAAM,EAAE,qBAAqB,IAAI,OAAO,OAAO,WAAW;AAAA,QACxD,KAAK,MAAM,OAAO,+BAAmB;AAAA,QACrC,OAAO,MACL,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACL,CAAC;AAED,aAAO,OAAO,cAAc;AAAA,QAC1B,WAAW;AAAA,QACX,iBAAiB,MACf,qBAAqB;AAAA,UACnB;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,KAAK,MAAM;AAAA,UACX,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,MAAM,IAAI,KAAK,IAAI;AAAA,QACrD,CAAC;AAAA,MACL,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAGA,QAAM,UAAU,MAAM,WAAW,CAAC;AAClC,QAAM,kBAAkB,MAAM,mBAAmB;AACjD,QAAM,cAAc,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI;AAEpE,QAAM,WAAW,iBAAiB,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC;AAEzE,QAAM,wBAAwB,cAAc;AAAA,IAC1C,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,8BAA8B,UAAU;AAAA,MAC1C;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,QAAM,aAAa,cAAc;AAAA,IAC/B,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,mBAAmB,UAAU;AAAA,MAC/B;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,MAAI,oBAAoB,kBAAmB,QAAO;AAClD,MAAI,oBAAoB,MAAO,QAAO;AAGtC,SAAO,sBAAsB,KAAK,OAAO,MAAM,MAAM,UAAU,CAAC;AAClE;;;AC1KA,SAAS,UAAAC,eAAc;AAkBhB,IAAM,gBAAgB,CAC3B,cAEAC,QAAO,IAAI,aAAa;AAEtB,QAAM,aAAa,OAAO,UAAU;AAAA,IAClCA,QAAO;AAAA,MACL,CAAC,EAAE,QAAQ,MACT,IAAI,sBAAsB;AAAA,QACxB,OAAO;AAAA,QACP,SAAS,oCAAoC,OAAO;AAAA,MACtD,CAAC;AAAA,IACL;AAAA,EACF;AAGA,QAAM,aAAa,OAAOA,QAAO,WAAW;AAAA,IAC1C,KAAK,MAAM,WAAW,OAAO,UAAU;AAAA,IACvC,OAAO,MACL,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC;AAED,MAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,WAAO,gBAAgB,UAAU;AACjC,WAAO,OAAO,IAAI,sBAAsB;AAAA,MACtC,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,mCAAmC,YAAY;AAAA,IAC9D,YAAY,WAAW,OAAO,mBAAmB;AAAA,EACnD,CAAC;AAGD,SAAO,gBAAgB,UAAU;AAEjC,SAAO;AACT,CAAC;AAEH,IAAM,kBAAkB,CAAC,eAGvBA,QAAO;AAAA,EACLA,QAAO,WAAW;AAAA,IAChB,KAAK,MAAM,WAAW,MAAM;AAAA,IAC5B,OAAO,MACL,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC;AACH;;;AChEF,SAAS,OAAO,UAAAC,SAAQ,MAAM,UAAAC,SAAQ,WAAW,UAAAC,eAAc;AAE/D,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AASP,IAAM,aAAaC,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAC9D,IAAM,mBAAmBA,QAAO,oBAAoB,UAAU;AAE9D,IAAM,aAAa,CAAC,UAClBC,QAAO,UAAU,iBAAiB,KAAK,GAAG,OAAO,CAAC,EAAE;AAOtD,IAAM,kBAAkBD,QAAO,MAAM;AAAA,EACnCA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,QAAQ,KAAK;AAAA,IAC1B,SAASA,QAAO;AAAA,IAChB,KAAKA,QAAO;AAAA,IACZ,eAAeA,QAAO,SAASA,QAAO,MAAM;AAAA,IAC5C,IAAIA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,CAAC;AAAA,EACDA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,SAASA,QAAO,QAAQ,MAAM,CAAC;AAAA,IAC5C,SAASA,QAAO;AAAA,IAChB,iBAAiBA,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAAA,EAC9D,CAAC;AACH,CAAC;AAGD,IAAM,qBAAqBA,QAAO,kBAAkB,eAAe;AAEnE,IAAM,uBAAuB,CAAC,WAC5B,OAAO,SAAS,QACZ,eAAe,KAAK;AAAA,EAClB,SAAS,OAAO;AAAA,EAChB,KAAK,OAAO;AAAA,EACZ,eAAe,cAAc,KAAK,OAAO,iBAAiB,OAAO,MAAM,EAAE;AAC3E,CAAC,IACD,gBAAgB,KAAK;AAAA,EACnB,SAAS,OAAO;AAAA,EAChB,iBAAiB,OAAO;AAC1B,CAAC;AAEP,IAAM,4BAA4B,CAAC,QAAiC,WAAyB;AAC3F,SAAO,kBAAkB,qBAAqB,OAAO,YAAiC;AACpF,UAAM,SAAS,mBAAmB,QAAQ,MAAM;AAChD,UAAM,MAAM,qBAAqB,MAAM;AAKvC,UAAM,OAAO,MAAME,QAAO,eAAe,OAAO,GAAG,CAAC;AACpD,QAAI,KAAK,UAAU,IAAI,GAAG;AACxB,YAAM,WAAW,KAAK;AACtB,aAAO;AAAA,QACL,QAAQ,SAAS;AAAA,QACjB,GAAI,SAAS,WAAW,YAAY,SAAS,UAAU,EAAE,SAAS,SAAS,QAAQ,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,YAAY;AAC1D,QAAI,SAAS;AACX,YAAM,MAAM,QAAQ;AACpB,UAAI,UAAU,SAAS,KAAK,0BAA0B,GAAG;AACvD,cAAM,SACJ,UAAU,YAAY,KAAK,QAAQ,KAAK,IAAI,WAAW,WAAW,WAAW;AAC/E,eAAO,EAAE,OAAO;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,MAAM,OAAO,KAAK,KAAK;AAAA,EAC/B,CAAC;AACH;AAMA,IAAM,gBAAgB,CACpB,YACA,UACA,MACA,WAEAA,QAAO,IAAI,aAAa;AACtB,4BAA0B,WAAW,QAAQ,MAAM;AACnD,SAAO,OAAOA,QAAO,WAAW;AAAA,IAC9B,KAAK,MAAM,WAAW,OAAO,SAAS,EAAE,MAAM,UAAU,WAAW,KAAK,CAAC;AAAA,IACzE,OAAO,MACL,IAAI,mBAAmB;AAAA,MACrB;AAAA,MACA,SAAS,4BAA4B,QAAQ;AAAA,IAC/C,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACDA,QAAO,SAAS,+BAA+B;AAAA,MAC7C,YAAY,EAAE,iBAAiB,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AACF,CAAC;AAiBI,IAAM,gBAAgB,CAC3B,UAEAA,QAAO,IAAI,aAAa;AACtB,QAAM,OAAO,WAAW,MAAM,IAAI;AAElC,QAAM,aAAa,OAAOA,QAAO;AAAA,IAC/B,MAAM,UAAU;AAAA,MACdA,QAAO,SAAS,iCAAiC;AAAA,QAC/C,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,IACA,CAAC,SACCA,QAAO;AAAA,MACLA,QAAO,WAAW;AAAA,QAChB,KAAK,MAAM,KAAK,MAAM;AAAA,QACtB,OAAO,MACL,IAAI,mBAAmB;AAAA,UACrB,WAAW,MAAM;AAAA,UACjB,SAAS;AAAA,QACX,CAAC;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACJ;AAEA,SAAO,OAAO,cAAc,YAAY,MAAM,UAAU,MAAM,MAAM,MAAM;AAC5E,CAAC,EAAE;AAAA,EACDA,QAAO;AAAA,EACPA,QAAO,SAAS,qBAAqB;AAAA,IACnC,YAAY;AAAA,MACV,iBAAiB,MAAM;AAAA,MACvB,sBAAsB,MAAM;AAAA,MAC5B,wBAAwB,MAAM;AAAA,IAChC;AAAA,EACF,CAAC;AACH;;;AC/IF,SAAS,MAAM,UAAU,UAAAC,SAAe,UAAAC,SAAQ,UAAAC,eAAc;AAC9D,SAAS,iBAAiB,YAAY,yBAAyB;AAQ/D,IAAM,kBAAkB,KAAK,UAAU;AAAA,EACrC,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,QAAQ;AAAA,EACR,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,MAAM,kBAAkB,SAAS,IAAI;AAAA,EACrD;AACF,CAAC;AAKD,IAAM,aAAa,CAAC,SAA2C,SAAgC;AAC7F,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,QAAQ,KAAK,YAAY;AAC/B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,QAAI,EAAE,YAAY,MAAM,MAAO,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,sBAAN,cAAkC,KAAK,YAAY,qBAAqB,EAGrE;AAAC;AAEJ,IAAM,mBAAmBA,QAAO,oBAAoBA,QAAO,eAAeA,QAAO,OAAO,CAAC;AAEzF,IAAM,WAAW,CAAC,SAAiD;AACjE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,iBAAiB,IAAI;AACpC,MAAID,QAAO,OAAO,MAAM,EAAG,QAAO;AAClC,QAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,SAAO;AACT;AAOA,IAAM,oBAAoB,CAAC,SAA0B;AACnD,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,YAAY,MAAO,QAAO;AAClC,SAAO,YAAY,OAAO,WAAW,OAAO,YAAY;AAC1D;AAQA,IAAM,mBAAmB,CAAC,SAA0B;AAClD,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAG,QAAO;AACtC,SAAO,OAAO,IAAI,UAAU;AAC9B;AAMA,IAAM,4BAA4BC,QAAO,OAAO;AAAA,EAC9C,UAAUA,QAAO;AAAA,EACjB,uBAAuBA,QAAO,MAAMA,QAAO,MAAM;AACnD,CAAC;AACD,IAAM,kCAAkCA,QAAO;AAAA,EAC7CA,QAAO,eAAe,yBAAyB;AACjD;AAOA,IAAM,+BAA+B,CAAC,aAA0B;AAC9D,QAAM,OAAO,SAAS,aAAa,MAAM,KAAK,SAAS;AACvD,SAAO,GAAG,SAAS,MAAM,wCAAwC,IAAI;AACvE;AAOA,IAAM,0BAA0B,CAAC,UAAkB,aAA2B;AAC5E,MAAI,CAAC,IAAI,SAAS,QAAQ,EAAG,QAAO;AACpC,QAAM,SAAS,IAAI,IAAI,QAAQ;AAC/B,MAAI,OAAO,WAAW,SAAS,OAAQ,QAAO;AAC9C,QAAM,eAAe,OAAO,SAAS,QAAQ,QAAQ,EAAE;AACvD,QAAM,eAAe,SAAS,SAAS,QAAQ,QAAQ,EAAE;AACzD,SAAO,iBAAiB,gBAAgB,aAAa,WAAW,GAAG,YAAY,GAAG;AACpF;AAcA,IAAM,iCAAiC,CACrC,QACA,UACA,cAEAF,QAAO,IAAI,aAAa;AACtB,QAAM,WAAW,OAAO,OACrB;AAAA,IACC,kBAAkB,IAAI,6BAA6B,QAAQ,CAAC,EAAE;AAAA,MAC5D,kBAAkB,UAAU,UAAU,kBAAkB;AAAA,IAC1D;AAAA,EACF,EACC,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAClD,MAAI,SAAS,SAAS,OAAO,SAAS,UAAU,IAAK,QAAO;AAC5D,QAAM,OAAO,OAAO,SAAS,KAAK;AAAA,IAChCA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC;AAAA,IACzCA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,CAAC;AAAA,EACvC;AACA,QAAM,WAAW,gCAAgC,IAAI;AACrD,MAAIC,QAAO,OAAO,QAAQ,EAAG,QAAO;AACpC,MAAI,SAAS,MAAM,sBAAsB,WAAW,EAAG,QAAO;AAC9D,SAAO,wBAAwB,SAAS,MAAM,UAAU,QAAQ;AAClE,CAAC,EAAE,KAAKD,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC,CAAC;AAEnD,IAAM,oBAAoBE,QAAO,OAAO,EAAE,SAASA,QAAO,OAAO,CAAC;AAClE,IAAM,0BAA0BA,QAAO,oBAAoB,iBAAiB;AAE5E,IAAM,0BAA0B,CAAC,UAA2B;AAC1D,QAAM,eAAe,wBAAwB,KAAK;AAClD,MAAID,QAAO,OAAO,YAAY,EAAG,QAAO,aAAa,MAAM;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,GAAG,KAAK;AAAA,EACjB;AACA,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,eAAe;AAC3D,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,YAAa,QAAO;AACzC,SAAO;AACT;AAiDO,IAAM,wBAAwB,CACnC,UACA,UAAwB,CAAC,MAEzBD,QAAO,IAAI,aAAa;AACtB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,UAAU,OAAOA,QAAO,IAAI,aAAa;AAC7C,UAAM,SAAS,OAAO,WAAW;AAEjC,UAAM,WAAW,CAAC,aAGhB,SAAS,KAAK;AAAA,MACZA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC;AAAA,MACzCA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,CAAC;AAAA,IACvC;AAEF,UAAM,WAAW,CACf,UAKA,WAEAA,QAAO,IAAI,aAAa;AACtB,YAAM,cAAc,WAAW,SAAS,SAAS,cAAc,KAAK;AACpE,YAAM,QAAQ,4BAA4B,KAAK,WAAW;AAE1D,UAAI,SAAS,WAAW,KAAK;AAC3B,cAAM,UAAU,WAAW,SAAS,SAAS,kBAAkB;AAC/D,YAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAK9C,cAAI,OAAO,+BAA+B,QAAQ,KAAK,SAAS,GAAG;AACjE,mBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,UAC3C;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,UACV;AAAA,QACF;AAQA,YAAI,oCAAoC,KAAK,OAAO,GAAG;AACrD,iBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,QAC3C;AASA,YAAI,wBAAwB,KAAK,OAAO,GAAG;AACzC,iBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,QAC3C;AAGA,YAAI,MAAO,QAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAWpD,cAAM,OAAO,OAAO,SAAS,QAAQ;AACrC,YAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC,iBAAiB,IAAI,GAAG;AAGvD,cAAI,OAAO,+BAA+B,QAAQ,KAAK,SAAS,GAAG;AACjE,mBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,UAC3C;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QACE;AAAA,UACJ;AAAA,QACF;AACA,eAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,MAC3C;AAEA,UAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,YAAI,WAAW,OAAO;AACpB,cAAI,CAAC,OAAO;AACV,mBAAO;AAAA,cACL,MAAM;AAAA,cACN,UAAU;AAAA,cACV,QAAQ;AAAA,YACV;AAAA,UACF;AACA,iBAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,QAC5C;AAGA,YAAI,MAAO,QAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AACrD,cAAM,OAAO,OAAO,SAAS,QAAQ;AACrC,YAAI,CAAC,kBAAkB,IAAI,GAAG;AAC5B,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,UACV;AAAA,QACF;AACA,eAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,MAC5C;AAEA,aAAO;AAAA,IACT,CAAC;AAEH,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,eAAe,CAAC,CAAC,GAAG;AACpE,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,cAAc,kBAAkB,KAAK,IAAI,SAAS,CAAC,EAAE;AAAA,MACvD,kBAAkB,UAAU,gBAAgB,kBAAkB;AAAA,MAC9D,kBAAkB,UAAU,UAAU,qCAAqC;AAAA,MAC3E,kBAAkB,SAAS,iBAAiB,kBAAkB;AAAA,IAChE;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AACjE,oBAAc,kBAAkB,UAAU,aAAa,MAAM,KAAK;AAAA,IACpE;AAEA,UAAM,eAAe,OAAO,OACzB,QAAQ,WAAW,EACnB,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAElD,UAAM,aAAa,OAAO,SAAS,cAAc,MAAM;AACvD,QAAI,WAAY,QAAO;AAEvB,QAAI,CAAC,KAAK,KAAK,KAAK,GAAG,EAAE,SAAS,aAAa,MAAM,GAAG;AACtD,UAAI,aAAa,kBAAkB,IAAI,IAAI,SAAS,CAAC,EAAE;AAAA,QACrD,kBAAkB,UAAU,UAAU,mBAAmB;AAAA,MAC3D;AACA,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AACjE,qBAAa,kBAAkB,UAAU,YAAY,MAAM,KAAK;AAAA,MAClE;AACA,YAAM,cAAc,OAAO,OACxB,QAAQ,UAAU,EAClB,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAClD,YAAM,YAAY,OAAO,SAAS,aAAa,KAAK;AACpD,UAAI,UAAW,QAAO;AAAA,IACxB;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,qBAAqB,aAAa,MAAM;AAAA,IAClD;AAAA,EACF,CAAC,EAAE;AAAA,IACDA,QAAO,QAAQ,QAAQ,mBAAmB,gBAAgB,KAAK;AAAA,IAC/DA,QAAO;AAAA,MACL,CAAC,UACC,IAAI,oBAAoB;AAAA,QACtB,QAAQ,wBAAwB,KAAK;AAAA,QACrC;AAAA,MACF,CAAC;AAAA,IACL;AAAA,IACAA,QAAO;AAAA,MAAM,CAAC,UACZA,QAAO,QAA6B;AAAA,QAClC,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT,CAAC,EAAE,KAAKA,QAAO,SAAS,wBAAwB,CAAC;;;AJ9XnD,IAAM,gBAAgB;AAEtB,IAAM,iCAAiC,CAAC,UAAiC;AACvE,QAAM,OAAO,MACV,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,IAAM,kCAAkC,CACtC,MACA,gBACwB;AACxB,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,WAAW,+BAA+B,IAAI;AACpD,MAAI,SAAU,YAAW,IAAI,QAAQ;AACrC,QAAM,kBACJ,eAAe,OAAO,OAAO,+BAA+B,YAAY,WAAW;AACrF,MAAI,gBAAiB,YAAW,IAAI,eAAe;AACnD,SAAO;AACT;AAEA,IAAM,iBAAiB,CAAC,OAAc,SAAkC,GAAG,KAAK,IAAI,OAAO,IAAI,CAAC;AAEhG,IAAM,yBAAyB,CAC7B,QACA,YACA,WACY;AACZ,MAAI,CAAC,WAAW,IAAI,OAAO,OAAO,IAAI,CAAC,EAAG,QAAO;AACjD,MAAI,CAAC,UAAU,OAAO,cAAc,YAAY,OAAO,KAAK,SAAS,SAAU,QAAO;AACtF,SAAO,OAAO,UAAU,yBAAyB,OAAO,YAAY,UAAU,OAAO;AACvF;AAiBA,IAAM,iBAAiBG,QAAO,OAAO;AAAA,EACnC,UAAUA,QAAO;AAAA,EACjB,UAAUA,QAAO;AAAA,IACfA,QAAO,OAAO;AAAA,MACZ,OAAOA,QAAO,SAASA,QAAO,MAAM;AAAA,MACpC,cAAcA,QAAO,SAASA,QAAO,OAAO;AAAA,MAC5C,iBAAiBA,QAAO,SAASA,QAAO,OAAO;AAAA,MAC/C,gBAAgBA,QAAO,SAASA,QAAO,OAAO;AAAA,MAC9C,eAAeA,QAAO,SAASA,QAAO,OAAO;AAAA,IAC/C,CAAC;AAAA,EACH;AACF,CAAC;AACD,IAAM,uBAAuBA,QAAO,OAAO,EAAE,KAAK,eAAe,CAAC;AAClE,IAAM,cAAcA,QAAO,oBAAoB,oBAAoB;AAEnE,IAAM,YAAY,CAAC,gBACjBC,QAAO,MAAM,YAAY,WAAW,GAAG;AAAA,EACrC,QAAQ,MAAM;AAAA,EACd,QAAQ,CAAC,YAAY,QAAQ;AAC/B,CAAC;AAQH,IAAM,6BAA6BD,QAAO,OAAO;AAAA,EAC/C,WAAWA,QAAO,SAASA,QAAO,QAAQ,QAAQ,CAAC;AAAA,EACnD,MAAMA,QAAO;AAAA,EACb,UAAUA,QAAO;AAAA,EACjB,iBAAiBA,QAAO,SAAS,kBAAkB;AAAA,EACnD,SAASA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAAA,EACpE,aAAaA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAAA,EACxE,MAAMA,QAAO,SAASA,QAAO,MAAM;AAAA;AAAA,EAEnC,MAAMA,QAAO,SAAS,eAAe;AACvC,CAAC;AAED,IAAM,4BAA4BA,QAAO,OAAO;AAAA,EAC9C,WAAWA,QAAO,QAAQ,OAAO;AAAA,EACjC,MAAMA,QAAO;AAAA,EACb,SAASA,QAAO;AAAA,EAChB,MAAMA,QAAO,SAASA,QAAO,MAAMA,QAAO,MAAM,CAAC;AAAA,EACjD,KAAKA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAAA,EAChE,KAAKA,QAAO,SAASA,QAAO,MAAM;AAAA,EAClC,MAAMA,QAAO,SAASA,QAAO,MAAM;AACrC,CAAC;AAED,IAAM,0BAA0BA,QAAO,MAAM;AAAA,EAC3C;AAAA,EACA;AACF,CAAC;AAED,IAAM,2BAA2BA,QAAO,OAAO;AAAA,EAC7C,MAAMA,QAAO;AACf,CAAC;AAED,IAAM,8BAA8BA,QAAO,OAAO;AAAA,EAChD,UAAUA,QAAO;AAAA,EACjB,SAASA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAAA,EACpE,aAAaA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAC1E,CAAC;AAED,IAAM,+BAA+BA,QAAO,OAAO;AAAA,EACjD,WAAWA,QAAO;AAAA,EAClB,wBAAwBA,QAAO;AAAA,EAC/B,eAAeA,QAAO;AAAA,EACtB,6BAA6BA,QAAO;AAAA,EACpC,MAAMA,QAAO;AAAA,EACb,MAAMA,QAAO;AAAA,EACb,WAAWA,QAAO,OAAOA,QAAO,MAAM;AAAA,EACtC,YAAYA,QAAO,OAAOA,QAAO,MAAM;AACzC,CAAC;AAeD,IAAM,0BAA0BA,QAAO,OAAO;AAAA,EAC5C,MAAMA,QAAO;AACf,CAAC;AAED,IAAM,2BAA2BA,QAAO,OAAO;AAAA,EAC7C,aAAaA,QAAO,OAAOA,QAAO,OAAO;AAC3C,CAAC;AAED,IAAM,2BAA2B,CAAO,WACtCA,QAAO,mBAAmBA,QAAO,uBAAuB,MAAM,CAAU;AAK1E,IAAM,kCAAkC,yBAAyB,uBAAuB;AACxF,IAAM,mCAAmC,yBAAyB,wBAAwB;AAC1F,IAAM,sCAAsC,yBAAyB,2BAA2B;AAChG,IAAM,uCAAuC,yBAAyB,4BAA4B;AAClG,IAAM,kCAAkC,yBAAyB,uBAAuB;AACxF,IAAM,mCAAmC,yBAAyB,wBAAwB;AAE1F,IAAM,iBAAiB,CAAC,MAAc,SAAiB,YACrD,WAAW,KAAK;AAAA,EACd;AAAA,EACA;AAAA,EACA,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAC7C,CAAC;AAMH,IAAM,WAAW,CAAC,SAAkC,gBAAgB,KAAK,IAAI;AAE7E,IAAM,gBAAgB,CAAC,UACrB,MAAM,QACN,mBAAmB;AAAA,EACjB,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM,cAAc,UAAU,SAAY,MAAM;AAAA,EAC1D,SAAS,MAAM,cAAc,UAAU,MAAM,UAAU;AACzD,CAAC;AAEH,IAAM,sBAAsB,CAAC,UAAoD;AAC/E,MAAI,MAAM,cAAc,SAAS;AAC/B,WAAO;AAAA,MACL,WAAW;AAAA,MACX,SAAS,MAAM;AAAA,MACf,MAAM,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI;AAAA,MACrC,KAAK,MAAM;AAAA,MACX,KAAK,MAAM;AAAA,IACb;AAAA,EACF;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,aAAa,MAAM;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ,EAAE,MAAM,OAAO;AAAA,EACrC;AACF;AAMA,IAAM,8BAAgC,eAAa,oBAAoB;AAEvE,IAAM,gCAAgC,CAAC,4BAAwD;AAC7F,QAAM,iCACJ,4BAA4B,YAAY,qBAAqB,CAAC;AAEhE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY;AAAA,MACV,GAAG,4BAA4B;AAAA,MAC/B,mBACE,4BAA4B,SACxB,iCACA;AAAA,MACN,SAAS,EAAE,OAAO,MAAM;AAAA,IAC1B;AAAA,IACA,UACE,4BAA4B,SAAY,CAAC,SAAS,IAAI,CAAC,WAAW,mBAAmB;AAAA,EACzF;AACF;AAKA,IAAM,YAAY,CAAC,UAAyC;AAC1D,QAAM,cAAc,MAAM,aAAa,oBAAoB;AAC3D,QAAM,QAAsB;AAAA,IAC1B,UAAU,MAAM;AAAA,IAChB,GAAI,MAAM,cAAc,EAAE,UAAU,MAAM,YAAY,IAAI,CAAC;AAAA,EAC7D;AACA,QAAM,cAAkC;AAAA,IACtC,kBAAkB;AAAA,IAClB,GAAI,cAAc,EAAE,qBAAqB,MAAM,aAAa,SAAS,MAAM,SAAS,IAAI,CAAC;AAAA,IACzF,KAAK;AAAA,EACP;AACA,SAAO;AAAA,IACL,MAAM,SAAS,KAAK,MAAM,MAAM;AAAA,IAChC,aAAa,MAAM,eAAe,aAAa,MAAM,QAAQ;AAAA,IAC7D,aAAa,MAAM;AAAA,IACnB,cAAc,8BAA8B,MAAM,YAAY;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,IAAM,iBAAiBA,QAAO,OAAO,EAAE,MAAMA,QAAO,QAAQ,MAAM,GAAG,MAAMA,QAAO,OAAO,CAAC;AAC1F,IAAM,sBAAsBA,QAAO,OAAO;AAAA,EACxC,SAASA,QAAO,SAASA,QAAO,OAAO;AAAA,EACvC,SAASA,QAAO,SAASA,QAAO,MAAMA,QAAO,OAAO,CAAC;AACvD,CAAC;AAED,IAAM,uBAAuBA,QAAO,oBAAoB,cAAc;AACtE,IAAM,4BAA4BA,QAAO,oBAAoB,mBAAmB;AAEhF,IAAM,yBAAyB,CAAC,YAA6B;AAC3D,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,eAAW,QAAQ,SAAS;AAC1B,YAAM,UAAUC,QAAO,eAAe,qBAAqB,IAAI,CAAC;AAChE,UAAI,YAAY,UAAa,QAAQ,KAAK,SAAS,EAAG,QAAO,QAAQ;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAIA,IAAM,kBAAkB,CAAC,KAAU,UAA2B;AAC5D,QAAM,KAAK,IAAI,OAAO,kBAAkB,KAAK,mBAAmB,GAAG;AACnE,SAAO,GAAG,KAAK,IAAI,QAAQ,KAAK,GAAG,KAAK,IAAI,QAAQ;AACtD;AAIO,IAAM,yBAAyB,CACpC,UACW;AACX,MAAI,MAAM,SAAS,eAAe;AAChC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,MAAM,MAAM,QAAQ,EAAE;AAAA,IACjC,MAAM;AAAA,MACJ;AAAA,MACA,MACE;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,MACE;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,EACR;AACF;AASA,IAAM,oBAAoB,CAAC,iBAA8C;AAAA,EACvE,IAAI,cAAc;AAChB,WAAO;AAAA,EACT;AAAA,EACA,IAAI,iBAAiB;AACnB,WAAO;AAAA,MACL,eAAe,CAAC,iCAAiC;AAAA,MACjD,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,mBAAmB,MAAM;AAAA,EACzB,uBAAuB,MAAM;AAAA,EAC7B,QAAQ,OAAO,EAAE,cAAc,aAAa,YAAY,SAAS;AAAA,EACjE,YAAY,MAAM;AAAA,EAClB,yBAAyB,YAAY;AAEnC,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAAA,EACA,kBAAkB,MAAM;AAAA,EACxB,cAAc,MAAM;AAElB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EACA,oBAAoB,MAAM;AAAA,EAC1B,gBAAgB,MAAM;AACxB;AAOA,IAAM,sBAAsB,CAC1B,QACA,OACA,eACsD;AACtD,MAAI,OAAO,cAAc,SAAS;AAChC,QAAI,CAAC,YAAY;AACf,aAAOC,QAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAOA,QAAO,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd,CAAqC;AAAA,EACvC;AAEA,QAAM,UAAkC,EAAE,GAAI,OAAO,WAAW,CAAC,EAAG;AACpE,MAAI;AAEJ,QAAM,OAAO,OAAO;AACpB,MAAI,KAAK,SAAS,YAAY,UAAU,MAAM;AAC5C,YAAQ,KAAK,UAAU,IAAI,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,KAAK,KAAK;AAAA,EACtE,WAAW,KAAK,SAAS,YAAY,UAAU,MAAM;AACnD,mBAAe,kBAAkB,KAAK;AAAA,EACxC;AAEA,SAAOA,QAAO,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C,aACE,OAAO,eAAe,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,IAC3D,OAAO,cACP;AAAA,IACN,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AAAA,IACrD;AAAA,EACF,CAAC;AACH;AAkBO,IAAM,yBAAyB,CACpC,WACoC;AACpC,QAAM,SAAS,0BAA0B,OAAO,MAAM;AACtD,MAAI,CAAC,UAAU,OAAO,cAAc,QAAS,QAAO,CAAC;AAErD,QAAM,OAAO,OAAO;AACpB,MAAI,KAAK,SAAS,QAAQ;AACxB,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,MAAM;AAAA,QACN,UAAU;AAAA,QACV,YAAY,CAAC,EAAE,SAAS,UAAU,MAAM,KAAK,YAAY,QAAQ,KAAK,UAAU,GAAG,CAAC;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,MAAM;AAAA,QACN,UAAU;AAAA,QACV,OAAO,EAAE,cAAc,OAAO,UAAU,6BAA6B,KAAK;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,IAAM,gCAAgC,CAC3C,WAC8B;AAC9B,QAAM,SAAS,0BAA0B,OAAO,MAAM;AACtD,MAAI,CAAC,UAAU,OAAO,cAAc,QAAS,QAAO,CAAC;AACrD,SAAO,EAAE,KAAK,OAAO,SAAS;AAChC;AAiBO,IAAM,YAAY,aAAa,CAAC,YAA+B;AACpE,QAAM,aAAa,SAAS,4BAA4B;AAExD,QAAM,iBACJ,aACI,aACA,WAAW,OAAO,CAAC,WAAW,EAAE,eAAe,UAAU,OAAO,cAAc,QAAQ,GAC1F,IAAI,CAAC,YAAY;AAAA,IACjB,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,SAAS,OAAO;AAAA,IAChB,GAAI,SAAS,UAAU,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,IAC3D,GAAI,cAAc,UAAU,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,IAC/E,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,IACvD,WAAY,eAAe,UAAU,OAAO,cAAc,UAAU,UAAU;AAAA,IAG9E,GAAI,aAAa,SAAS,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;AAAA,IACzD,GAAI,UAAU,UAAU,OAAO,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,IAAI,CAAC;AAAA,IACpE,GAAI,SAAS,UAAU,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,EAC7D,EAAE;AAEF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,oBAAoB;AAAA;AAAA;AAAA,IAGpB,cAAc,EAAE,WAAW;AAAA,IAC3B,SAAS,OAAO,CAAC;AAAA,IAEjB,WAAW,CAAC,QAAmB;AAC7B,YAAM,kBAAkB,SAAS,mBAAmB,IAAI;AAExD,YAAM,gBAAgB,CAAC,UACrBA,QAAO,IAAI,aAAa;AACtB,cAAM,WAAW,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC3D,cAAM,UAAU,SAAS,KAAK;AAC9B,YAAI,CAAC,SAAS;AACZ,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,OAAO,OAAOA,QAAO,IAAI;AAAA,UAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;AAAA,UAC5B,OAAO,MAAM;AAAA,QACf,CAAC,EAAE,KAAKA,QAAO,cAAc,MAAM,KAAK,CAAC;AACzC,cAAM,OAAO,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAErD,cAAM,eAAe,OAAO,UAAU,WAAW,SAAY,MAAM;AACnE,cAAM,mBAAmB,OAAO,UAAU,WAAW,SAAY,MAAM;AAEvE,cAAM,YAAY,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AAED,cAAM,SAAS,OAAO,cAAc,SAAS,EAAE;AAAA,UAC7CA,QAAO,IAAI,CAAC,OAAO,EAAE,IAAI,MAAe,UAAU,EAAE,EAAE;AAAA,UACtDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,UAAU,KAAK,CAAC,CAAC;AAAA,UACzEA,QAAO,SAAS,2BAA2B;AAAA,QAC7C;AAEA,YAAI,OAAO,MAAM,OAAO,UAAU;AAChC,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,wBAAwB;AAAA,YACxB,eAAe;AAAA,YACf,6BAA6B;AAAA,YAC7B,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,YACtC;AAAA,YACA,WAAW,OAAO,SAAS,MAAM;AAAA,YACjC,YAAY,OAAO,SAAS,QAAQ,QAAQ;AAAA,UAC9C;AAAA,QACF;AAKA,cAAM,QAAQ,OAAO,sBAAsB,SAAS;AAAA,UAClD;AAAA,UACA,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AACD,YAAI,MAAM,SAAS,OAAO;AACxB,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS,uBAAuB,KAAK;AAAA,UACvC,CAAC;AAAA,QACH;AAEA,cAAM,cAAc,OAAO,IAAI,MAAM,MAAM,EAAE,KAAK,QAAQ,CAAC,EAAE;AAAA,UAC3DA,QAAO,IAAI,CAAC,WAAW,EAAE,IAAI,MAAe,MAAM,EAAE;AAAA,UACpDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,OAAO,KAAK,CAAC,CAAC;AAAA,UACtEA,QAAO,SAAS,wBAAwB;AAAA,QAC1C;AAEA,YAAI,YAAY,IAAI;AAClB,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,wBAAwB;AAAA,YACxB,eAAe;AAAA,YACf,6BAA6B,YAAY,MAAM,wBAAwB;AAAA,YACvE;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,YAAY;AAAA,UACd;AAAA,QACF;AAEA,YAAI,MAAM,cAAc;AACtB,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,wBAAwB;AAAA,YACxB,eAAe;AAAA,YACf,6BAA6B;AAAA,YAC7B;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,YAAY;AAAA,UACd;AAAA,QACF;AAEA,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,gBAAgB,OAAO,UAAU,WAAW,QAAQ,MAAM,SAAS;AAAA,QACnF,CAAC;AAAA,MACH;AAEF,YAAM,YAAY,CAAC,UACjBA,QAAO,IAAI,aAAa;AACtB,cAAM,OAAO,cAAc,KAAK;AAChC,cAAM,SAAS,oBAAoB,KAAK;AAOxC,cAAM,WAAW,OAAO,IAAI,KAAK,aAAa,IAAI,SAAS,IAAI,CAAC;AAChE,YAAI,UAAU;AACZ,iBAAO,OAAO,IAAI,8BAA8B,EAAE,MAAM,SAAS,IAAI,EAAE,CAAC;AAAA,QAC1E;AAEA,eAAO,IAAI,KAAK,aACb,SAAS;AAAA,UACR,MAAM,SAAS,IAAI;AAAA,UACnB,aAAa,MAAM;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,UACX,YAAY;AAAA,QACd,CAAC,EACA;AAAA,UACCA,QAAO,SAAS,mCAAmC;AAAA,YACjD,YAAY,EAAE,wBAAwB,KAAK;AAAA,UAC7C,CAAC;AAAA,QACH;AACF,eAAO,EAAE,KAAK;AAAA,MAChB,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY;AAAA,YACV,wBAAwB,MAAM,aAAa;AAAA,YAC3C,mBAAmB,MAAM;AAAA,UAC3B;AAAA,QACF,CAAC;AAAA,MACH;AAEF,YAAM,eAAe,CAAC,SACpBA,QAAO,IAAI,aAAa;AACtB,cAAM,cAAc,SAAS,IAAI;AACjC,cAAM,SAAS,OAAO,IAAI,KAAK,aAAa,IAAI,WAAW;AAC3D,cAAM,SAAS,SAAS,0BAA0B,OAAO,MAAM,IAAI;AACnE,cAAM,mBAAmB,gCAAgC,MAAM,MAAM;AACrE,cAAM,cAAc,OAAO,IAAI,YAAY,KAAK,EAAE,YAAY,CAAC;AAC/D,cAAM,iBAAiB,OAAO,IAAI,YAAY,KAAK;AACnD,cAAM,uBAAuB,OAAO,IAAI,MAAM,YAAY;AAC1D,cAAM,gBAAgB,IAAI;AAAA,UACxB,eACG,OAAO,CAAC,eAAe,OAAO,WAAW,WAAW,MAAM,OAAO,WAAW,CAAC,EAC7E;AAAA,YAAQ,CAAC,eACR,WAAW,eAAe,OACtB,CAAC,IACD;AAAA,cACE;AAAA,gBACE,WAAW,oBAAoB,WAAW;AAAA,gBAC1C,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACN;AAAA,QACJ;AACA,cAAM,oBAAoB,IAAI;AAAA,UAC5B,qBAAqB,IAAI,CAAC,WAAW;AAAA,YACnC,eAAe,OAAO,OAAO,OAAO,IAAI;AAAA,YACxC;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,kBAAkB,oBAAI,IAG1B;AAEF,mBAAW,cAAc,aAAa;AACpC,cAAI,WAAW,eAAe,KAAM;AACpC,gBAAM,QAAQ,WAAW,oBAAoB,WAAW;AACxD,gBAAM,MAAM,eAAe,OAAO,WAAW,WAAW;AACxD,gBAAM,SAAS,kBAAkB,IAAI,GAAG;AACxC,cAAI,QAAQ,OAAO,SAAS,8BAA+B;AAC3D,0BAAgB,IAAI,KAAK;AAAA,YACvB;AAAA,YACA,MAAM,WAAW;AAAA,UACnB,CAAC;AAAA,QACH;AACA,mBAAW,UAAU,sBAAsB;AACzC,gBAAM,MAAM,eAAe,OAAO,OAAO,OAAO,IAAI;AACpD,cAAI,cAAc,IAAI,GAAG,EAAG;AAC5B,cACE,OAAO,OAAO,SAAS,kCACtB,OAAO,OAAO,eAAe,QAAQ,OAAO,OAAO,OAAO,WAAW,MAAM,OAC5E;AACA,4BAAgB,IAAI,KAAK,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,KAAK,CAAC;AACnE;AAAA,UACF;AACA,cAAI,uBAAuB,QAAQ,kBAAkB,MAAM,GAAG;AAC5D,4BAAgB,IAAI,KAAK,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,KAAK,CAAC;AAAA,UACrE;AAAA,QACF;AAEA,eAAO,IAAI,KAAK,aACb,OAAO,WAAW,EAClB,KAAKA,QAAO,SAAS,qCAAqC,MAAMA,QAAO,IAAI,CAAC;AAE/E,eAAOA,QAAO;AAAA,UACZ,gBAAgB,OAAO;AAAA,UACvB,CAAC,WAAW,IAAI,MAAM,aAAa,OAAO,OAAO,OAAO,IAAI;AAAA,UAC5D,EAAE,SAAS,KAAK;AAAA,QAClB;AAAA,MACF,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,4BAA4B;AAAA,UAC1C,YAAY,EAAE,wBAAwB,KAAK;AAAA,QAC7C,CAAC;AAAA,MACH;AAEF,YAAM,YAAY,CAAC,SACjB,IAAI,KAAK,aAAa,IAAI,SAAS,IAAI,CAAC,EAAE;AAAA,QACxCA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY,EAAE,wBAAwB,KAAK;AAAA,QAC7C,CAAC;AAAA,MACH;AAEF,YAAM,kBAAkB,CAAC,MAAc,WACrC,IAAI,KAAK,aAAa,OAAO,SAAS,IAAI,GAAG,EAAE,OAAO,CAAC,EAAE;AAAA,QACvDA,QAAO,SAAS,+BAA+B;AAAA,UAC7C,YAAY,EAAE,wBAAwB,KAAK;AAAA,QAC7C,CAAC;AAAA,MACH;AAEF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA,cAAc,CAAC,EAAE,QAAQ,YAAY,SAAS,MAC5CA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,0BAA0B,MAAM;AAC/C,UAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,CAAC,EAAwB;AAEtD,YAAM,QAAQ,OAAO,SAAS,EAAE,KAAKA,QAAO,cAAc,MAAM,IAAI,CAAC;AAErE,YAAM,QAAQ,OAAO,oBAAoB,QAAQ,OAAO,UAAU,EAAE;AAAA,QAClEA,QAAO,IAAI,CAAC,OAAO,mBAAmB,EAAE,CAAC;AAAA,QACzCA,QAAO;AAAA,MACT;AAEA,YAAM,WAAW,OAAO,UAAU,KAAK,IACnC,OAAO,cAAc,MAAM,OAAO,EAAE;AAAA,QAClCA,QAAO,IAAI,CAAC,OAAO,EAAE,IAAI,MAAe,UAAU,EAAE,EAAE;AAAA,QACtDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,UAAU,KAAK,CAAC,CAAC;AAAA,QACzEA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,uBAAuB,OAAO,WAAW,IAAI,EAAE;AAAA,QAC/D,CAAC;AAAA,MACH,IACA,EAAE,IAAI,OAAgB,UAAU,KAAK;AAEzC,YAAM,UAAU,SAAS,MAAM,SAAS,WAAW,SAAS,SAAS,QAAQ,CAAC;AAC9E,aAAO,EAAE,OAAO,QAAQ,IAAI,SAAS,EAAE;AAAA,IACzC,CAAC,EAAE;AAAA,MACDA,QAAO,SAAS,4BAA4B;AAAA,QAC1C,YAAY,EAAE,uBAAuB,OAAO,WAAW,IAAI,EAAE;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,IAEF,YAAY,CAAC,EAAE,SAAS,YAAY,MAAM,OAAO,MAC/CA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,0BAA0B,WAAW,MAAM;AAC1D,UAAI,CAAC,QAAQ;AACX,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SAAS,oBAAoB,QAAQ,WAAW;AAAA,QAClD,CAAC;AAAA,MACH;AAEA,YAAM,QAAQ,UAAU,QAAQ,WAAW;AAC3C,UAAI,CAAC,OAAO;AACV,eAAO,OAAO,IAAI,sBAAsB;AAAA,UACtC,OAAO;AAAA,UACP,SAAS,SAAS,QAAQ,IAAI;AAAA,QAChC,CAAC;AAAA,MACH;AAEA,YAAM,YACJ,OAAO,cAAc,UAAU,UAAW,OAAO,mBAAmB;AAEtE,YAAM,YAA0B,OAAO;AAAA,QACrC;AAAA,QACA,WAAW;AAAA,QACX;AAAA,MACF,EAAE,KAAKA,QAAO,IAAI,CAAC,OAAO,mBAAmB,EAAE,CAAC,CAAC;AAEjD,YAAM,MAAM,OAAO,cAAc;AAAA,QAC/B,QAAQ,OAAO,QAAQ,IAAI;AAAA,QAC3B,UAAU,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,WAAWD,QAAO,eAAe,0BAA0B,GAAG,CAAC;AACrE,UAAI,UAAU,YAAY,MAAM;AAC9B,eAAO,WAAW,KAAK;AAAA,UACrB,MAAM;AAAA,UACN,SAAS,uBAAuB,SAAS,OAAO;AAAA,UAChD,SAAS,EAAE,SAAS,SAAS,QAAQ;AAAA,QACvC,CAAC;AAAA,MACH;AACA,aAAO,WAAW,GAAG,GAAG;AAAA,IAC1B,CAAC,EAAE;AAAA,MACDC,QAAO;AAAA,QAAS;AAAA,QAAsB,CAAC,EAAE,QAAQ,MAC/CA,QAAO;AAAA,UACL,gBAAgB;AAAA,YACd,MAAM;AAAA,YACN;AAAA,YACA,QAAQ,EAAE,IAAI,OAAO,WAAW,WAAW,EAAE;AAAA,YAC7C,YAAY,EAAE,MAAM,YAAY,OAAO,OAAO,WAAW,UAAU,EAAE;AAAA,UACvE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACAA,QAAO,SAAS,0BAA0B;AAAA,QACxC,YAAY;AAAA,UACV,iBAAiB,OAAO,QAAQ,IAAI;AAAA,UACpC,wBAAwB,OAAO,QAAQ,WAAW;AAAA,QACpD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEF,QAAQ,CAAC,EAAE,KAAK,IAAI,MAClBA,QAAO,IAAI,aAAa;AACtB,YAAM,kBAAkB,SAAS,mBAAmB,IAAI;AACxD,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,SAAS,OAAOA,QAAO,IAAI;AAAA,QAC/B,KAAK,MAAM,IAAI,IAAI,OAAO;AAAA,QAC1B,OAAO,CAAC,UAAU;AAAA,MACpB,CAAC,EAAE,KAAKA,QAAO,MAAM;AACrB,UAAID,QAAO,OAAO,MAAM,EAAG,QAAO;AAElC,YAAM,OAAO,OAAO,MAAM,YAAY;AACtC,YAAM,OAAO,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAErD,YAAM,YAAY,mBAAmB,EAAE,WAAW,UAAU,UAAU,QAAQ,CAAC;AAE/E,YAAM,YAAY,OAAO,cAAc,SAAS,EAAE;AAAA,QAChDC,QAAO,IAAI,MAAM,IAAI;AAAA,QACrBA,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC;AAAA,QACxCA,QAAO,SAAS,2BAA2B;AAAA,MAC7C;AAEA,UAAI,WAAW;AACb,eAAO;AAAA,UACL,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,sBAAsB,SAAS,EAAE,gBAAgB,CAAC;AACvE,UAAI,MAAM,SAAS,OAAO;AACxB,eAAO;AAAA,UACL,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAIA,UAAI,gBAAgB,OAAO,OAAO,KAAK,GAAG;AACxC,eAAO;AAAA,UACL,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,IACT,CAAC,EAAE;AAAA,MACDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,IAAI,CAAC;AAAA,MACvCA,QAAO,SAAS,qBAAqB;AAAA,QACnC,YAAY,EAAE,gBAAgB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA,IAIF,oBAAoB,CAAC,EAAE,SAAS,MAC9BA,QAAO,KAAK,MAAM;AAChB,YAAM,MAAuC,CAAC;AAC9C,iBAAW,OAAO,UAAU;AAC1B,cAAM,QAAQ,UAAU,IAAI,WAAW;AACvC,cAAM,MAAM,OAAO;AACnB,YAAI,KAAK,oBAAoB,MAAM;AACjC,cAAI,OAAO,IAAI,IAAI,CAAC,IAAI;AAAA,YACtB,kBAAkB;AAAA,YAClB,qBAAqB,IAAI,SAAS,OAAO,YAAY,OAAO,IAAI,IAAI;AAAA,UACtE;AAAA,QACF,OAAO;AACL,cAAI,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,kBAAkB,MAAM;AAAA,QACpD;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,qBAAqB;AAAA,IACrB,4BAA4B;AAAA,IAE5B,sBAAsB;AAAA,MACpB,MAAM;AAAA,MACN,WAAW,CAAC,EAAE,KAAK,aAAa,OAAO,MACrCA,QAAO,IAAI,aAAa;AACtB,cAAM,OAAO,0BAA0B,MAAM;AAC7C,YAAI,CAAC,KAAM;AACX,eAAO,IAAI,KAAK,aAAa,OAAO,aAAa,EAAE,QAAQ,KAAK,CAAC;AAAA,MACnE,CAAC;AAAA,IACL;AAAA,IAEA,eAAe,CAAC,SAAS;AAAA,MACvB;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,UACL,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,YACb,cAAc;AAAA,YACd,SAAS,CAAC,UACR,KAAK,cAAc,KAA8B,EAAE;AAAA,cACjDA,QAAO,IAAI,WAAW,EAAE;AAAA,cACxBA,QAAO;AAAA,gBAAS;AAAA,gBAAsB,CAAC,EAAE,SAAS,UAAU,MAC1DA,QAAO,QAAQ,eAAe,yBAAyB,SAAS,EAAE,UAAU,CAAC,CAAC;AAAA,cAChF;AAAA,YACF;AAAA,UACJ,CAAC;AAAA,UACD,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,YACb,cAAc;AAAA,YACd,SAAS,CAAC,UAAU;AAClB,oBAAM,OAAO;AACb,qBAAOA,QAAO;AAAA,gBAAI,KAAK,UAAU,KAAK,IAAI;AAAA,gBAAG,CAAC,gBAC5C,WAAW,GAAG,EAAE,YAAY,CAAC;AAAA,cAC/B;AAAA,YACF;AAAA,UACF,CAAC;AAAA,UACD,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,cACX,kBAAkB;AAAA,cAClB,qBAAqB;AAAA,YACvB;AAAA,YACA,aAAa;AAAA,YACb,cAAc;AAAA,YACd,SAAS,CAAC,aAAa;AACrB,oBAAM,QAAQ;AACd,qBAAO,KAAK,UAAU,KAAuB,EAAE;AAAA,gBAC7CA,QAAO,IAAI,WAAW,EAAE;AAAA,gBACxBA,QAAO;AAAA,kBACL;AAAA,kBACA,CAAC,EAAE,KAAK,MACNA,QAAO;AAAA,oBACL;AAAA,sBACE;AAAA,sBACA,eAAe,IAAI;AAAA,oBACrB;AAAA,kBACF;AAAA,gBACJ;AAAA,cACF;AAAA,YACF;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;","names":["tool","Effect","Option","Schema","Effect","Effect","Effect","Option","Schema","Schema","Option","Effect","Effect","Option","Schema","Schema","Option","Effect"]}

package/dist/core.js

@@ -4,7 +4,7 @@ import {
   joinToolPath,
   mcpPlugin,
   userFacingProbeMessage
-} from "./chunk-2TXHTMKM.js";
+} from "./chunk-HSJWIVME.js";
 import "./chunk-TW44CBXJ.js";
 import {
   McpAuthTemplate,

package/dist/index.js

@@ -1,6 +1,6 @@
 import {
   mcpPlugin
-} from "./chunk-2TXHTMKM.js";
+} from "./chunk-HSJWIVME.js";
 import "./chunk-TW44CBXJ.js";
 import "./chunk-6OEQZ72N.js";
 export {

package/dist/sdk/invoke.d.ts

@@ -1,5 +1,5 @@
 import { Effect } from "effect";
-import { type Elicit } from "@executor-js/sdk";
+import { type Elicit } from "@executor-js/sdk/core";
 import { McpConnectionError, McpInvocationError } from "./errors";
 import type { McpConnector } from "./connection";
 export interface InvokeMcpToolInput {

package/dist/sdk/plugin.d.ts

@@ -1,6 +1,6 @@
 import { Effect, Layer, Schema } from "effect";
 import type { HttpClient } from "effect/unstable/http";
-import { IntegrationAlreadyExistsError, type AuthMethodDescriptor, type Integration, type IntegrationConfig, type IntegrationRecord, type StorageFailure } from "@executor-js/sdk";
+import { IntegrationAlreadyExistsError, type AuthMethodDescriptor, type Integration, type IntegrationConfig, type IntegrationRecord, type StorageFailure } from "@executor-js/sdk/core";
 import { McpConnectionError, McpToolDiscoveryError } from "./errors";
 import { type McpShapeProbeResult } from "./probe-shape";
 import { type McpIntegrationConfig as McpIntegrationConfigType } from "./types";
@@ -100,7 +100,7 @@ export interface McpPluginOptions {
     readonly dangerouslyAllowStdioMCP?: boolean;
     readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;
 }
-export declare const mcpPlugin: import("@executor-js/sdk").ConfiguredPlugin<"mcp", {
+export declare const mcpPlugin: import("@executor-js/sdk/core").ConfiguredPlugin<"mcp", {
     probeEndpoint: (input: string | McpProbeEndpointInput) => Effect.Effect<{
         connected: true;
         requiresAuthentication: false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/plugin-mcp",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "homepage": "https://github.com/RhysSullivan/executor/tree/main/packages/plugins/mcp",
   "bugs": {
     "url": "https://github.com/RhysSullivan/executor/issues"
@@ -54,8 +54,8 @@
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "@effect/platform-node": "4.0.0-beta.59",
-    "@executor-js/config": "1.5.4",
-    "@executor-js/sdk": "1.5.4",
+    "@executor-js/config": "1.5.6",
+    "@executor-js/sdk": "1.5.6",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.3.6"
   },

package/dist/chunk-2TXHTMKM.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/sdk/manifest.ts","../src/sdk/plugin.ts","../src/sdk/connection.ts","../src/sdk/discover.ts","../src/sdk/invoke.ts","../src/sdk/probe-shape.ts"],"sourcesContent":["import { Option, Schema } from \"effect\";\n\nimport { McpToolAnnotations } from \"./types\";\n\n// ---------------------------------------------------------------------------\n// Output types\n// ---------------------------------------------------------------------------\n\nexport interface McpToolManifestEntry {\n  readonly toolId: string;\n  readonly toolName: string;\n  readonly description: string | null;\n  readonly inputSchema?: unknown;\n  readonly outputSchema?: unknown;\n  readonly annotations?: McpToolAnnotations;\n}\n\nexport interface McpServerMetadata {\n  readonly name: string | null;\n  readonly version: string | null;\n}\n\nexport interface McpToolManifest {\n  readonly server: McpServerMetadata | null;\n  readonly tools: readonly McpToolManifestEntry[];\n}\n\n// ---------------------------------------------------------------------------\n// Schemas\n// ---------------------------------------------------------------------------\n\nconst ListedTool = Schema.Struct({\n  name: Schema.String,\n  description: Schema.optional(Schema.NullOr(Schema.String)),\n  inputSchema: Schema.optional(Schema.Unknown),\n  parameters: Schema.optional(Schema.Unknown),\n  outputSchema: Schema.optional(Schema.Unknown),\n  annotations: Schema.optional(McpToolAnnotations),\n});\n\nconst ListToolsResult = Schema.Struct({\n  tools: Schema.Array(ListedTool),\n});\n\nconst ServerInfo = Schema.Struct({\n  name: Schema.optional(Schema.String),\n  version: Schema.optional(Schema.String),\n});\n\nconst decodeListToolsResult = Schema.decodeUnknownOption(ListToolsResult);\nconst decodeServerInfo = Schema.decodeUnknownOption(ServerInfo);\n\nexport const isListToolsResult = (value: unknown): boolean =>\n  Option.isSome(decodeListToolsResult(value));\n\n// ---------------------------------------------------------------------------\n// Tool ID sanitization\n// ---------------------------------------------------------------------------\n\nconst sanitize = (value: string): string => {\n  const s = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n  return s || \"tool\";\n};\n\nconst uniqueId = (value: string, seen: Map<string, number>): string => {\n  const base = sanitize(value);\n  const n = (seen.get(base) ?? 0) + 1;\n  seen.set(base, n);\n  return n === 1 ? base : `${base}_${n}`;\n};\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport const joinToolPath = (namespace: string | undefined, toolId: string): string =>\n  namespace?.trim() ? `${namespace}.${toolId}` : toolId;\n\nexport const extractManifestFromListToolsResult = (\n  listToolsResult: unknown,\n  metadata?: { serverInfo?: unknown },\n): McpToolManifest => {\n  const seen = new Map<string, number>();\n\n  const listed = decodeListToolsResult(listToolsResult).pipe(\n    Option.map((result) => result.tools),\n    Option.getOrElse(() => []),\n  );\n\n  const server = decodeServerInfo(metadata?.serverInfo).pipe(\n    Option.map(\n      (info): McpServerMetadata => ({\n        name: info.name ?? null,\n        version: info.version ?? null,\n      }),\n    ),\n    Option.getOrNull,\n  );\n\n  const tools = listed.flatMap((tool): McpToolManifestEntry[] => {\n    const toolName = tool.name.trim();\n    if (!toolName) return [];\n\n    return [\n      {\n        toolId: uniqueId(toolName, seen),\n        toolName,\n        description: tool.description ?? null,\n        inputSchema: tool.inputSchema ?? tool.parameters,\n        outputSchema: tool.outputSchema,\n        annotations: tool.annotations,\n      },\n    ];\n  });\n\n  return { server, tools };\n};\n\n// ---------------------------------------------------------------------------\n// Namespace derivation\n// ---------------------------------------------------------------------------\n\nconst slugify = (value: string): string =>\n  value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n\nconst hostnameOf = (url: string): string | null => {\n  if (!URL.canParse(url)) return null;\n  return new URL(url).hostname;\n};\n\nconst basenameOf = (path: string): string => path.trim().split(/[\\\\/]/).pop() ?? path.trim();\n\nexport const deriveMcpNamespace = (input: {\n  name?: string | null;\n  endpoint?: string | null;\n  command?: string | null;\n}): string => {\n  if (input.name?.trim()) return slugify(input.name) || \"mcp\";\n\n  const fromEndpoint = input.endpoint?.trim() ? hostnameOf(input.endpoint) : null;\n  if (fromEndpoint) return slugify(fromEndpoint) || \"mcp\";\n\n  if (input.command?.trim()) return slugify(basenameOf(input.command)) || \"mcp\";\n\n  return \"mcp\";\n};\n","import { Effect, Layer, Match, Option, Result, Schema } from \"effect\";\nimport type { HttpClient } from \"effect/unstable/http\";\n\nimport type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport { CallToolResultSchema } from \"@modelcontextprotocol/sdk/types.js\";\nimport * as z from \"zod/v4\";\n\nimport {\n  authToolFailure,\n  definePlugin,\n  IntegrationAlreadyExistsError,\n  IntegrationSlug,\n  OAuthClientSlug,\n  tool,\n  ToolResult,\n  type AuthMethodDescriptor,\n  type Integration,\n  type IntegrationConfig,\n  type IntegrationRecord,\n  type OAuthClientSummary,\n  type Owner,\n  type PluginCtx,\n  type StaticToolSchema,\n  type StorageFailure,\n  type ToolAnnotations,\n  type ToolDef,\n  ToolName,\n} from \"@executor-js/sdk\";\n\nimport { createMcpConnector, type ConnectorInput, type McpConnector } from \"./connection\";\nimport { discoverTools } from \"./discover\";\nimport { McpConnectionError, McpToolDiscoveryError } from \"./errors\";\nimport { invokeMcpTool } from \"./invoke\";\nimport { deriveMcpNamespace, type McpToolManifestEntry } from \"./manifest\";\nimport { mcpPresets } from \"./presets\";\nimport { probeMcpEndpointShape, type McpShapeProbeResult } from \"./probe-shape\";\nimport {\n  McpAuthTemplate,\n  McpRemoteTransport,\n  type McpToolAnnotations,\n  parseMcpIntegrationConfig,\n  type McpIntegrationConfig as McpIntegrationConfigType,\n  type McpStdioIntegrationConfig,\n} from \"./types\";\n\nconst MCP_PLUGIN_ID = \"mcp\" as const;\n\nconst legacyOAuthClientSlugCandidate = (value: string): string | null => {\n  const slug = value\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug.length > 0 ? slug : null;\n};\n\nconst legacyOAuthClientSlugCandidates = (\n  slug: string,\n  integration: (Integration & { readonly config: IntegrationConfig }) | null,\n): ReadonlySet<string> => {\n  const candidates = new Set<string>();\n  const fromSlug = legacyOAuthClientSlugCandidate(slug);\n  if (fromSlug) candidates.add(fromSlug);\n  const fromDescription =\n    integration == null ? null : legacyOAuthClientSlugCandidate(integration.description);\n  if (fromDescription) candidates.add(fromDescription);\n  return candidates;\n};\n\nconst oauthClientKey = (owner: Owner, slug: OAuthClientSlug): string => `${owner}:${String(slug)}`;\n\nconst legacyMcpClientMatches = (\n  client: OAuthClientSummary,\n  candidates: ReadonlySet<string>,\n  config: McpIntegrationConfigType | null,\n): boolean => {\n  if (!candidates.has(String(client.slug))) return false;\n  if (!config || config.transport !== \"remote\" || config.auth.kind !== \"oauth2\") return false;\n  return client.grant === \"authorization_code\" && (client.resource ?? null) === config.endpoint;\n};\n\n// ---------------------------------------------------------------------------\n// Tool annotations carry an `mcp` envelope alongside the executor's policy\n// hints. The executor persists `ToolDef.annotations` verbatim into the tool\n// row's JSON column, so the real MCP tool name + upstream annotations survive\n// to `invokeTool` / `resolveAnnotations` with no plugin-side store (resolveTools\n// has no ctx to write one anyway). The envelope is opaque to core.\n// ---------------------------------------------------------------------------\n\ninterface McpToolStamp {\n  readonly toolName: string;\n  readonly upstream?: McpToolAnnotations;\n}\n\ntype StampedAnnotations = ToolAnnotations & { readonly mcp: McpToolStamp };\n\nconst McpStampSchema = Schema.Struct({\n  toolName: Schema.String,\n  upstream: Schema.optional(\n    Schema.Struct({\n      title: Schema.optional(Schema.String),\n      readOnlyHint: Schema.optional(Schema.Boolean),\n      destructiveHint: Schema.optional(Schema.Boolean),\n      idempotentHint: Schema.optional(Schema.Boolean),\n      openWorldHint: Schema.optional(Schema.Boolean),\n    }),\n  ),\n});\nconst AnnotationsWithStamp = Schema.Struct({ mcp: McpStampSchema });\nconst decodeStamp = Schema.decodeUnknownOption(AnnotationsWithStamp);\n\nconst readStamp = (annotations: unknown): McpToolStamp | null =>\n  Option.match(decodeStamp(annotations), {\n    onNone: () => null,\n    onSome: (decoded) => decoded.mcp,\n  });\n\n// ---------------------------------------------------------------------------\n// Extension input shapes — `addServer` registers an MCP integration. A\n// connection (the credential) is then created against it via\n// `executor.connections.create` / `oauth.start`.\n// ---------------------------------------------------------------------------\n\nconst McpRemoteServerInputSchema = Schema.Struct({\n  transport: Schema.optional(Schema.Literal(\"remote\")),\n  name: Schema.String,\n  endpoint: Schema.String,\n  remoteTransport: Schema.optional(McpRemoteTransport),\n  headers: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  queryParams: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  slug: Schema.optional(Schema.String),\n  /** How a connection's value is applied to requests. Defaults to none. */\n  auth: Schema.optional(McpAuthTemplate),\n});\n\nconst McpStdioServerInputSchema = Schema.Struct({\n  transport: Schema.Literal(\"stdio\"),\n  name: Schema.String,\n  command: Schema.String,\n  args: Schema.optional(Schema.Array(Schema.String)),\n  env: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  cwd: Schema.optional(Schema.String),\n  slug: Schema.optional(Schema.String),\n});\n\nconst McpAddServerInputSchema = Schema.Union([\n  McpRemoteServerInputSchema,\n  McpStdioServerInputSchema,\n]);\n\nconst McpAddServerOutputSchema = Schema.Struct({\n  slug: Schema.String,\n});\n\nconst McpProbeEndpointInputSchema = Schema.Struct({\n  endpoint: Schema.String,\n  headers: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n  queryParams: Schema.optional(Schema.Record(Schema.String, Schema.String)),\n});\n\nconst McpProbeEndpointOutputSchema = Schema.Struct({\n  connected: Schema.Boolean,\n  requiresAuthentication: Schema.Boolean,\n  requiresOAuth: Schema.Boolean,\n  supportsDynamicRegistration: Schema.Boolean,\n  name: Schema.String,\n  slug: Schema.String,\n  toolCount: Schema.NullOr(Schema.Number),\n  serverName: Schema.NullOr(Schema.String),\n});\n\n// ---------------------------------------------------------------------------\n// Extension input/output shapes — `addServer` registers an MCP integration. A\n// connection (the credential) is then created against it via\n// `executor.connections.create` / `oauth.start`. Types are inferred from the\n// schemas above so the wire shape and the TS surface can't drift.\n// ---------------------------------------------------------------------------\n\nexport type McpRemoteServerInput = typeof McpRemoteServerInputSchema.Type;\nexport type McpStdioServerInput = typeof McpStdioServerInputSchema.Type;\nexport type McpServerInput = typeof McpAddServerInputSchema.Type;\nexport type McpProbeResult = typeof McpProbeEndpointOutputSchema.Type;\nexport type McpProbeEndpointInput = typeof McpProbeEndpointInputSchema.Type;\n\nconst McpGetServerInputSchema = Schema.Struct({\n  slug: Schema.String,\n});\n\nconst McpGetServerOutputSchema = Schema.Struct({\n  integration: Schema.NullOr(Schema.Unknown),\n});\n\nconst schemaToStaticToolSchema = <A, I>(schema: Schema.Decoder<A, I>): StaticToolSchema<A, I> =>\n  Schema.toStandardSchemaV1(Schema.toStandardJSONSchemaV1(schema) as never) as StaticToolSchema<\n    A,\n    I\n  >;\n\nconst McpAddServerInputStandardSchema = schemaToStaticToolSchema(McpAddServerInputSchema);\nconst McpAddServerOutputStandardSchema = schemaToStaticToolSchema(McpAddServerOutputSchema);\nconst McpProbeEndpointInputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointInputSchema);\nconst McpProbeEndpointOutputStandardSchema = schemaToStaticToolSchema(McpProbeEndpointOutputSchema);\nconst McpGetServerInputStandardSchema = schemaToStaticToolSchema(McpGetServerInputSchema);\nconst McpGetServerOutputStandardSchema = schemaToStaticToolSchema(McpGetServerOutputSchema);\n\nconst mcpToolFailure = (code: string, message: string, details?: unknown) =>\n  ToolResult.fail({\n    code,\n    message,\n    ...(details === undefined ? {} : { details }),\n  });\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst slugFrom = (slug: string): IntegrationSlug => IntegrationSlug.make(slug);\n\nconst normalizeSlug = (input: McpServerInput): string =>\n  input.slug ??\n  deriveMcpNamespace({\n    name: input.name,\n    endpoint: input.transport === \"stdio\" ? undefined : input.endpoint,\n    command: input.transport === \"stdio\" ? input.command : undefined,\n  });\n\nconst toIntegrationConfig = (input: McpServerInput): McpIntegrationConfigType => {\n  if (input.transport === \"stdio\") {\n    return {\n      transport: \"stdio\",\n      command: input.command,\n      args: input.args ? [...input.args] : undefined,\n      env: input.env,\n      cwd: input.cwd,\n    };\n  }\n  return {\n    transport: \"remote\",\n    endpoint: input.endpoint,\n    remoteTransport: input.remoteTransport ?? \"auto\",\n    queryParams: input.queryParams,\n    headers: input.headers,\n    auth: input.auth ?? { kind: \"none\" },\n  };\n};\n\ntype JsonSchemaObject = Record<string, unknown> & {\n  readonly properties?: Record<string, unknown>;\n};\n\nconst McpCallToolResultJsonSchema = z.toJSONSchema(CallToolResultSchema) as JsonSchemaObject;\n\nconst mcpCallToolResultOutputSchema = (structuredContentSchema?: unknown): JsonSchemaObject => {\n  const defaultStructuredContentSchema =\n    McpCallToolResultJsonSchema.properties?.structuredContent ?? {};\n\n  return {\n    ...McpCallToolResultJsonSchema,\n    properties: {\n      ...McpCallToolResultJsonSchema.properties,\n      structuredContent:\n        structuredContentSchema === undefined\n          ? defaultStructuredContentSchema\n          : structuredContentSchema,\n      isError: { const: false },\n    },\n    required:\n      structuredContentSchema === undefined ? [\"content\"] : [\"content\", \"structuredContent\"],\n  };\n};\n\n/** Build the executor-facing ToolDef for one discovered MCP tool, stamping the\n *  real MCP tool name + upstream annotations into the persisted annotations so\n *  they survive to invokeTool with no plugin-side store. */\nconst toToolDef = (entry: McpToolManifestEntry): ToolDef => {\n  const destructive = entry.annotations?.destructiveHint === true;\n  const stamp: McpToolStamp = {\n    toolName: entry.toolName,\n    ...(entry.annotations ? { upstream: entry.annotations } : {}),\n  };\n  const annotations: StampedAnnotations = {\n    requiresApproval: destructive,\n    ...(destructive ? { approvalDescription: entry.annotations?.title ?? entry.toolName } : {}),\n    mcp: stamp,\n  };\n  return {\n    name: ToolName.make(entry.toolId),\n    description: entry.description ?? `MCP tool: ${entry.toolName}`,\n    inputSchema: entry.inputSchema,\n    outputSchema: mcpCallToolResultOutputSchema(entry.outputSchema),\n    annotations: annotations as ToolAnnotations,\n  };\n};\n\nconst McpTextContent = Schema.Struct({ type: Schema.Literal(\"text\"), text: Schema.String });\nconst McpToolCallEnvelope = Schema.Struct({\n  isError: Schema.optional(Schema.Boolean),\n  content: Schema.optional(Schema.Array(Schema.Unknown)),\n});\n\nconst decodeMcpTextContent = Schema.decodeUnknownOption(McpTextContent);\nconst decodeMcpToolCallEnvelope = Schema.decodeUnknownOption(McpToolCallEnvelope);\n\nconst extractMcpErrorMessage = (content: unknown): string => {\n  if (Array.isArray(content)) {\n    for (const item of content) {\n      const decoded = Option.getOrUndefined(decodeMcpTextContent(item));\n      if (decoded !== undefined && decoded.text.length > 0) return decoded.text;\n    }\n  }\n  return \"MCP tool returned an error\";\n};\n\n/** Match `token` as a separator-bounded run inside a URL hostname or path,\n *  used as a low-confidence detection hint when wire-shape detection fails. */\nconst urlMatchesToken = (url: URL, token: string): boolean => {\n  const re = new RegExp(`(?:^|[^a-z0-9])${token}(?:$|[^a-z0-9])`, \"i\");\n  return re.test(url.hostname) || re.test(url.pathname);\n};\n\n/** Translate a non-MCP probe outcome into a message a user can act on.\n *  Exported for tests. */\nexport const userFacingProbeMessage = (\n  shape: Extract<McpShapeProbeResult, { kind: \"not-mcp\" } | { kind: \"unreachable\" }>,\n): string => {\n  if (shape.kind === \"unreachable\") {\n    return \"Couldn't reach this URL. Check the address, your network, and that the server is running.\";\n  }\n  return Match.value(shape.category).pipe(\n    Match.when(\n      \"auth-required\",\n      () =>\n        \"This server requires authentication. Add credentials (Authorization header, query parameter, or API key) below and retry.\",\n    ),\n    Match.when(\n      \"wrong-shape\",\n      () =>\n        \"This URL doesn't appear to host an MCP server. Double-check the address, including the path.\",\n    ),\n    Match.exhaustive,\n  );\n};\n\n// ---------------------------------------------------------------------------\n// MCP-SDK OAuth provider adapter — wraps a pre-resolved access token so the\n// transport sends it as a Bearer header. Refresh is core's responsibility\n// (the connection row carries the OAuth grant); this adapter never initiates\n// a new flow and fails loudly if the SDK tries to.\n// ---------------------------------------------------------------------------\n\nconst makeOAuthProvider = (accessToken: string): OAuthClientProvider => ({\n  get redirectUrl() {\n    return \"http://localhost/oauth/callback\";\n  },\n  get clientMetadata() {\n    return {\n      redirect_uris: [\"http://localhost/oauth/callback\"],\n      grant_types: [\"authorization_code\", \"refresh_token\"] as string[],\n      response_types: [\"code\"] as string[],\n      token_endpoint_auth_method: \"none\" as const,\n      client_name: \"Executor\",\n    };\n  },\n  clientInformation: () => undefined,\n  saveClientInformation: () => undefined,\n  tokens: () => ({ access_token: accessToken, token_type: \"Bearer\" }),\n  saveTokens: () => undefined,\n  redirectToAuthorization: async () => {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: MCP SDK OAuthClientProvider callback can only signal reauthorization by throwing\n    throw new Error(\"MCP OAuth re-authorization required\");\n  },\n  saveCodeVerifier: () => undefined,\n  codeVerifier: () => {\n    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: MCP SDK OAuthClientProvider callback requires a thrown verifier failure\n    throw new Error(\"No active PKCE verifier\");\n  },\n  saveDiscoveryState: () => undefined,\n  discoveryState: () => undefined,\n});\n\n// ---------------------------------------------------------------------------\n// Connector input — render the integration config + the connection's resolved\n// value through the auth template into a live `ConnectorInput`.\n// ---------------------------------------------------------------------------\n\nconst buildConnectorInput = (\n  config: McpIntegrationConfigType,\n  value: string | null,\n  allowStdio: boolean,\n): Effect.Effect<ConnectorInput, McpConnectionError> => {\n  if (config.transport === \"stdio\") {\n    if (!allowStdio) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message:\n            \"MCP stdio transport is disabled. Enable it by passing `dangerouslyAllowStdioMCP: true` to mcpPlugin() — only safe for trusted local contexts.\",\n        }),\n      );\n    }\n    return Effect.succeed({\n      transport: \"stdio\" as const,\n      command: config.command,\n      args: config.args,\n      env: config.env,\n      cwd: config.cwd,\n    } satisfies McpStdioIntegrationConfig);\n  }\n\n  const headers: Record<string, string> = { ...(config.headers ?? {}) };\n  let authProvider: OAuthClientProvider | undefined;\n\n  const auth = config.auth;\n  if (auth.kind === \"header\" && value !== null) {\n    headers[auth.headerName] = auth.prefix ? `${auth.prefix}${value}` : value;\n  } else if (auth.kind === \"oauth2\" && value !== null) {\n    authProvider = makeOAuthProvider(value);\n  }\n\n  return Effect.succeed({\n    transport: \"remote\" as const,\n    endpoint: config.endpoint,\n    remoteTransport: config.remoteTransport ?? \"auto\",\n    queryParams:\n      config.queryParams && Object.keys(config.queryParams).length > 0\n        ? config.queryParams\n        : undefined,\n    headers: Object.keys(headers).length > 0 ? headers : undefined,\n    authProvider,\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Declared auth methods — project the stored MCP config into the catalog's\n// plugin-agnostic `AuthMethodDescriptor[]`. Pure and tolerant of a malformed or\n// foreign config blob (returns `[]`). Exported for tests.\n//\n//   open (`none`)        → one none method carrying no credential inputs\n//   stdio                → []          (no remote connection to configure)\n//   header               → one apikey method carrying the header placement\n//   oauth2               → one oauth method carrying the MCP endpoint to probe\n//                          (`discoveryUrl`); endpoints are discovered live at\n//                          connect time, so they are NOT pre-resolved here. We\n//                          mark `supportsDynamicRegistration: true` because MCP\n//                          OAuth servers are expected to support RFC 7591 DCR;\n//                          the connect flow probes to confirm and falls back.\n// ---------------------------------------------------------------------------\n\nexport const describeMcpAuthMethods = (\n  record: IntegrationRecord,\n): readonly AuthMethodDescriptor[] => {\n  const config = parseMcpIntegrationConfig(record.config);\n  if (!config || config.transport === \"stdio\") return [];\n\n  const auth = config.auth;\n  if (auth.kind === \"none\") {\n    return [\n      {\n        id: \"none\",\n        label: \"No authentication\",\n        kind: \"none\",\n        template: \"none\",\n      },\n    ];\n  }\n  if (auth.kind === \"header\") {\n    return [\n      {\n        id: \"header\",\n        label: \"API key (header)\",\n        kind: \"apikey\",\n        template: \"header\",\n        placements: [{ carrier: \"header\", name: auth.headerName, prefix: auth.prefix ?? \"\" }],\n      },\n    ];\n  }\n  if (auth.kind === \"oauth2\") {\n    return [\n      {\n        id: \"oauth2\",\n        label: \"OAuth\",\n        kind: \"oauth\",\n        template: \"oauth2\",\n        oauth: { discoveryUrl: config.endpoint, supportsDynamicRegistration: true },\n      },\n    ];\n  }\n  return [];\n};\n\nexport const describeMcpIntegrationDisplay = (\n  record: IntegrationRecord,\n): { readonly url?: string } => {\n  const config = parseMcpIntegrationConfig(record.config);\n  if (!config || config.transport === \"stdio\") return {};\n  return { url: config.endpoint };\n};\n\n// ---------------------------------------------------------------------------\n// Plugin factory\n// ---------------------------------------------------------------------------\n\nexport interface McpPluginOptions {\n  /**\n   * Allow configuring stdio-transport MCP servers. Off by default.\n   *\n   * Stdio servers spawn a local subprocess that inherits the parent\n   * `process.env`. Only enable for trusted single-user contexts.\n   */\n  readonly dangerouslyAllowStdioMCP?: boolean;\n  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;\n}\n\nexport const mcpPlugin = definePlugin((options?: McpPluginOptions) => {\n  const allowStdio = options?.dangerouslyAllowStdioMCP ?? false;\n\n  const presetEntries = (\n    allowStdio\n      ? mcpPresets\n      : mcpPresets.filter((preset) => !(\"transport\" in preset && preset.transport === \"stdio\"))\n  ).map((preset) => ({\n    id: preset.id,\n    name: preset.name,\n    summary: preset.summary,\n    ...(\"url\" in preset && preset.url ? { url: preset.url } : {}),\n    ...(\"endpoint\" in preset && preset.endpoint ? { endpoint: preset.endpoint } : {}),\n    ...(preset.icon ? { icon: preset.icon } : {}),\n    ...(preset.featured ? { featured: preset.featured } : {}),\n    transport: (\"transport\" in preset && preset.transport === \"stdio\" ? \"stdio\" : \"remote\") as\n      | \"stdio\"\n      | \"remote\",\n    ...(\"command\" in preset ? { command: preset.command } : {}),\n    ...(\"args\" in preset && preset.args ? { args: [...preset.args] } : {}),\n    ...(\"env\" in preset && preset.env ? { env: preset.env } : {}),\n  }));\n\n  return {\n    id: MCP_PLUGIN_ID,\n    packageName: \"@executor-js/plugin-mcp\",\n    integrationPresets: presetEntries,\n    // Surfaced to the client bundle via the Vite plugin. The MCP `./client`\n    // factory reads `allowStdio` and gates the stdio tab + presets.\n    clientConfig: { allowStdio },\n    storage: () => ({}),\n\n    extension: (ctx: PluginCtx) => {\n      const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;\n\n      const probeEndpoint = (input: string | McpProbeEndpointInput) =>\n        Effect.gen(function* () {\n          const endpoint = typeof input === \"string\" ? input : input.endpoint;\n          const trimmed = endpoint.trim();\n          if (!trimmed) {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: \"Endpoint URL is required\",\n            });\n          }\n\n          const name = yield* Effect.try({\n            try: () => new URL(trimmed).hostname,\n            catch: () => \"mcp\",\n          }).pipe(Effect.orElseSucceed(() => \"mcp\"));\n          const slug = deriveMcpNamespace({ endpoint: trimmed });\n\n          const probeHeaders = typeof input === \"string\" ? undefined : input.headers;\n          const probeQueryParams = typeof input === \"string\" ? undefined : input.queryParams;\n\n          const connector = createMcpConnector({\n            transport: \"remote\",\n            endpoint: trimmed,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n\n          const result = yield* discoverTools(connector).pipe(\n            Effect.map((m) => ({ ok: true as const, manifest: m })),\n            Effect.catch(() => Effect.succeed({ ok: false as const, manifest: null })),\n            Effect.withSpan(\"mcp.plugin.discover_tools\"),\n          );\n\n          if (result.ok && result.manifest) {\n            return {\n              connected: true,\n              requiresAuthentication: false,\n              requiresOAuth: false,\n              supportsDynamicRegistration: false,\n              name: result.manifest.server?.name ?? name,\n              slug,\n              toolCount: result.manifest.tools.length,\n              serverName: result.manifest.server?.name ?? null,\n            } satisfies McpProbeResult;\n          }\n\n          // Confirm the endpoint actually speaks MCP before classifying it as\n          // OAuth-protected (an OAuth-protected non-MCP service would\n          // otherwise be misclassified).\n          const shape = yield* probeMcpEndpointShape(trimmed, {\n            httpClientLayer,\n            headers: probeHeaders,\n            queryParams: probeQueryParams,\n          });\n          if (shape.kind !== \"mcp\") {\n            return yield* new McpConnectionError({\n              transport: \"remote\",\n              message: userFacingProbeMessage(shape),\n            });\n          }\n\n          const probeResult = yield* ctx.oauth.probe({ url: trimmed }).pipe(\n            Effect.map((oauth) => ({ ok: true as const, oauth })),\n            Effect.catch(() => Effect.succeed({ ok: false as const, oauth: null })),\n            Effect.withSpan(\"mcp.plugin.probe_oauth\"),\n          );\n\n          if (probeResult.ok) {\n            return {\n              connected: false,\n              requiresAuthentication: true,\n              requiresOAuth: true,\n              supportsDynamicRegistration: probeResult.oauth.registrationEndpoint != null,\n              name,\n              slug,\n              toolCount: null,\n              serverName: null,\n            } satisfies McpProbeResult;\n          }\n\n          if (shape.requiresAuth) {\n            return {\n              connected: false,\n              requiresAuthentication: true,\n              requiresOAuth: false,\n              supportsDynamicRegistration: false,\n              name,\n              slug,\n              toolCount: null,\n              serverName: null,\n            } satisfies McpProbeResult;\n          }\n\n          return yield* new McpConnectionError({\n            transport: \"remote\",\n            message:\n              \"This endpoint looks like MCP, but Executor couldn't discover tools from it. Check the URL and try again.\",\n          });\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.probe_endpoint\", {\n            attributes: { \"mcp.endpoint\": typeof input === \"string\" ? input : input.endpoint },\n          }),\n        );\n\n      const addServer = (input: McpServerInput) =>\n        Effect.gen(function* () {\n          const slug = normalizeSlug(input);\n          const config = toIntegrationConfig(input);\n\n          // Block re-adding an existing slug. The core `integrations.register`\n          // primitive upserts (so boot re-registration is idempotent), but an\n          // explicit add must NOT silently clobber an existing integration's\n          // tools, connections, and policies. To add more auth, update the\n          // existing integration instead.\n          const existing = yield* ctx.core.integrations.get(slugFrom(slug));\n          if (existing) {\n            return yield* new IntegrationAlreadyExistsError({ slug: slugFrom(slug) });\n          }\n\n          yield* ctx.core.integrations\n            .register({\n              slug: slugFrom(slug),\n              description: input.name,\n              config,\n              canRemove: true,\n              canRefresh: true,\n            })\n            .pipe(\n              Effect.withSpan(\"mcp.plugin.register_integration\", {\n                attributes: { \"mcp.integration.slug\": slug },\n              }),\n            );\n          return { slug };\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.add_server\", {\n            attributes: {\n              \"mcp.server.transport\": input.transport ?? \"remote\",\n              \"mcp.server.name\": input.name,\n            },\n          }),\n        );\n\n      const removeServer = (slug: string) =>\n        Effect.gen(function* () {\n          const integration = slugFrom(slug);\n          const record = yield* ctx.core.integrations.get(integration);\n          const config = record ? parseMcpIntegrationConfig(record.config) : null;\n          const legacyCandidates = legacyOAuthClientSlugCandidates(slug, record);\n          const connections = yield* ctx.connections.list({ integration });\n          const allConnections = yield* ctx.connections.list();\n          const oauthClientSummaries = yield* ctx.oauth.listClients();\n          const usedElsewhere = new Set(\n            allConnections\n              .filter((connection) => String(connection.integration) !== String(integration))\n              .flatMap((connection) =>\n                connection.oauthClient == null\n                  ? []\n                  : [\n                      oauthClientKey(\n                        connection.oauthClientOwner ?? connection.owner,\n                        connection.oauthClient,\n                      ),\n                    ],\n              ),\n          );\n          const oauthClientsByKey = new Map(\n            oauthClientSummaries.map((client) => [\n              oauthClientKey(client.owner, client.slug),\n              client,\n            ]),\n          );\n          const clientsToRemove = new Map<\n            string,\n            { readonly owner: Owner; readonly slug: OAuthClientSlug }\n          >();\n\n          for (const connection of connections) {\n            if (connection.oauthClient == null) continue;\n            const owner = connection.oauthClientOwner ?? connection.owner;\n            const key = oauthClientKey(owner, connection.oauthClient);\n            const client = oauthClientsByKey.get(key);\n            if (client?.origin.kind !== \"dynamic_client_registration\") continue;\n            clientsToRemove.set(key, {\n              owner,\n              slug: connection.oauthClient,\n            });\n          }\n          for (const client of oauthClientSummaries) {\n            const key = oauthClientKey(client.owner, client.slug);\n            if (usedElsewhere.has(key)) continue;\n            if (\n              client.origin.kind === \"dynamic_client_registration\" &&\n              (client.origin.integration == null || String(client.origin.integration) === slug)\n            ) {\n              clientsToRemove.set(key, { owner: client.owner, slug: client.slug });\n              continue;\n            }\n            if (legacyMcpClientMatches(client, legacyCandidates, config)) {\n              clientsToRemove.set(key, { owner: client.owner, slug: client.slug });\n            }\n          }\n\n          yield* ctx.core.integrations\n            .remove(integration)\n            .pipe(Effect.catchTag(\"IntegrationRemovalNotAllowedError\", () => Effect.void));\n\n          yield* Effect.forEach(\n            clientsToRemove.values(),\n            (client) => ctx.oauth.removeClient(client.owner, client.slug),\n            { discard: true },\n          );\n        }).pipe(\n          Effect.withSpan(\"mcp.plugin.remove_server\", {\n            attributes: { \"mcp.integration.slug\": slug },\n          }),\n        );\n\n      const getServer = (slug: string) =>\n        ctx.core.integrations.get(slugFrom(slug)).pipe(\n          Effect.withSpan(\"mcp.plugin.get_server\", {\n            attributes: { \"mcp.integration.slug\": slug },\n          }),\n        );\n\n      const configureServer = (slug: string, config: McpIntegrationConfigType) =>\n        ctx.core.integrations.update(slugFrom(slug), { config }).pipe(\n          Effect.withSpan(\"mcp.plugin.configure_server\", {\n            attributes: { \"mcp.integration.slug\": slug },\n          }),\n        );\n\n      return {\n        probeEndpoint,\n        addServer,\n        removeServer,\n        getServer,\n        configureServer,\n      };\n    },\n\n    // -----------------------------------------------------------------------\n    // Per-connection tool production. Dial the server using the connection's\n    // resolved value (rendered through the integration's auth template) and\n    // list its tools. The real MCP tool name + upstream annotations are\n    // stamped into each ToolDef's annotations so invokeTool can recover them.\n    // Discovery failures (auth not ready, server down) yield an empty tool set\n    // rather than failing — the connection still lands and can be refreshed.\n    // -----------------------------------------------------------------------\n    resolveTools: ({ config, connection, getValue }) =>\n      Effect.gen(function* () {\n        const parsed = parseMcpIntegrationConfig(config);\n        if (!parsed) return { tools: [] as readonly ToolDef[] };\n\n        const value = yield* getValue().pipe(Effect.orElseSucceed(() => null));\n\n        const built = yield* buildConnectorInput(parsed, value, allowStdio).pipe(\n          Effect.map((ci) => createMcpConnector(ci)),\n          Effect.result,\n        );\n\n        const manifest = Result.isSuccess(built)\n          ? yield* discoverTools(built.success).pipe(\n              Effect.map((m) => ({ ok: true as const, manifest: m })),\n              Effect.catch(() => Effect.succeed({ ok: false as const, manifest: null })),\n              Effect.withSpan(\"mcp.plugin.discover_tools\", {\n                attributes: { \"mcp.connection.name\": String(connection.name) },\n              }),\n            )\n          : { ok: false as const, manifest: null };\n\n        const entries = manifest.ok && manifest.manifest ? manifest.manifest.tools : [];\n        return { tools: entries.map(toToolDef) };\n      }).pipe(\n        Effect.withSpan(\"mcp.plugin.resolve_tools\", {\n          attributes: { \"mcp.connection.name\": String(connection.name) },\n        }),\n      ) as Effect.Effect<{ readonly tools: readonly ToolDef[] }, StorageFailure>,\n\n    invokeTool: ({ toolRow, credential, args, elicit }) =>\n      Effect.gen(function* () {\n        const parsed = parseMcpIntegrationConfig(credential.config);\n        if (!parsed) {\n          return yield* new McpConnectionError({\n            transport: \"auto\",\n            message: `MCP integration \"${toolRow.integration}\" has no usable config`,\n          });\n        }\n\n        const stamp = readStamp(toolRow.annotations);\n        if (!stamp) {\n          return yield* new McpToolDiscoveryError({\n            stage: \"list_tools\",\n            message: `Tool \"${toolRow.name}\" is missing its MCP binding — refresh the connection`,\n          });\n        }\n\n        const transport: string =\n          parsed.transport === \"stdio\" ? \"stdio\" : (parsed.remoteTransport ?? \"auto\");\n\n        const connector: McpConnector = yield* buildConnectorInput(\n          parsed,\n          credential.value,\n          allowStdio,\n        ).pipe(Effect.map((ci) => createMcpConnector(ci)));\n\n        const raw = yield* invokeMcpTool({\n          toolId: String(toolRow.name),\n          toolName: stamp.toolName,\n          args,\n          transport,\n          connector,\n          elicit,\n        });\n\n        const envelope = Option.getOrUndefined(decodeMcpToolCallEnvelope(raw));\n        if (envelope?.isError === true) {\n          return ToolResult.fail({\n            code: \"mcp_tool_error\",\n            message: extractMcpErrorMessage(envelope.content),\n            details: { content: envelope.content },\n          });\n        }\n        return ToolResult.ok(raw);\n      }).pipe(\n        Effect.catchTag(\"McpConnectionError\", ({ message }) =>\n          Effect.succeed(\n            authToolFailure({\n              code: \"connection_rejected\",\n              message,\n              source: { id: String(credential.integration) },\n              credential: { kind: \"upstream\", label: String(credential.connection) },\n            }),\n          ),\n        ),\n        Effect.withSpan(\"mcp.plugin.invoke_tool\", {\n          attributes: {\n            \"mcp.tool.name\": String(toolRow.name),\n            \"mcp.integration.slug\": String(toolRow.integration),\n          },\n        }),\n      ),\n\n    detect: ({ ctx, url }: { readonly ctx: PluginCtx; readonly url: string }) =>\n      Effect.gen(function* () {\n        const httpClientLayer = options?.httpClientLayer ?? ctx.httpClientLayer;\n        const trimmed = url.trim();\n        if (!trimmed) return null;\n\n        const parsed = yield* Effect.try({\n          try: () => new URL(trimmed),\n          catch: (cause) => cause,\n        }).pipe(Effect.option);\n        if (Option.isNone(parsed)) return null;\n\n        const name = parsed.value.hostname || \"mcp\";\n        const slug = deriveMcpNamespace({ endpoint: trimmed });\n\n        const connector = createMcpConnector({ transport: \"remote\", endpoint: trimmed });\n\n        const connected = yield* discoverTools(connector).pipe(\n          Effect.map(() => true),\n          Effect.catch(() => Effect.succeed(false)),\n          Effect.withSpan(\"mcp.plugin.discover_tools\"),\n        );\n\n        if (connected) {\n          return {\n            kind: MCP_PLUGIN_ID,\n            confidence: \"high\" as const,\n            endpoint: trimmed,\n            name,\n            slug,\n          };\n        }\n\n        const shape = yield* probeMcpEndpointShape(trimmed, { httpClientLayer });\n        if (shape.kind === \"mcp\") {\n          return {\n            kind: MCP_PLUGIN_ID,\n            confidence: \"high\" as const,\n            endpoint: trimmed,\n            name,\n            slug,\n          };\n        }\n\n        // Low-confidence URL-token fallback when wire-shape detection can't\n        // confirm MCP but the URL itself is a strong hint.\n        if (urlMatchesToken(parsed.value, \"mcp\")) {\n          return {\n            kind: MCP_PLUGIN_ID,\n            confidence: \"low\" as const,\n            endpoint: trimmed,\n            name,\n            slug,\n          };\n        }\n\n        return null;\n      }).pipe(\n        Effect.catch(() => Effect.succeed(null)),\n        Effect.withSpan(\"mcp.plugin.detect\", {\n          attributes: { \"mcp.endpoint\": url },\n        }),\n      ),\n\n    // Honour upstream destructiveHint from MCP ToolAnnotations using the stamp\n    // persisted in each tool row's annotations.\n    resolveAnnotations: ({ toolRows }) =>\n      Effect.sync(() => {\n        const out: Record<string, ToolAnnotations> = {};\n        for (const row of toolRows) {\n          const stamp = readStamp(row.annotations);\n          const ann = stamp?.upstream;\n          if (ann?.destructiveHint === true) {\n            out[String(row.name)] = {\n              requiresApproval: true,\n              approvalDescription: ann.title ?? stamp?.toolName ?? String(row.name),\n            };\n          } else {\n            out[String(row.name)] = { requiresApproval: false };\n          }\n        }\n        return out;\n      }),\n\n    describeAuthMethods: describeMcpAuthMethods,\n    describeIntegrationDisplay: describeMcpIntegrationDisplay,\n\n    integrationConfigure: {\n      type: \"mcp\",\n      configure: ({ ctx, integration, config }) =>\n        Effect.gen(function* () {\n          const next = parseMcpIntegrationConfig(config);\n          if (!next) return;\n          yield* ctx.core.integrations.update(integration, { config: next });\n        }),\n    },\n\n    staticSources: (self) => [\n      {\n        id: \"mcp\",\n        kind: \"executor\",\n        name: \"MCP\",\n        tools: [\n          tool({\n            name: \"probeEndpoint\",\n            description:\n              \"Probe a remote MCP endpoint before adding it. If the result requires OAuth, run the core OAuth handoff (`oauth.probe`, `oauth.start`) to mint a connection; otherwise create a connection with `connections.create` carrying the API key or header value.\",\n            inputSchema: McpProbeEndpointInputStandardSchema,\n            outputSchema: McpProbeEndpointOutputStandardSchema,\n            execute: (input) =>\n              self.probeEndpoint(input as McpProbeEndpointInput).pipe(\n                Effect.map(ToolResult.ok),\n                Effect.catchTag(\"McpConnectionError\", ({ message, transport }) =>\n                  Effect.succeed(mcpToolFailure(\"mcp_connection_failed\", message, { transport })),\n                ),\n              ),\n          }),\n          tool({\n            name: \"getServer\",\n            description:\n              \"Inspect a registered MCP integration, including transport, endpoint/command, and auth template. Use this before creating a connection (`connections.create` / `oauth.start`).\",\n            inputSchema: McpGetServerInputStandardSchema,\n            outputSchema: McpGetServerOutputStandardSchema,\n            execute: (input) => {\n              const args = input as typeof McpGetServerInputSchema.Type;\n              return Effect.map(self.getServer(args.slug), (integration) =>\n                ToolResult.ok({ integration }),\n              );\n            },\n          }),\n          tool({\n            name: \"addServer\",\n            description:\n              \"Register an MCP server in the catalog as an integration. Returns its `slug`. Then create a connection against it: for header/API-key auth call `connections.create` with the value; for OAuth-protected servers run `oauth.probe` + `oauth.start`. Tools are produced per-connection at connection create / refresh.\",\n            annotations: {\n              requiresApproval: true,\n              approvalDescription: \"Add an MCP server\",\n            },\n            inputSchema: McpAddServerInputStandardSchema,\n            outputSchema: McpAddServerOutputStandardSchema,\n            execute: (rawInput) => {\n              const input = rawInput as typeof McpAddServerInputSchema.Type;\n              return self.addServer(input as McpServerInput).pipe(\n                Effect.map(ToolResult.ok),\n                Effect.catchTag(\n                  \"IntegrationAlreadyExistsError\",\n                  ({ slug }: IntegrationAlreadyExistsError) =>\n                    Effect.succeed(\n                      mcpToolFailure(\n                        \"integration_already_exists\",\n                        `Integration ${slug} already exists; update it instead of re-adding.`,\n                      ),\n                    ),\n                ),\n              );\n            },\n          }),\n        ],\n      },\n    ],\n  };\n});\n\n// ---------------------------------------------------------------------------\n// McpPluginExtension — shape of `executor.mcp` for consumers (api/, react/).\n// ---------------------------------------------------------------------------\n\nexport type McpExtensionFailure = McpConnectionError | McpToolDiscoveryError | StorageFailure;\n\nexport interface McpPluginExtension {\n  readonly probeEndpoint: (\n    input: string | McpProbeEndpointInput,\n  ) => Effect.Effect<McpProbeResult, McpExtensionFailure>;\n  readonly addServer: (\n    input: McpServerInput,\n  ) => Effect.Effect<\n    { readonly slug: string },\n    McpExtensionFailure | IntegrationAlreadyExistsError\n  >;\n  readonly removeServer: (slug: string) => Effect.Effect<void, McpExtensionFailure>;\n  readonly getServer: (\n    slug: string,\n  ) => Effect.Effect<\n    (Integration & { readonly config: IntegrationConfig }) | null,\n    McpExtensionFailure\n  >;\n  readonly configureServer: (\n    slug: string,\n    config: McpIntegrationConfigType,\n  ) => Effect.Effect<void, McpExtensionFailure>;\n}\n","import type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { SSEClientTransport } from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { CfWorkerJsonSchemaValidator } from \"@modelcontextprotocol/sdk/validation/cfworker\";\nimport { Effect } from \"effect\";\n\n// NOTE: `StdioClientTransport` is NOT imported eagerly. The upstream module\n// (`@modelcontextprotocol/sdk/client/stdio.js`) touches `node:child_process`\n// at evaluation time, which crashes workerd (incl. vitest-pool-workers) at\n// SIGSEGV on module instantiation. Cloud callers set\n// `dangerouslyAllowStdioMCP: false` and never reach the stdio branch below;\n// prod bundles that DO use stdio load it via a dynamic import inside the\n// stdio branch of `createMcpConnector`.\n\nimport type { McpRemoteIntegrationConfig, McpStdioIntegrationConfig } from \"./types\";\nimport { McpConnectionError } from \"./errors\";\n\n// ---------------------------------------------------------------------------\n// Connection type\n// ---------------------------------------------------------------------------\n\nexport type McpConnection = {\n  readonly client: Client;\n  readonly close: () => Promise<void>;\n};\n\nexport type McpConnector = Effect.Effect<McpConnection, McpConnectionError>;\n\n// ---------------------------------------------------------------------------\n// Connector input — extends stored source data with resolved auth\n// ---------------------------------------------------------------------------\n\nexport type RemoteConnectorInput = Omit<\n  McpRemoteIntegrationConfig,\n  \"auth\" | \"remoteTransport\" | \"headers\" | \"queryParams\"\n> & {\n  readonly remoteTransport?: McpRemoteIntegrationConfig[\"remoteTransport\"];\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n  readonly authProvider?: OAuthClientProvider;\n};\n\nexport type StdioConnectorInput = McpStdioIntegrationConfig;\n\nexport type ConnectorInput = RemoteConnectorInput | StdioConnectorInput;\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst buildEndpointUrl = (endpoint: string, queryParams: Record<string, string>): URL => {\n  const url = new URL(endpoint);\n  for (const [key, value] of Object.entries(queryParams)) {\n    url.searchParams.set(key, value);\n  }\n  return url;\n};\n\n// Use the cfworker JSON Schema validator instead of the SDK's default\n// (Ajv). Ajv compiles schemas via `new Function(...)`, which throws\n// `Code generation from strings disallowed for this context` when the\n// MCP plugin runs inside a Cloudflare Worker (executor.sh). The\n// cfworker validator does not use code generation and works in every\n// runtime we ship to.\nconst createClient = (): Client =>\n  new Client(\n    { name: \"executor-mcp\", version: \"0.1.0\" },\n    {\n      capabilities: { elicitation: { form: {}, url: {} } },\n      jsonSchemaValidator: new CfWorkerJsonSchemaValidator(),\n    },\n  );\n\nconst connectionFromClient = (client: Client): McpConnection => ({\n  client,\n  close: () => client.close(),\n});\n\nconst connectClient = (input: {\n  transport: string;\n  createTransport: () => Parameters<Client[\"connect\"]>[0];\n}): Effect.Effect<McpConnection, McpConnectionError> =>\n  Effect.gen(function* () {\n    const client = createClient();\n    const transportInstance = input.createTransport();\n\n    yield* Effect.tryPromise({\n      try: () => client.connect(transportInstance),\n      catch: () =>\n        new McpConnectionError({\n          transport: input.transport,\n          message: `Failed connecting via ${input.transport}`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.connection.handshake\", {\n        attributes: { \"plugin.mcp.transport\": input.transport },\n      }),\n    );\n\n    return connectionFromClient(client);\n  });\n\n// ---------------------------------------------------------------------------\n// Public factory\n// ---------------------------------------------------------------------------\n\nexport const createMcpConnector = (input: ConnectorInput): McpConnector => {\n  if (input.transport === \"stdio\") {\n    const command = input.command.trim();\n    if (!command) {\n      return Effect.fail(\n        new McpConnectionError({\n          transport: \"stdio\",\n          message: \"MCP stdio transport requires a command\",\n        }),\n      );\n    }\n\n    return Effect.gen(function* () {\n      // Dynamic import so the underlying module (which evaluates\n      // `node:child_process`) is only loaded when stdio is actually used.\n      const { createStdioTransport } = yield* Effect.tryPromise({\n        try: () => import(\"./stdio-connector\"),\n        catch: () =>\n          new McpConnectionError({\n            transport: \"stdio\",\n            message: \"Failed to load stdio transport module\",\n          }),\n      });\n\n      return yield* connectClient({\n        transport: \"stdio\",\n        createTransport: () =>\n          createStdioTransport({\n            command,\n            args: input.args,\n            env: input.env,\n            cwd: input.cwd?.trim().length ? input.cwd.trim() : undefined,\n          }),\n      });\n    });\n  }\n\n  // Remote transport\n  const headers = input.headers ?? {};\n  const remoteTransport = input.remoteTransport ?? \"auto\";\n  const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;\n\n  const endpoint = buildEndpointUrl(input.endpoint, input.queryParams ?? {});\n\n  const connectStreamableHttp = connectClient({\n    transport: \"streamable-http\",\n    createTransport: () =>\n      new StreamableHTTPClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  const connectSse = connectClient({\n    transport: \"sse\",\n    createTransport: () =>\n      new SSEClientTransport(endpoint, {\n        requestInit,\n        authProvider: input.authProvider,\n      }),\n  });\n\n  if (remoteTransport === \"streamable-http\") return connectStreamableHttp;\n  if (remoteTransport === \"sse\") return connectSse;\n\n  // auto — try streamable-http first, fall back to SSE\n  return connectStreamableHttp.pipe(Effect.catch(() => connectSse));\n};\n","// ---------------------------------------------------------------------------\n// MCP tool discovery — connect to an MCP server and list its tools\n// ---------------------------------------------------------------------------\n\nimport { Effect } from \"effect\";\n\nimport type { McpConnector } from \"./connection\";\nimport { McpToolDiscoveryError } from \"./errors\";\nimport {\n  extractManifestFromListToolsResult,\n  isListToolsResult,\n  type McpToolManifest,\n} from \"./manifest\";\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Connect to an MCP server and discover all available tools.\n * Returns the parsed manifest containing server metadata and tool entries.\n */\nexport const discoverTools = (\n  connector: McpConnector,\n): Effect.Effect<McpToolManifest, McpToolDiscoveryError> =>\n  Effect.gen(function* () {\n    // Acquire connection\n    const connection = yield* connector.pipe(\n      Effect.mapError(\n        ({ message }) =>\n          new McpToolDiscoveryError({\n            stage: \"connect\",\n            message: `Failed connecting to MCP server: ${message}`,\n          }),\n      ),\n    );\n\n    // List tools\n    const listResult = yield* Effect.tryPromise({\n      try: () => connection.client.listTools(),\n      catch: () =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"Failed listing MCP tools\",\n        }),\n    });\n\n    if (!isListToolsResult(listResult)) {\n      yield* closeConnection(connection);\n      return yield* new McpToolDiscoveryError({\n        stage: \"list_tools\",\n        message: \"MCP listTools response did not match the expected schema\",\n      });\n    }\n\n    const manifest = extractManifestFromListToolsResult(listResult, {\n      serverInfo: connection.client.getServerVersion?.(),\n    });\n\n    // Close the connection after discovery\n    yield* closeConnection(connection);\n\n    return manifest;\n  });\n\nconst closeConnection = (connection: {\n  readonly close: () => Promise<void>;\n}): Effect.Effect<void, never> =>\n  Effect.ignore(\n    Effect.tryPromise({\n      try: () => connection.close(),\n      catch: () =>\n        new McpToolDiscoveryError({\n          stage: \"list_tools\",\n          message: \"Failed closing MCP connection\",\n        }),\n    }),\n  );\n","// ---------------------------------------------------------------------------\n// MCP tool invocation — shared helper called from plugin.invokeTool.\n//\n// Responsible for:\n//   1. Dialing a fresh MCP client connection for the call (no DB-connection\n//      caching — request-scoped per the Hyperdrive rule; each invoke acquires\n//      and releases its own connection).\n//   2. Installing a per-invocation `ElicitRequestSchema` handler that bridges\n//      MCP's elicit capability into the host's elicit function threaded via\n//      `InvokeToolInput.elicit`.\n//   3. Calling `client.callTool({ name, arguments })`.\n// ---------------------------------------------------------------------------\n\nimport { Cause, Effect, Exit, Option, Predicate, Schema } from \"effect\";\n\nimport { ElicitRequestSchema } from \"@modelcontextprotocol/sdk/types.js\";\n\nimport {\n  ElicitationId,\n  FormElicitation,\n  UrlElicitation,\n  type Elicit,\n  type ElicitationRequest,\n} from \"@executor-js/sdk\";\n\nimport { McpConnectionError, McpInvocationError } from \"./errors\";\nimport type { McpConnection, McpConnector } from \"./connection\";\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nconst ArgsRecord = Schema.Record(Schema.String, Schema.Unknown);\nconst decodeArgsRecord = Schema.decodeUnknownOption(ArgsRecord);\n\nconst argsRecord = (value: unknown): Record<string, unknown> =>\n  Option.getOrElse(decodeArgsRecord(value), () => ({}));\n\n// ---------------------------------------------------------------------------\n// Elicitation bridge — decode incoming MCP ElicitRequest, route through\n// the host's elicit function, marshal the response back to MCP shape.\n// ---------------------------------------------------------------------------\n\nconst McpElicitParams = Schema.Union([\n  Schema.Struct({\n    mode: Schema.Literal(\"url\"),\n    message: Schema.String,\n    url: Schema.String,\n    elicitationId: Schema.optional(Schema.String),\n    id: Schema.optional(Schema.String),\n  }),\n  Schema.Struct({\n    mode: Schema.optional(Schema.Literal(\"form\")),\n    message: Schema.String,\n    requestedSchema: Schema.Record(Schema.String, Schema.Unknown),\n  }),\n]);\ntype McpElicitParams = typeof McpElicitParams.Type;\n\nconst decodeElicitParams = Schema.decodeUnknownSync(McpElicitParams);\n\nconst toElicitationRequest = (params: McpElicitParams): ElicitationRequest =>\n  params.mode === \"url\"\n    ? UrlElicitation.make({\n        message: params.message,\n        url: params.url,\n        elicitationId: ElicitationId.make(params.elicitationId ?? params.id ?? \"\"),\n      })\n    : FormElicitation.make({\n        message: params.message,\n        requestedSchema: params.requestedSchema,\n      });\n\nconst installElicitationHandler = (client: McpConnection[\"client\"], elicit: Elicit): void => {\n  client.setRequestHandler(ElicitRequestSchema, async (request: { params: unknown }) => {\n    const params = decodeElicitParams(request.params);\n    const req = toElicitationRequest(params);\n    // Use runPromiseExit so we can inspect typed failures — `elicit`\n    // fails with `ElicitationDeclinedError` on decline/cancel, which\n    // we translate into the equivalent MCP elicit response instead of\n    // surfacing as a JSON-RPC error.\n    const exit = await Effect.runPromiseExit(elicit(req));\n    if (Exit.isSuccess(exit)) {\n      const response = exit.value;\n      return {\n        action: response.action,\n        ...(response.action === \"accept\" && response.content ? { content: response.content } : {}),\n      };\n    }\n    const failure = exit.cause.reasons.find(Cause.isFailReason);\n    if (failure) {\n      const err = failure.error;\n      if (Predicate.isTagged(err, \"ElicitationDeclinedError\")) {\n        const action =\n          Predicate.hasProperty(err, \"action\") && err.action === \"cancel\" ? \"cancel\" : \"decline\";\n        return { action };\n      }\n    }\n    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: MCP SDK async request handlers signal unexpected failures by rejecting\n    throw Cause.squash(exit.cause);\n  });\n};\n\n// ---------------------------------------------------------------------------\n// Single tool call — install handler, callTool, return raw result\n// ---------------------------------------------------------------------------\n\nconst useConnection = (\n  connection: McpConnection,\n  toolName: string,\n  args: Record<string, unknown>,\n  elicit: Elicit,\n): Effect.Effect<unknown, McpInvocationError> =>\n  Effect.gen(function* () {\n    installElicitationHandler(connection.client, elicit);\n    return yield* Effect.tryPromise({\n      try: () => connection.client.callTool({ name: toolName, arguments: args }),\n      catch: () =>\n        new McpInvocationError({\n          toolName,\n          message: `MCP tool call failed for ${toolName}`,\n        }),\n    }).pipe(\n      Effect.withSpan(\"plugin.mcp.client.call_tool\", {\n        attributes: { \"mcp.tool.name\": toolName },\n      }),\n    );\n  });\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\nexport interface InvokeMcpToolInput {\n  readonly toolId: string;\n  /** The real MCP tool name advertised by the server. */\n  readonly toolName: string;\n  readonly args: unknown;\n  readonly transport: string;\n  /** Dials a fresh connection. The connection is closed after the call. */\n  readonly connector: McpConnector;\n  readonly elicit: Elicit;\n}\n\nexport const invokeMcpTool = (\n  input: InvokeMcpToolInput,\n): Effect.Effect<unknown, McpConnectionError | McpInvocationError> =>\n  Effect.gen(function* () {\n    const args = argsRecord(input.args);\n\n    const connection = yield* Effect.acquireRelease(\n      input.connector.pipe(\n        Effect.withSpan(\"plugin.mcp.connection.acquire\", {\n          attributes: { \"plugin.mcp.transport\": input.transport },\n        }),\n      ),\n      (conn) =>\n        Effect.ignore(\n          Effect.tryPromise({\n            try: () => conn.close(),\n            catch: () =>\n              new McpConnectionError({\n                transport: input.transport,\n                message: \"Failed to close MCP connection\",\n              }),\n          }),\n        ),\n    );\n\n    return yield* useConnection(connection, input.toolName, args, input.elicit);\n  }).pipe(\n    Effect.scoped,\n    Effect.withSpan(\"plugin.mcp.invoke\", {\n      attributes: {\n        \"mcp.tool.name\": input.toolName,\n        \"plugin.mcp.tool_id\": input.toolId,\n        \"plugin.mcp.transport\": input.transport,\n      },\n    }),\n  );\n","// ---------------------------------------------------------------------------\n// MCP endpoint shape probe — decide whether an unknown HTTP endpoint is\n// actually speaking MCP before we try to classify it as such.\n//\n// Background:\n//\n//   `discoverTools` (via the MCP SDK's StreamableHTTP / SSE transport)\n//   fails for every non-MCP endpoint too — 200-with-HTML, 400-GraphQL,\n//   404, etc. all surface as the same opaque transport error. We need\n//   our own classifier that distinguishes \"real MCP\" from\n//   \"OAuth-protected non-MCP service\" without relying on RFC 9728/8414\n//   metadata, since (a) plenty of non-MCP APIs publish that metadata,\n//   and (b) plenty of real MCP servers authenticate with static API\n//   keys and publish no OAuth metadata at all (e.g. cubic.dev).\n//\n// The probe issues an unauth JSON-RPC `initialize` POST and accepts\n// only the wire shapes a real MCP server can return:\n//\n//   - 2xx with `Content-Type: text/event-stream` — streamable HTTP\n//     transport, body is an SSE stream we don't consume.\n//   - 2xx with `Content-Type: application/json` whose body parses as a\n//     JSON-RPC 2.0 envelope (`{jsonrpc:\"2.0\", result|error|method,...}`).\n//   - 401 with `WWW-Authenticate: Bearer` AND a JSON-RPC error envelope\n//     in the body. The body shape is what separates a real MCP server\n//     from an unrelated OAuth-protected API: GraphQL/REST/HTML 401s\n//     don't shape themselves as JSON-RPC.\n//\n// When POST returns 404/405/406/415 we retry with GET + `Accept:\n// text/event-stream` to support legacy SSE-only servers; that path\n// only accepts 2xx with `text/event-stream` or the same 401+Bearer\n// shape.\n//\n// One `fetch` (occasionally two), no MCP-SDK session state, no OAuth\n// round-trip, no DCR — every non-MCP endpoint exits here.\n// ---------------------------------------------------------------------------\n\nimport { Data, Duration, Effect, Layer, Option, Schema } from \"effect\";\nimport { FetchHttpClient, HttpClient, HttpClientRequest } from \"effect/unstable/http\";\n\n/** MCP initialize request body used as the shape probe. Any real MCP\n *  server either answers it (unauth-OK server) or returns the spec-\n *  mandated 401 + WWW-Authenticate pair. A non-MCP endpoint hit with\n *  this body will respond with whatever it does for unknown JSON\n *  payloads — 400, 404, HTML, a GraphQL error envelope, etc. — none of\n *  which match the gate below. */\nconst INITIALIZE_BODY = JSON.stringify({\n  jsonrpc: \"2.0\",\n  id: 1,\n  method: \"initialize\",\n  params: {\n    protocolVersion: \"2025-06-18\",\n    capabilities: {},\n    clientInfo: { name: \"executor-probe\", version: \"0\" },\n  },\n});\n\n/** Header-name lookup is case-insensitive per RFC 7230. `fetch`'s\n *  `Response.headers` already lower-cases, but we normalise explicitly\n *  to stay robust against test mocks that construct `Headers` loosely. */\nconst readHeader = (headers: Readonly<Record<string, string>>, name: string): string | null => {\n  const direct = headers[name];\n  if (direct !== undefined) return direct;\n  const lower = name.toLowerCase();\n  for (const [k, v] of Object.entries(headers)) {\n    if (k.toLowerCase() === lower) return v;\n  }\n  return null;\n};\n\nclass ProbeTransportError extends Data.TaggedError(\"ProbeTransportError\")<{\n  readonly reason: string;\n  readonly cause: unknown;\n}> {}\n\nconst decodeJsonString = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown));\n\nconst asObject = (body: string): Record<string, unknown> | null => {\n  if (!body) return null;\n  const parsed = decodeJsonString(body);\n  if (Option.isNone(parsed)) return null;\n  const value = parsed.value;\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return null;\n  return value as Record<string, unknown>;\n};\n\n/** Quick check that a body parses as a JSON-RPC 2.0 envelope. The MCP wire\n *  protocol is JSON-RPC 2.0, so a real MCP server's response to `initialize`\n *  (whether 2xx with the result, or a 401 error envelope) carries this\n *  shape. Non-MCP services don't — GraphQL APIs return `{errors:[...]}`,\n *  REST APIs return their own envelope, marketing pages return HTML. */\nconst isJsonRpcEnvelope = (body: string): boolean => {\n  const obj = asObject(body);\n  if (!obj) return false;\n  if (obj.jsonrpc !== \"2.0\") return false;\n  return \"result\" in obj || \"error\" in obj || \"method\" in obj;\n};\n\n/** Quick check that a body parses as an RFC 6750 OAuth Bearer error\n *  envelope (`{error: \"invalid_token\", error_description?: ..., ...}`).\n *  Real MCP servers like Atlassian return this shape on unauth requests\n *  even when their WWW-Authenticate omits `resource_metadata=`. The\n *  GraphQL `{errors: [...]}` envelope, which a non-MCP OAuth-protected\n *  GraphQL API would return, is explicitly excluded. */\nconst isOAuthErrorBody = (body: string): boolean => {\n  const obj = asObject(body);\n  if (!obj) return false;\n  if (Array.isArray(obj.errors)) return false;\n  return typeof obj.error === \"string\";\n};\n\n/** RFC 9728 protected-resource-metadata document. We only need the two\n *  fields that prove the document genuinely describes an OAuth-protected\n *  resource: `resource` (the resource identifier) and a non-empty\n *  `authorization_servers` list. */\nconst ProtectedResourceMetadata = Schema.Struct({\n  resource: Schema.String,\n  authorization_servers: Schema.Array(Schema.String),\n});\nconst decodeProtectedResourceMetadata = Schema.decodeUnknownOption(\n  Schema.fromJsonString(ProtectedResourceMetadata),\n);\n\n/** RFC 9728 §3.1 path-scoped well-known URL: insert\n *  `/.well-known/oauth-protected-resource` before the resource's path\n *  component. `https://host/api/mcp` → `https://host/.well-known/oauth-\n *  protected-resource/api/mcp`. This is exactly the URL the MCP\n *  authorization spec tells clients to construct. */\nconst protectedResourceMetadataUrl = (endpoint: URL): string => {\n  const path = endpoint.pathname === \"/\" ? \"\" : endpoint.pathname;\n  return `${endpoint.origin}/.well-known/oauth-protected-resource${path}`;\n};\n\n/** The RFC 9728 `resource` value must actually describe this endpoint\n *  before we trust the document — an exact URL match, or a same-origin\n *  parent whose path is a prefix of the endpoint's. Guards against a\n *  shared host serving protected-resource metadata for some unrelated\n *  resource. */\nconst resourceMatchesEndpoint = (resource: string, endpoint: URL): boolean => {\n  if (!URL.canParse(resource)) return false;\n  const parsed = new URL(resource);\n  if (parsed.origin !== endpoint.origin) return false;\n  const resourcePath = parsed.pathname.replace(/\\/+$/, \"\");\n  const endpointPath = endpoint.pathname.replace(/\\/+$/, \"\");\n  return endpointPath === resourcePath || endpointPath.startsWith(`${resourcePath}/`);\n};\n\n/** Workaround for MCP servers that omit (or under-specify) the\n *  `WWW-Authenticate` challenge on their 401 — e.g. Datadog's\n *  `mcp.datadoghq.com` returns a bare `401 {\"errors\":[\"Unauthorized\"]}`\n *  with no header at all, so the wire-shape gate above can't tell it\n *  apart from an unrelated OAuth-protected API and the user lands on the\n *  manual-credentials prompt instead of an OAuth sign-in.\n *\n *  The MCP authorization spec still requires such servers to publish\n *  RFC 9728 metadata at the path-scoped well-known URL. A document there\n *  whose `resource` matches this endpoint is a deliberate, MCP-spec-\n *  specific signal a generic OAuth API would not emit — strong enough to\n *  classify the endpoint as MCP so the OAuth flow can start. */\nconst probeProtectedResourceMetadata = (\n  client: HttpClient.HttpClient,\n  endpoint: URL,\n  timeoutMs: number,\n): Effect.Effect<boolean> =>\n  Effect.gen(function* () {\n    const response = yield* client\n      .execute(\n        HttpClientRequest.get(protectedResourceMetadataUrl(endpoint)).pipe(\n          HttpClientRequest.setHeader(\"accept\", \"application/json\"),\n        ),\n      )\n      .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n    if (response.status < 200 || response.status >= 300) return false;\n    const body = yield* response.text.pipe(\n      Effect.timeout(Duration.millis(timeoutMs)),\n      Effect.catch(() => Effect.succeed(\"\")),\n    );\n    const metadata = decodeProtectedResourceMetadata(body);\n    if (Option.isNone(metadata)) return false;\n    if (metadata.value.authorization_servers.length === 0) return false;\n    return resourceMatchesEndpoint(metadata.value.resource, endpoint);\n  }).pipe(Effect.catch(() => Effect.succeed(false)));\n\nconst ErrorMessageShape = Schema.Struct({ message: Schema.String });\nconst decodeErrorMessageShape = Schema.decodeUnknownOption(ErrorMessageShape);\n\nconst reasonFromBoundaryCause = (cause: unknown): string => {\n  const messageShape = decodeErrorMessageShape(cause);\n  if (Option.isSome(messageShape)) return messageShape.value.message;\n  if (typeof cause === \"string\") return cause;\n  if (typeof cause === \"number\" || typeof cause === \"boolean\" || typeof cause === \"bigint\") {\n    return `${cause}`;\n  }\n  if (typeof cause === \"symbol\") return cause.description ?? \"symbol\";\n  if (cause === null) return \"null\";\n  if (typeof cause === \"undefined\") return \"undefined\";\n  return \"fetch failed\";\n};\n\n/** Why the probe rejected an endpoint as not-MCP.\n *\n *  - `auth-required` — server returned 401. We don't know for sure it's\n *    an MCP server (no spec-compliant Bearer challenge or the body\n *    isn't JSON-RPC), but the right next step for the user is the same\n *    either way: provide credentials and retry. This is what\n *    misclassifies real MCP servers like cubic.dev (no\n *    resource_metadata) or ref.tools (no WWW-Authenticate at all)\n *    without the URL-token fallback at the detect layer.\n *  - `wrong-shape` — endpoint responded but with a body or status that\n *    doesn't match any MCP shape (200 HTML, 400 GraphQL, 404 from a\n *    static host, etc.). User action: this URL probably isn't MCP. */\nexport type McpProbeRejectCategory = \"auth-required\" | \"wrong-shape\";\n\nexport type McpShapeProbeResult =\n  /** Server answered initialize successfully — either a 2xx with a\n   *  JSON-RPC payload, or a 401 + WWW-Authenticate: Bearer (RFC 6750\n   *  challenge) that the MCP auth spec requires. */\n  | { readonly kind: \"mcp\"; readonly requiresAuth: boolean }\n  /** Endpoint is reachable but the response does not look like MCP. */\n  | {\n      readonly kind: \"not-mcp\";\n      readonly reason: string;\n      readonly category: McpProbeRejectCategory;\n    }\n  /** Transport-level failure (DNS, TLS, timeout, abort, ...). */\n  | { readonly kind: \"unreachable\"; readonly reason: string };\n\nexport interface ProbeOptions {\n  /** Abort the request after this many ms. Default 8000. */\n  readonly timeoutMs?: number;\n  readonly httpClientLayer?: Layer.Layer<HttpClient.HttpClient>;\n  readonly headers?: Record<string, string>;\n  readonly queryParams?: Record<string, string>;\n}\n\n/**\n * Hit `endpoint` with a JSON-RPC `initialize` POST and classify the\n * response according to the MCP authorization spec.\n *\n * Returns `{kind: \"mcp\"}` only when the endpoint either:\n *   - answers with 2xx (unauth-OK MCP server), or\n *   - responds 401 with a `Bearer` WWW-Authenticate challenge.\n *\n * Anything else (400, 404, 200-with-HTML, 200-with-GraphQL-errors, ...)\n * is classified `not-mcp`. Transport errors surface as `unreachable`.\n */\nexport const probeMcpEndpointShape = (\n  endpoint: string,\n  options: ProbeOptions = {},\n): Effect.Effect<McpShapeProbeResult> =>\n  Effect.gen(function* () {\n    const timeoutMs = options.timeoutMs ?? 8_000;\n    const outcome = yield* Effect.gen(function* () {\n      const client = yield* HttpClient.HttpClient;\n\n      const readBody = (response: {\n        readonly text: Effect.Effect<string, unknown>;\n      }): Effect.Effect<string> =>\n        response.text.pipe(\n          Effect.timeout(Duration.millis(timeoutMs)),\n          Effect.catch(() => Effect.succeed(\"\")),\n        );\n\n      const classify = (\n        response: {\n          readonly status: number;\n          readonly headers: Readonly<Record<string, string>>;\n          readonly text: Effect.Effect<string, unknown>;\n        },\n        method: \"GET\" | \"POST\",\n      ): Effect.Effect<McpShapeProbeResult | null> =>\n        Effect.gen(function* () {\n          const contentType = readHeader(response.headers, \"content-type\") ?? \"\";\n          const isSse = /^\\s*text\\/event-stream\\b/i.test(contentType);\n\n          if (response.status === 401) {\n            const wwwAuth = readHeader(response.headers, \"www-authenticate\");\n            if (!wwwAuth || !/^\\s*bearer\\b/i.test(wwwAuth)) {\n              // Spec-non-compliant 401 (no `Bearer` challenge). Before\n              // giving up, check whether the server still publishes\n              // RFC 9728 protected-resource metadata for this path —\n              // some real MCP servers (Datadog) do exactly this.\n              if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {\n                return { kind: \"mcp\", requiresAuth: true } as const;\n              }\n              return {\n                kind: \"not-mcp\",\n                category: \"auth-required\",\n                reason: \"401 without Bearer WWW-Authenticate — not an MCP auth challenge\",\n              } as const;\n            }\n            // Spec-compliant MCP signal: the auth spec mandates a\n            // `resource_metadata=` attribute pointing at the server's\n            // RFC 9728 document. Real OAuth-protected MCP servers\n            // (sentry.dev, etc.) include it. This attribute is rare on\n            // unrelated OAuth services and is the cleanest accept signal\n            // we have when the 401 body is RFC 6750 OAuth-shape rather\n            // than JSON-RPC.\n            if (/(?:^|[\\s,])resource_metadata\\s*=/i.test(wwwAuth)) {\n              return { kind: \"mcp\", requiresAuth: true } as const;\n            }\n            // Looser RFC 6750 §3.1 signal: the Bearer challenge carries\n            // `error=` / `error_description=` auth-params. Real MCP\n            // servers (Supabase, GitHub Copilot, Vercel, Neon, Tavily,\n            // Replicate, ...) include this even when they omit\n            // `resource_metadata=`. The body alone isn't enough for\n            // those — Supabase, e.g., returns `{\"message\":\"Unauthorized\"}`\n            // which is neither JSON-RPC nor RFC 6750. The `error=`\n            // auth-param is the tiebreaker.\n            if (/(?:^|[\\s,])error\\s*=/i.test(wwwAuth)) {\n              return { kind: \"mcp\", requiresAuth: true } as const;\n            }\n            // SSE responses can't carry a JSON-RPC error envelope; accept the\n            // Bearer challenge alone in that case (rare but spec-permissible).\n            if (isSse) return { kind: \"mcp\", requiresAuth: true } as const;\n            // Fallback for MCP servers whose 401 omits\n            // `resource_metadata=`. Two body shapes count:\n            //   - JSON-RPC error (cubic.dev: API-key auth, JSON-RPC\n            //     errors end-to-end).\n            //   - RFC 6750 OAuth Bearer error envelope `{error:\n            //     \"invalid_token\", ...}` without GraphQL `{errors:[...]}`\n            //     (Atlassian).\n            // Non-MCP OAuth-protected services that issue bare Bearer\n            // challenges (Railway-style GraphQL, etc.) return `errors`\n            // arrays or other shapes that fail both checks.\n            const body = yield* readBody(response);\n            if (!isJsonRpcEnvelope(body) && !isOAuthErrorBody(body)) {\n              // Bearer challenge with no usable accept signal. Same\n              // RFC 9728 fallback as the no-`Bearer` case above.\n              if (yield* probeProtectedResourceMetadata(client, url, timeoutMs)) {\n                return { kind: \"mcp\", requiresAuth: true } as const;\n              }\n              return {\n                kind: \"not-mcp\",\n                category: \"auth-required\",\n                reason:\n                  \"401 + Bearer without resource_metadata, JSON-RPC body, or OAuth error body\",\n              } as const;\n            }\n            return { kind: \"mcp\", requiresAuth: true } as const;\n          }\n\n          if (response.status >= 200 && response.status < 300) {\n            if (method === \"GET\") {\n              if (!isSse) {\n                return {\n                  kind: \"not-mcp\",\n                  category: \"wrong-shape\",\n                  reason: \"GET response is not an SSE stream\",\n                } as const;\n              }\n              return { kind: \"mcp\", requiresAuth: false } as const;\n            }\n            // POST 2xx: SSE body is opaque to us; otherwise require a\n            // JSON-RPC envelope so we don't accept HTML/REST 200 responses.\n            if (isSse) return { kind: \"mcp\", requiresAuth: false } as const;\n            const body = yield* readBody(response);\n            if (!isJsonRpcEnvelope(body)) {\n              return {\n                kind: \"not-mcp\",\n                category: \"wrong-shape\",\n                reason: \"2xx POST body is not a JSON-RPC envelope\",\n              } as const;\n            }\n            return { kind: \"mcp\", requiresAuth: false } as const;\n          }\n\n          return null;\n        });\n\n      const url = new URL(endpoint);\n      for (const [key, value] of Object.entries(options.queryParams ?? {})) {\n        url.searchParams.set(key, value);\n      }\n\n      let postRequest = HttpClientRequest.post(url.toString()).pipe(\n        HttpClientRequest.setHeader(\"content-type\", \"application/json\"),\n        HttpClientRequest.setHeader(\"accept\", \"application/json, text/event-stream\"),\n        HttpClientRequest.bodyText(INITIALIZE_BODY, \"application/json\"),\n      );\n      for (const [name, value] of Object.entries(options.headers ?? {})) {\n        postRequest = HttpClientRequest.setHeader(postRequest, name, value);\n      }\n\n      const postResponse = yield* client\n        .execute(postRequest)\n        .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n\n      const postResult = yield* classify(postResponse, \"POST\");\n      if (postResult) return postResult;\n\n      if ([404, 405, 406, 415].includes(postResponse.status)) {\n        let getRequest = HttpClientRequest.get(url.toString()).pipe(\n          HttpClientRequest.setHeader(\"accept\", \"text/event-stream\"),\n        );\n        for (const [name, value] of Object.entries(options.headers ?? {})) {\n          getRequest = HttpClientRequest.setHeader(getRequest, name, value);\n        }\n        const getResponse = yield* client\n          .execute(getRequest)\n          .pipe(Effect.timeout(Duration.millis(timeoutMs)));\n        const getResult = yield* classify(getResponse, \"GET\");\n        if (getResult) return getResult;\n      }\n\n      return {\n        kind: \"not-mcp\",\n        category: \"wrong-shape\",\n        reason: `unexpected status ${postResponse.status} for initialize`,\n      } as const;\n    }).pipe(\n      Effect.provide(options.httpClientLayer ?? FetchHttpClient.layer),\n      Effect.mapError(\n        (cause) =>\n          new ProbeTransportError({\n            reason: reasonFromBoundaryCause(cause),\n            cause,\n          }),\n      ),\n      Effect.catch((cause) =>\n        Effect.succeed<McpShapeProbeResult>({\n          kind: \"unreachable\",\n          reason: cause.reason,\n        }),\n      ),\n    );\n\n    return outcome;\n  }).pipe(Effect.withSpan(\"mcp.plugin.probe_shape\"));\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,QAAQ,cAAc;AA+B/B,IAAM,aAAa,OAAO,OAAO;AAAA,EAC/B,MAAM,OAAO;AAAA,EACb,aAAa,OAAO,SAAS,OAAO,OAAO,OAAO,MAAM,CAAC;AAAA,EACzD,aAAa,OAAO,SAAS,OAAO,OAAO;AAAA,EAC3C,YAAY,OAAO,SAAS,OAAO,OAAO;AAAA,EAC1C,cAAc,OAAO,SAAS,OAAO,OAAO;AAAA,EAC5C,aAAa,OAAO,SAAS,kBAAkB;AACjD,CAAC;AAED,IAAM,kBAAkB,OAAO,OAAO;AAAA,EACpC,OAAO,OAAO,MAAM,UAAU;AAChC,CAAC;AAED,IAAM,aAAa,OAAO,OAAO;AAAA,EAC/B,MAAM,OAAO,SAAS,OAAO,MAAM;AAAA,EACnC,SAAS,OAAO,SAAS,OAAO,MAAM;AACxC,CAAC;AAED,IAAM,wBAAwB,OAAO,oBAAoB,eAAe;AACxE,IAAM,mBAAmB,OAAO,oBAAoB,UAAU;AAEvD,IAAM,oBAAoB,CAAC,UAChC,OAAO,OAAO,sBAAsB,KAAK,CAAC;AAM5C,IAAM,WAAW,CAAC,UAA0B;AAC1C,QAAM,IAAI,MACP,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK;AACd;AAEA,IAAM,WAAW,CAAC,OAAe,SAAsC;AACrE,QAAM,OAAO,SAAS,KAAK;AAC3B,QAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK;AAClC,OAAK,IAAI,MAAM,CAAC;AAChB,SAAO,MAAM,IAAI,OAAO,GAAG,IAAI,IAAI,CAAC;AACtC;AAMO,IAAM,eAAe,CAAC,WAA+B,WAC1D,WAAW,KAAK,IAAI,GAAG,SAAS,IAAI,MAAM,KAAK;AAE1C,IAAM,qCAAqC,CAChD,iBACA,aACoB;AACpB,QAAM,OAAO,oBAAI,IAAoB;AAErC,QAAM,SAAS,sBAAsB,eAAe,EAAE;AAAA,IACpD,OAAO,IAAI,CAAC,WAAW,OAAO,KAAK;AAAA,IACnC,OAAO,UAAU,MAAM,CAAC,CAAC;AAAA,EAC3B;AAEA,QAAM,SAAS,iBAAiB,UAAU,UAAU,EAAE;AAAA,IACpD,OAAO;AAAA,MACL,CAAC,UAA6B;AAAA,QAC5B,MAAM,KAAK,QAAQ;AAAA,QACnB,SAAS,KAAK,WAAW;AAAA,MAC3B;AAAA,IACF;AAAA,IACA,OAAO;AAAA,EACT;AAEA,QAAM,QAAQ,OAAO,QAAQ,CAACA,UAAiC;AAC7D,UAAM,WAAWA,MAAK,KAAK,KAAK;AAChC,QAAI,CAAC,SAAU,QAAO,CAAC;AAEvB,WAAO;AAAA,MACL;AAAA,QACE,QAAQ,SAAS,UAAU,IAAI;AAAA,QAC/B;AAAA,QACA,aAAaA,MAAK,eAAe;AAAA,QACjC,aAAaA,MAAK,eAAeA,MAAK;AAAA,QACtC,cAAcA,MAAK;AAAA,QACnB,aAAaA,MAAK;AAAA,MACpB;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO,EAAE,QAAQ,MAAM;AACzB;AAMA,IAAM,UAAU,CAAC,UACf,MACG,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAE3B,IAAM,aAAa,CAAC,QAA+B;AACjD,MAAI,CAAC,IAAI,SAAS,GAAG,EAAG,QAAO;AAC/B,SAAO,IAAI,IAAI,GAAG,EAAE;AACtB;AAEA,IAAM,aAAa,CAAC,SAAyB,KAAK,KAAK,EAAE,MAAM,OAAO,EAAE,IAAI,KAAK,KAAK,KAAK;AAEpF,IAAM,qBAAqB,CAAC,UAIrB;AACZ,MAAI,MAAM,MAAM,KAAK,EAAG,QAAO,QAAQ,MAAM,IAAI,KAAK;AAEtD,QAAM,eAAe,MAAM,UAAU,KAAK,IAAI,WAAW,MAAM,QAAQ,IAAI;AAC3E,MAAI,aAAc,QAAO,QAAQ,YAAY,KAAK;AAElD,MAAI,MAAM,SAAS,KAAK,EAAG,QAAO,QAAQ,WAAW,MAAM,OAAO,CAAC,KAAK;AAExE,SAAO;AACT;;;ACxJA,SAAS,UAAAC,SAAe,OAAO,UAAAC,SAAQ,QAAQ,UAAAC,eAAc;AAI7D,SAAS,4BAA4B;AACrC,YAAY,OAAO;AAEnB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAYA;AAAA,OACK;;;AC1BP,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAC9C,SAAS,mCAAmC;AAC5C,SAAS,cAAc;AA8CvB,IAAM,mBAAmB,CAAC,UAAkB,gBAA6C;AACvF,QAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,QAAI,aAAa,IAAI,KAAK,KAAK;AAAA,EACjC;AACA,SAAO;AACT;AAQA,IAAM,eAAe,MACnB,IAAI;AAAA,EACF,EAAE,MAAM,gBAAgB,SAAS,QAAQ;AAAA,EACzC;AAAA,IACE,cAAc,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,EAAE;AAAA,IACnD,qBAAqB,IAAI,4BAA4B;AAAA,EACvD;AACF;AAEF,IAAM,uBAAuB,CAAC,YAAmC;AAAA,EAC/D;AAAA,EACA,OAAO,MAAM,OAAO,MAAM;AAC5B;AAEA,IAAM,gBAAgB,CAAC,UAIrB,OAAO,IAAI,aAAa;AACtB,QAAM,SAAS,aAAa;AAC5B,QAAM,oBAAoB,MAAM,gBAAgB;AAEhD,SAAO,OAAO,WAAW;AAAA,IACvB,KAAK,MAAM,OAAO,QAAQ,iBAAiB;AAAA,IAC3C,OAAO,MACL,IAAI,mBAAmB;AAAA,MACrB,WAAW,MAAM;AAAA,MACjB,SAAS,yBAAyB,MAAM,SAAS;AAAA,IACnD,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACD,OAAO,SAAS,mCAAmC;AAAA,MACjD,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,IACxD,CAAC;AAAA,EACH;AAEA,SAAO,qBAAqB,MAAM;AACpC,CAAC;AAMI,IAAM,qBAAqB,CAAC,UAAwC;AACzE,MAAI,MAAM,cAAc,SAAS;AAC/B,UAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAI,CAAC,SAAS;AACZ,aAAO,OAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAEA,WAAO,OAAO,IAAI,aAAa;AAG7B,YAAM,EAAE,qBAAqB,IAAI,OAAO,OAAO,WAAW;AAAA,QACxD,KAAK,MAAM,OAAO,+BAAmB;AAAA,QACrC,OAAO,MACL,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SAAS;AAAA,QACX,CAAC;AAAA,MACL,CAAC;AAED,aAAO,OAAO,cAAc;AAAA,QAC1B,WAAW;AAAA,QACX,iBAAiB,MACf,qBAAqB;AAAA,UACnB;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,KAAK,MAAM;AAAA,UACX,KAAK,MAAM,KAAK,KAAK,EAAE,SAAS,MAAM,IAAI,KAAK,IAAI;AAAA,QACrD,CAAC;AAAA,MACL,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAGA,QAAM,UAAU,MAAM,WAAW,CAAC;AAClC,QAAM,kBAAkB,MAAM,mBAAmB;AACjD,QAAM,cAAc,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI;AAEpE,QAAM,WAAW,iBAAiB,MAAM,UAAU,MAAM,eAAe,CAAC,CAAC;AAEzE,QAAM,wBAAwB,cAAc;AAAA,IAC1C,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,8BAA8B,UAAU;AAAA,MAC1C;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,QAAM,aAAa,cAAc;AAAA,IAC/B,WAAW;AAAA,IACX,iBAAiB,MACf,IAAI,mBAAmB,UAAU;AAAA,MAC/B;AAAA,MACA,cAAc,MAAM;AAAA,IACtB,CAAC;AAAA,EACL,CAAC;AAED,MAAI,oBAAoB,kBAAmB,QAAO;AAClD,MAAI,oBAAoB,MAAO,QAAO;AAGtC,SAAO,sBAAsB,KAAK,OAAO,MAAM,MAAM,UAAU,CAAC;AAClE;;;AC1KA,SAAS,UAAAC,eAAc;AAkBhB,IAAM,gBAAgB,CAC3B,cAEAC,QAAO,IAAI,aAAa;AAEtB,QAAM,aAAa,OAAO,UAAU;AAAA,IAClCA,QAAO;AAAA,MACL,CAAC,EAAE,QAAQ,MACT,IAAI,sBAAsB;AAAA,QACxB,OAAO;AAAA,QACP,SAAS,oCAAoC,OAAO;AAAA,MACtD,CAAC;AAAA,IACL;AAAA,EACF;AAGA,QAAM,aAAa,OAAOA,QAAO,WAAW;AAAA,IAC1C,KAAK,MAAM,WAAW,OAAO,UAAU;AAAA,IACvC,OAAO,MACL,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC;AAED,MAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,WAAO,gBAAgB,UAAU;AACjC,WAAO,OAAO,IAAI,sBAAsB;AAAA,MACtC,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,QAAM,WAAW,mCAAmC,YAAY;AAAA,IAC9D,YAAY,WAAW,OAAO,mBAAmB;AAAA,EACnD,CAAC;AAGD,SAAO,gBAAgB,UAAU;AAEjC,SAAO;AACT,CAAC;AAEH,IAAM,kBAAkB,CAAC,eAGvBA,QAAO;AAAA,EACLA,QAAO,WAAW;AAAA,IAChB,KAAK,MAAM,WAAW,MAAM;AAAA,IAC5B,OAAO,MACL,IAAI,sBAAsB;AAAA,MACxB,OAAO;AAAA,MACP,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC;AACH;;;AChEF,SAAS,OAAO,UAAAC,SAAQ,MAAM,UAAAC,SAAQ,WAAW,UAAAC,eAAc;AAE/D,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AASP,IAAM,aAAaC,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAC9D,IAAM,mBAAmBA,QAAO,oBAAoB,UAAU;AAE9D,IAAM,aAAa,CAAC,UAClBC,QAAO,UAAU,iBAAiB,KAAK,GAAG,OAAO,CAAC,EAAE;AAOtD,IAAM,kBAAkBD,QAAO,MAAM;AAAA,EACnCA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,QAAQ,KAAK;AAAA,IAC1B,SAASA,QAAO;AAAA,IAChB,KAAKA,QAAO;AAAA,IACZ,eAAeA,QAAO,SAASA,QAAO,MAAM;AAAA,IAC5C,IAAIA,QAAO,SAASA,QAAO,MAAM;AAAA,EACnC,CAAC;AAAA,EACDA,QAAO,OAAO;AAAA,IACZ,MAAMA,QAAO,SAASA,QAAO,QAAQ,MAAM,CAAC;AAAA,IAC5C,SAASA,QAAO;AAAA,IAChB,iBAAiBA,QAAO,OAAOA,QAAO,QAAQA,QAAO,OAAO;AAAA,EAC9D,CAAC;AACH,CAAC;AAGD,IAAM,qBAAqBA,QAAO,kBAAkB,eAAe;AAEnE,IAAM,uBAAuB,CAAC,WAC5B,OAAO,SAAS,QACZ,eAAe,KAAK;AAAA,EAClB,SAAS,OAAO;AAAA,EAChB,KAAK,OAAO;AAAA,EACZ,eAAe,cAAc,KAAK,OAAO,iBAAiB,OAAO,MAAM,EAAE;AAC3E,CAAC,IACD,gBAAgB,KAAK;AAAA,EACnB,SAAS,OAAO;AAAA,EAChB,iBAAiB,OAAO;AAC1B,CAAC;AAEP,IAAM,4BAA4B,CAAC,QAAiC,WAAyB;AAC3F,SAAO,kBAAkB,qBAAqB,OAAO,YAAiC;AACpF,UAAM,SAAS,mBAAmB,QAAQ,MAAM;AAChD,UAAM,MAAM,qBAAqB,MAAM;AAKvC,UAAM,OAAO,MAAME,QAAO,eAAe,OAAO,GAAG,CAAC;AACpD,QAAI,KAAK,UAAU,IAAI,GAAG;AACxB,YAAM,WAAW,KAAK;AACtB,aAAO;AAAA,QACL,QAAQ,SAAS;AAAA,QACjB,GAAI,SAAS,WAAW,YAAY,SAAS,UAAU,EAAE,SAAS,SAAS,QAAQ,IAAI,CAAC;AAAA,MAC1F;AAAA,IACF;AACA,UAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,YAAY;AAC1D,QAAI,SAAS;AACX,YAAM,MAAM,QAAQ;AACpB,UAAI,UAAU,SAAS,KAAK,0BAA0B,GAAG;AACvD,cAAM,SACJ,UAAU,YAAY,KAAK,QAAQ,KAAK,IAAI,WAAW,WAAW,WAAW;AAC/E,eAAO,EAAE,OAAO;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,MAAM,OAAO,KAAK,KAAK;AAAA,EAC/B,CAAC;AACH;AAMA,IAAM,gBAAgB,CACpB,YACA,UACA,MACA,WAEAA,QAAO,IAAI,aAAa;AACtB,4BAA0B,WAAW,QAAQ,MAAM;AACnD,SAAO,OAAOA,QAAO,WAAW;AAAA,IAC9B,KAAK,MAAM,WAAW,OAAO,SAAS,EAAE,MAAM,UAAU,WAAW,KAAK,CAAC;AAAA,IACzE,OAAO,MACL,IAAI,mBAAmB;AAAA,MACrB;AAAA,MACA,SAAS,4BAA4B,QAAQ;AAAA,IAC/C,CAAC;AAAA,EACL,CAAC,EAAE;AAAA,IACDA,QAAO,SAAS,+BAA+B;AAAA,MAC7C,YAAY,EAAE,iBAAiB,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AACF,CAAC;AAiBI,IAAM,gBAAgB,CAC3B,UAEAA,QAAO,IAAI,aAAa;AACtB,QAAM,OAAO,WAAW,MAAM,IAAI;AAElC,QAAM,aAAa,OAAOA,QAAO;AAAA,IAC/B,MAAM,UAAU;AAAA,MACdA,QAAO,SAAS,iCAAiC;AAAA,QAC/C,YAAY,EAAE,wBAAwB,MAAM,UAAU;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,IACA,CAAC,SACCA,QAAO;AAAA,MACLA,QAAO,WAAW;AAAA,QAChB,KAAK,MAAM,KAAK,MAAM;AAAA,QACtB,OAAO,MACL,IAAI,mBAAmB;AAAA,UACrB,WAAW,MAAM;AAAA,UACjB,SAAS;AAAA,QACX,CAAC;AAAA,MACL,CAAC;AAAA,IACH;AAAA,EACJ;AAEA,SAAO,OAAO,cAAc,YAAY,MAAM,UAAU,MAAM,MAAM,MAAM;AAC5E,CAAC,EAAE;AAAA,EACDA,QAAO;AAAA,EACPA,QAAO,SAAS,qBAAqB;AAAA,IACnC,YAAY;AAAA,MACV,iBAAiB,MAAM;AAAA,MACvB,sBAAsB,MAAM;AAAA,MAC5B,wBAAwB,MAAM;AAAA,IAChC;AAAA,EACF,CAAC;AACH;;;AC/IF,SAAS,MAAM,UAAU,UAAAC,SAAe,UAAAC,SAAQ,UAAAC,eAAc;AAC9D,SAAS,iBAAiB,YAAY,yBAAyB;AAQ/D,IAAM,kBAAkB,KAAK,UAAU;AAAA,EACrC,SAAS;AAAA,EACT,IAAI;AAAA,EACJ,QAAQ;AAAA,EACR,QAAQ;AAAA,IACN,iBAAiB;AAAA,IACjB,cAAc,CAAC;AAAA,IACf,YAAY,EAAE,MAAM,kBAAkB,SAAS,IAAI;AAAA,EACrD;AACF,CAAC;AAKD,IAAM,aAAa,CAAC,SAA2C,SAAgC;AAC7F,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,QAAQ,KAAK,YAAY;AAC/B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;AAC5C,QAAI,EAAE,YAAY,MAAM,MAAO,QAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,IAAM,sBAAN,cAAkC,KAAK,YAAY,qBAAqB,EAGrE;AAAC;AAEJ,IAAM,mBAAmBA,QAAO,oBAAoBA,QAAO,eAAeA,QAAO,OAAO,CAAC;AAEzF,IAAM,WAAW,CAAC,SAAiD;AACjE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,SAAS,iBAAiB,IAAI;AACpC,MAAID,QAAO,OAAO,MAAM,EAAG,QAAO;AAClC,QAAM,QAAQ,OAAO;AACrB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,SAAO;AACT;AAOA,IAAM,oBAAoB,CAAC,SAA0B;AACnD,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,YAAY,MAAO,QAAO;AAClC,SAAO,YAAY,OAAO,WAAW,OAAO,YAAY;AAC1D;AAQA,IAAM,mBAAmB,CAAC,SAA0B;AAClD,QAAM,MAAM,SAAS,IAAI;AACzB,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAG,QAAO;AACtC,SAAO,OAAO,IAAI,UAAU;AAC9B;AAMA,IAAM,4BAA4BC,QAAO,OAAO;AAAA,EAC9C,UAAUA,QAAO;AAAA,EACjB,uBAAuBA,QAAO,MAAMA,QAAO,MAAM;AACnD,CAAC;AACD,IAAM,kCAAkCA,QAAO;AAAA,EAC7CA,QAAO,eAAe,yBAAyB;AACjD;AAOA,IAAM,+BAA+B,CAAC,aAA0B;AAC9D,QAAM,OAAO,SAAS,aAAa,MAAM,KAAK,SAAS;AACvD,SAAO,GAAG,SAAS,MAAM,wCAAwC,IAAI;AACvE;AAOA,IAAM,0BAA0B,CAAC,UAAkB,aAA2B;AAC5E,MAAI,CAAC,IAAI,SAAS,QAAQ,EAAG,QAAO;AACpC,QAAM,SAAS,IAAI,IAAI,QAAQ;AAC/B,MAAI,OAAO,WAAW,SAAS,OAAQ,QAAO;AAC9C,QAAM,eAAe,OAAO,SAAS,QAAQ,QAAQ,EAAE;AACvD,QAAM,eAAe,SAAS,SAAS,QAAQ,QAAQ,EAAE;AACzD,SAAO,iBAAiB,gBAAgB,aAAa,WAAW,GAAG,YAAY,GAAG;AACpF;AAcA,IAAM,iCAAiC,CACrC,QACA,UACA,cAEAF,QAAO,IAAI,aAAa;AACtB,QAAM,WAAW,OAAO,OACrB;AAAA,IACC,kBAAkB,IAAI,6BAA6B,QAAQ,CAAC,EAAE;AAAA,MAC5D,kBAAkB,UAAU,UAAU,kBAAkB;AAAA,IAC1D;AAAA,EACF,EACC,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAClD,MAAI,SAAS,SAAS,OAAO,SAAS,UAAU,IAAK,QAAO;AAC5D,QAAM,OAAO,OAAO,SAAS,KAAK;AAAA,IAChCA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC;AAAA,IACzCA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,CAAC;AAAA,EACvC;AACA,QAAM,WAAW,gCAAgC,IAAI;AACrD,MAAIC,QAAO,OAAO,QAAQ,EAAG,QAAO;AACpC,MAAI,SAAS,MAAM,sBAAsB,WAAW,EAAG,QAAO;AAC9D,SAAO,wBAAwB,SAAS,MAAM,UAAU,QAAQ;AAClE,CAAC,EAAE,KAAKD,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC,CAAC;AAEnD,IAAM,oBAAoBE,QAAO,OAAO,EAAE,SAASA,QAAO,OAAO,CAAC;AAClE,IAAM,0BAA0BA,QAAO,oBAAoB,iBAAiB;AAE5E,IAAM,0BAA0B,CAAC,UAA2B;AAC1D,QAAM,eAAe,wBAAwB,KAAK;AAClD,MAAID,QAAO,OAAO,YAAY,EAAG,QAAO,aAAa,MAAM;AAC3D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,OAAO,UAAU,UAAU;AACxF,WAAO,GAAG,KAAK;AAAA,EACjB;AACA,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,eAAe;AAC3D,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,YAAa,QAAO;AACzC,SAAO;AACT;AAiDO,IAAM,wBAAwB,CACnC,UACA,UAAwB,CAAC,MAEzBD,QAAO,IAAI,aAAa;AACtB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,UAAU,OAAOA,QAAO,IAAI,aAAa;AAC7C,UAAM,SAAS,OAAO,WAAW;AAEjC,UAAM,WAAW,CAAC,aAGhB,SAAS,KAAK;AAAA,MACZA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC;AAAA,MACzCA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,CAAC;AAAA,IACvC;AAEF,UAAM,WAAW,CACf,UAKA,WAEAA,QAAO,IAAI,aAAa;AACtB,YAAM,cAAc,WAAW,SAAS,SAAS,cAAc,KAAK;AACpE,YAAM,QAAQ,4BAA4B,KAAK,WAAW;AAE1D,UAAI,SAAS,WAAW,KAAK;AAC3B,cAAM,UAAU,WAAW,SAAS,SAAS,kBAAkB;AAC/D,YAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,OAAO,GAAG;AAK9C,cAAI,OAAO,+BAA+B,QAAQ,KAAK,SAAS,GAAG;AACjE,mBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,UAC3C;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,UACV;AAAA,QACF;AAQA,YAAI,oCAAoC,KAAK,OAAO,GAAG;AACrD,iBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,QAC3C;AASA,YAAI,wBAAwB,KAAK,OAAO,GAAG;AACzC,iBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,QAC3C;AAGA,YAAI,MAAO,QAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAWpD,cAAM,OAAO,OAAO,SAAS,QAAQ;AACrC,YAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC,iBAAiB,IAAI,GAAG;AAGvD,cAAI,OAAO,+BAA+B,QAAQ,KAAK,SAAS,GAAG;AACjE,mBAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,UAC3C;AACA,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QACE;AAAA,UACJ;AAAA,QACF;AACA,eAAO,EAAE,MAAM,OAAO,cAAc,KAAK;AAAA,MAC3C;AAEA,UAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,YAAI,WAAW,OAAO;AACpB,cAAI,CAAC,OAAO;AACV,mBAAO;AAAA,cACL,MAAM;AAAA,cACN,UAAU;AAAA,cACV,QAAQ;AAAA,YACV;AAAA,UACF;AACA,iBAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,QAC5C;AAGA,YAAI,MAAO,QAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AACrD,cAAM,OAAO,OAAO,SAAS,QAAQ;AACrC,YAAI,CAAC,kBAAkB,IAAI,GAAG;AAC5B,iBAAO;AAAA,YACL,MAAM;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,UACV;AAAA,QACF;AACA,eAAO,EAAE,MAAM,OAAO,cAAc,MAAM;AAAA,MAC5C;AAEA,aAAO;AAAA,IACT,CAAC;AAEH,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,eAAe,CAAC,CAAC,GAAG;AACpE,UAAI,aAAa,IAAI,KAAK,KAAK;AAAA,IACjC;AAEA,QAAI,cAAc,kBAAkB,KAAK,IAAI,SAAS,CAAC,EAAE;AAAA,MACvD,kBAAkB,UAAU,gBAAgB,kBAAkB;AAAA,MAC9D,kBAAkB,UAAU,UAAU,qCAAqC;AAAA,MAC3E,kBAAkB,SAAS,iBAAiB,kBAAkB;AAAA,IAChE;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AACjE,oBAAc,kBAAkB,UAAU,aAAa,MAAM,KAAK;AAAA,IACpE;AAEA,UAAM,eAAe,OAAO,OACzB,QAAQ,WAAW,EACnB,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAElD,UAAM,aAAa,OAAO,SAAS,cAAc,MAAM;AACvD,QAAI,WAAY,QAAO;AAEvB,QAAI,CAAC,KAAK,KAAK,KAAK,GAAG,EAAE,SAAS,aAAa,MAAM,GAAG;AACtD,UAAI,aAAa,kBAAkB,IAAI,IAAI,SAAS,CAAC,EAAE;AAAA,QACrD,kBAAkB,UAAU,UAAU,mBAAmB;AAAA,MAC3D;AACA,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AACjE,qBAAa,kBAAkB,UAAU,YAAY,MAAM,KAAK;AAAA,MAClE;AACA,YAAM,cAAc,OAAO,OACxB,QAAQ,UAAU,EAClB,KAAKA,QAAO,QAAQ,SAAS,OAAO,SAAS,CAAC,CAAC;AAClD,YAAM,YAAY,OAAO,SAAS,aAAa,KAAK;AACpD,UAAI,UAAW,QAAO;AAAA,IACxB;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,qBAAqB,aAAa,MAAM;AAAA,IAClD;AAAA,EACF,CAAC,EAAE;AAAA,IACDA,QAAO,QAAQ,QAAQ,mBAAmB,gBAAgB,KAAK;AAAA,IAC/DA,QAAO;AAAA,MACL,CAAC,UACC,IAAI,oBAAoB;AAAA,QACtB,QAAQ,wBAAwB,KAAK;AAAA,QACrC;AAAA,MACF,CAAC;AAAA,IACL;AAAA,IACAA,QAAO;AAAA,MAAM,CAAC,UACZA,QAAO,QAA6B;AAAA,QAClC,MAAM;AAAA,QACN,QAAQ,MAAM;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT,CAAC,EAAE,KAAKA,QAAO,SAAS,wBAAwB,CAAC;;;AJ9XnD,IAAM,gBAAgB;AAEtB,IAAM,iCAAiC,CAAC,UAAiC;AACvE,QAAM,OAAO,MACV,KAAK,EACL,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AACzB,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,IAAM,kCAAkC,CACtC,MACA,gBACwB;AACxB,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,WAAW,+BAA+B,IAAI;AACpD,MAAI,SAAU,YAAW,IAAI,QAAQ;AACrC,QAAM,kBACJ,eAAe,OAAO,OAAO,+BAA+B,YAAY,WAAW;AACrF,MAAI,gBAAiB,YAAW,IAAI,eAAe;AACnD,SAAO;AACT;AAEA,IAAM,iBAAiB,CAAC,OAAc,SAAkC,GAAG,KAAK,IAAI,OAAO,IAAI,CAAC;AAEhG,IAAM,yBAAyB,CAC7B,QACA,YACA,WACY;AACZ,MAAI,CAAC,WAAW,IAAI,OAAO,OAAO,IAAI,CAAC,EAAG,QAAO;AACjD,MAAI,CAAC,UAAU,OAAO,cAAc,YAAY,OAAO,KAAK,SAAS,SAAU,QAAO;AACtF,SAAO,OAAO,UAAU,yBAAyB,OAAO,YAAY,UAAU,OAAO;AACvF;AAiBA,IAAM,iBAAiBG,QAAO,OAAO;AAAA,EACnC,UAAUA,QAAO;AAAA,EACjB,UAAUA,QAAO;AAAA,IACfA,QAAO,OAAO;AAAA,MACZ,OAAOA,QAAO,SAASA,QAAO,MAAM;AAAA,MACpC,cAAcA,QAAO,SAASA,QAAO,OAAO;AAAA,MAC5C,iBAAiBA,QAAO,SAASA,QAAO,OAAO;AAAA,MAC/C,gBAAgBA,QAAO,SAASA,QAAO,OAAO;AAAA,MAC9C,eAAeA,QAAO,SAASA,QAAO,OAAO;AAAA,IAC/C,CAAC;AAAA,EACH;AACF,CAAC;AACD,IAAM,uBAAuBA,QAAO,OAAO,EAAE,KAAK,eAAe,CAAC;AAClE,IAAM,cAAcA,QAAO,oBAAoB,oBAAoB;AAEnE,IAAM,YAAY,CAAC,gBACjBC,QAAO,MAAM,YAAY,WAAW,GAAG;AAAA,EACrC,QAAQ,MAAM;AAAA,EACd,QAAQ,CAAC,YAAY,QAAQ;AAC/B,CAAC;AAQH,IAAM,6BAA6BD,QAAO,OAAO;AAAA,EAC/C,WAAWA,QAAO,SAASA,QAAO,QAAQ,QAAQ,CAAC;AAAA,EACnD,MAAMA,QAAO;AAAA,EACb,UAAUA,QAAO;AAAA,EACjB,iBAAiBA,QAAO,SAAS,kBAAkB;AAAA,EACnD,SAASA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAAA,EACpE,aAAaA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAAA,EACxE,MAAMA,QAAO,SAASA,QAAO,MAAM;AAAA;AAAA,EAEnC,MAAMA,QAAO,SAAS,eAAe;AACvC,CAAC;AAED,IAAM,4BAA4BA,QAAO,OAAO;AAAA,EAC9C,WAAWA,QAAO,QAAQ,OAAO;AAAA,EACjC,MAAMA,QAAO;AAAA,EACb,SAASA,QAAO;AAAA,EAChB,MAAMA,QAAO,SAASA,QAAO,MAAMA,QAAO,MAAM,CAAC;AAAA,EACjD,KAAKA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAAA,EAChE,KAAKA,QAAO,SAASA,QAAO,MAAM;AAAA,EAClC,MAAMA,QAAO,SAASA,QAAO,MAAM;AACrC,CAAC;AAED,IAAM,0BAA0BA,QAAO,MAAM;AAAA,EAC3C;AAAA,EACA;AACF,CAAC;AAED,IAAM,2BAA2BA,QAAO,OAAO;AAAA,EAC7C,MAAMA,QAAO;AACf,CAAC;AAED,IAAM,8BAA8BA,QAAO,OAAO;AAAA,EAChD,UAAUA,QAAO;AAAA,EACjB,SAASA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAAA,EACpE,aAAaA,QAAO,SAASA,QAAO,OAAOA,QAAO,QAAQA,QAAO,MAAM,CAAC;AAC1E,CAAC;AAED,IAAM,+BAA+BA,QAAO,OAAO;AAAA,EACjD,WAAWA,QAAO;AAAA,EAClB,wBAAwBA,QAAO;AAAA,EAC/B,eAAeA,QAAO;AAAA,EACtB,6BAA6BA,QAAO;AAAA,EACpC,MAAMA,QAAO;AAAA,EACb,MAAMA,QAAO;AAAA,EACb,WAAWA,QAAO,OAAOA,QAAO,MAAM;AAAA,EACtC,YAAYA,QAAO,OAAOA,QAAO,MAAM;AACzC,CAAC;AAeD,IAAM,0BAA0BA,QAAO,OAAO;AAAA,EAC5C,MAAMA,QAAO;AACf,CAAC;AAED,IAAM,2BAA2BA,QAAO,OAAO;AAAA,EAC7C,aAAaA,QAAO,OAAOA,QAAO,OAAO;AAC3C,CAAC;AAED,IAAM,2BAA2B,CAAO,WACtCA,QAAO,mBAAmBA,QAAO,uBAAuB,MAAM,CAAU;AAK1E,IAAM,kCAAkC,yBAAyB,uBAAuB;AACxF,IAAM,mCAAmC,yBAAyB,wBAAwB;AAC1F,IAAM,sCAAsC,yBAAyB,2BAA2B;AAChG,IAAM,uCAAuC,yBAAyB,4BAA4B;AAClG,IAAM,kCAAkC,yBAAyB,uBAAuB;AACxF,IAAM,mCAAmC,yBAAyB,wBAAwB;AAE1F,IAAM,iBAAiB,CAAC,MAAc,SAAiB,YACrD,WAAW,KAAK;AAAA,EACd;AAAA,EACA;AAAA,EACA,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAC7C,CAAC;AAMH,IAAM,WAAW,CAAC,SAAkC,gBAAgB,KAAK,IAAI;AAE7E,IAAM,gBAAgB,CAAC,UACrB,MAAM,QACN,mBAAmB;AAAA,EACjB,MAAM,MAAM;AAAA,EACZ,UAAU,MAAM,cAAc,UAAU,SAAY,MAAM;AAAA,EAC1D,SAAS,MAAM,cAAc,UAAU,MAAM,UAAU;AACzD,CAAC;AAEH,IAAM,sBAAsB,CAAC,UAAoD;AAC/E,MAAI,MAAM,cAAc,SAAS;AAC/B,WAAO;AAAA,MACL,WAAW;AAAA,MACX,SAAS,MAAM;AAAA,MACf,MAAM,MAAM,OAAO,CAAC,GAAG,MAAM,IAAI,IAAI;AAAA,MACrC,KAAK,MAAM;AAAA,MACX,KAAK,MAAM;AAAA,IACb;AAAA,EACF;AACA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,aAAa,MAAM;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,MAAM,MAAM,QAAQ,EAAE,MAAM,OAAO;AAAA,EACrC;AACF;AAMA,IAAM,8BAAgC,eAAa,oBAAoB;AAEvE,IAAM,gCAAgC,CAAC,4BAAwD;AAC7F,QAAM,iCACJ,4BAA4B,YAAY,qBAAqB,CAAC;AAEhE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY;AAAA,MACV,GAAG,4BAA4B;AAAA,MAC/B,mBACE,4BAA4B,SACxB,iCACA;AAAA,MACN,SAAS,EAAE,OAAO,MAAM;AAAA,IAC1B;AAAA,IACA,UACE,4BAA4B,SAAY,CAAC,SAAS,IAAI,CAAC,WAAW,mBAAmB;AAAA,EACzF;AACF;AAKA,IAAM,YAAY,CAAC,UAAyC;AAC1D,QAAM,cAAc,MAAM,aAAa,oBAAoB;AAC3D,QAAM,QAAsB;AAAA,IAC1B,UAAU,MAAM;AAAA,IAChB,GAAI,MAAM,cAAc,EAAE,UAAU,MAAM,YAAY,IAAI,CAAC;AAAA,EAC7D;AACA,QAAM,cAAkC;AAAA,IACtC,kBAAkB;AAAA,IAClB,GAAI,cAAc,EAAE,qBAAqB,MAAM,aAAa,SAAS,MAAM,SAAS,IAAI,CAAC;AAAA,IACzF,KAAK;AAAA,EACP;AACA,SAAO;AAAA,IACL,MAAM,SAAS,KAAK,MAAM,MAAM;AAAA,IAChC,aAAa,MAAM,eAAe,aAAa,MAAM,QAAQ;AAAA,IAC7D,aAAa,MAAM;AAAA,IACnB,cAAc,8BAA8B,MAAM,YAAY;AAAA,IAC9D;AAAA,EACF;AACF;AAEA,IAAM,iBAAiBA,QAAO,OAAO,EAAE,MAAMA,QAAO,QAAQ,MAAM,GAAG,MAAMA,QAAO,OAAO,CAAC;AAC1F,IAAM,sBAAsBA,QAAO,OAAO;AAAA,EACxC,SAASA,QAAO,SAASA,QAAO,OAAO;AAAA,EACvC,SAASA,QAAO,SAASA,QAAO,MAAMA,QAAO,OAAO,CAAC;AACvD,CAAC;AAED,IAAM,uBAAuBA,QAAO,oBAAoB,cAAc;AACtE,IAAM,4BAA4BA,QAAO,oBAAoB,mBAAmB;AAEhF,IAAM,yBAAyB,CAAC,YAA6B;AAC3D,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,eAAW,QAAQ,SAAS;AAC1B,YAAM,UAAUC,QAAO,eAAe,qBAAqB,IAAI,CAAC;AAChE,UAAI,YAAY,UAAa,QAAQ,KAAK,SAAS,EAAG,QAAO,QAAQ;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAIA,IAAM,kBAAkB,CAAC,KAAU,UAA2B;AAC5D,QAAM,KAAK,IAAI,OAAO,kBAAkB,KAAK,mBAAmB,GAAG;AACnE,SAAO,GAAG,KAAK,IAAI,QAAQ,KAAK,GAAG,KAAK,IAAI,QAAQ;AACtD;AAIO,IAAM,yBAAyB,CACpC,UACW;AACX,MAAI,MAAM,SAAS,eAAe;AAChC,WAAO;AAAA,EACT;AACA,SAAO,MAAM,MAAM,MAAM,QAAQ,EAAE;AAAA,IACjC,MAAM;AAAA,MACJ;AAAA,MACA,MACE;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,MACE;AAAA,IACJ;AAAA,IACA,MAAM;AAAA,EACR;AACF;AASA,IAAM,oBAAoB,CAAC,iBAA8C;AAAA,EACvE,IAAI,cAAc;AAChB,WAAO;AAAA,EACT;AAAA,EACA,IAAI,iBAAiB;AACnB,WAAO;AAAA,MACL,eAAe,CAAC,iCAAiC;AAAA,MACjD,aAAa,CAAC,sBAAsB,eAAe;AAAA,MACnD,gBAAgB,CAAC,MAAM;AAAA,MACvB,4BAA4B;AAAA,MAC5B,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,mBAAmB,MAAM;AAAA,EACzB,uBAAuB,MAAM;AAAA,EAC7B,QAAQ,OAAO,EAAE,cAAc,aAAa,YAAY,SAAS;AAAA,EACjE,YAAY,MAAM;AAAA,EAClB,yBAAyB,YAAY;AAEnC,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAAA,EACA,kBAAkB,MAAM;AAAA,EACxB,cAAc,MAAM;AAElB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAAA,EACA,oBAAoB,MAAM;AAAA,EAC1B,gBAAgB,MAAM;AACxB;AAOA,IAAM,sBAAsB,CAC1B,QACA,OACA,eACsD;AACtD,MAAI,OAAO,cAAc,SAAS;AAChC,QAAI,CAAC,YAAY;AACf,aAAOC,QAAO;AAAA,QACZ,IAAI,mBAAmB;AAAA,UACrB,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAOA,QAAO,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd,CAAqC;AAAA,EACvC;AAEA,QAAM,UAAkC,EAAE,GAAI,OAAO,WAAW,CAAC,EAAG;AACpE,MAAI;AAEJ,QAAM,OAAO,OAAO;AACpB,MAAI,KAAK,SAAS,YAAY,UAAU,MAAM;AAC5C,YAAQ,KAAK,UAAU,IAAI,KAAK,SAAS,GAAG,KAAK,MAAM,GAAG,KAAK,KAAK;AAAA,EACtE,WAAW,KAAK,SAAS,YAAY,UAAU,MAAM;AACnD,mBAAe,kBAAkB,KAAK;AAAA,EACxC;AAEA,SAAOA,QAAO,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,UAAU,OAAO;AAAA,IACjB,iBAAiB,OAAO,mBAAmB;AAAA,IAC3C,aACE,OAAO,eAAe,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,IAC3D,OAAO,cACP;AAAA,IACN,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AAAA,IACrD;AAAA,EACF,CAAC;AACH;AAkBO,IAAM,yBAAyB,CACpC,WACoC;AACpC,QAAM,SAAS,0BAA0B,OAAO,MAAM;AACtD,MAAI,CAAC,UAAU,OAAO,cAAc,QAAS,QAAO,CAAC;AAErD,QAAM,OAAO,OAAO;AACpB,MAAI,KAAK,SAAS,QAAQ;AACxB,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,MAAM;AAAA,QACN,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,MAAM;AAAA,QACN,UAAU;AAAA,QACV,YAAY,CAAC,EAAE,SAAS,UAAU,MAAM,KAAK,YAAY,QAAQ,KAAK,UAAU,GAAG,CAAC;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,MAAM;AAAA,QACN,UAAU;AAAA,QACV,OAAO,EAAE,cAAc,OAAO,UAAU,6BAA6B,KAAK;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEO,IAAM,gCAAgC,CAC3C,WAC8B;AAC9B,QAAM,SAAS,0BAA0B,OAAO,MAAM;AACtD,MAAI,CAAC,UAAU,OAAO,cAAc,QAAS,QAAO,CAAC;AACrD,SAAO,EAAE,KAAK,OAAO,SAAS;AAChC;AAiBO,IAAM,YAAY,aAAa,CAAC,YAA+B;AACpE,QAAM,aAAa,SAAS,4BAA4B;AAExD,QAAM,iBACJ,aACI,aACA,WAAW,OAAO,CAAC,WAAW,EAAE,eAAe,UAAU,OAAO,cAAc,QAAQ,GAC1F,IAAI,CAAC,YAAY;AAAA,IACjB,IAAI,OAAO;AAAA,IACX,MAAM,OAAO;AAAA,IACb,SAAS,OAAO;AAAA,IAChB,GAAI,SAAS,UAAU,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,IAC3D,GAAI,cAAc,UAAU,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,IAC/E,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,IAC3C,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,IACvD,WAAY,eAAe,UAAU,OAAO,cAAc,UAAU,UAAU;AAAA,IAG9E,GAAI,aAAa,SAAS,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;AAAA,IACzD,GAAI,UAAU,UAAU,OAAO,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,IAAI,CAAC;AAAA,IACpE,GAAI,SAAS,UAAU,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;AAAA,EAC7D,EAAE;AAEF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,oBAAoB;AAAA;AAAA;AAAA,IAGpB,cAAc,EAAE,WAAW;AAAA,IAC3B,SAAS,OAAO,CAAC;AAAA,IAEjB,WAAW,CAAC,QAAmB;AAC7B,YAAM,kBAAkB,SAAS,mBAAmB,IAAI;AAExD,YAAM,gBAAgB,CAAC,UACrBA,QAAO,IAAI,aAAa;AACtB,cAAM,WAAW,OAAO,UAAU,WAAW,QAAQ,MAAM;AAC3D,cAAM,UAAU,SAAS,KAAK;AAC9B,YAAI,CAAC,SAAS;AACZ,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAEA,cAAM,OAAO,OAAOA,QAAO,IAAI;AAAA,UAC7B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;AAAA,UAC5B,OAAO,MAAM;AAAA,QACf,CAAC,EAAE,KAAKA,QAAO,cAAc,MAAM,KAAK,CAAC;AACzC,cAAM,OAAO,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAErD,cAAM,eAAe,OAAO,UAAU,WAAW,SAAY,MAAM;AACnE,cAAM,mBAAmB,OAAO,UAAU,WAAW,SAAY,MAAM;AAEvE,cAAM,YAAY,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AAED,cAAM,SAAS,OAAO,cAAc,SAAS,EAAE;AAAA,UAC7CA,QAAO,IAAI,CAAC,OAAO,EAAE,IAAI,MAAe,UAAU,EAAE,EAAE;AAAA,UACtDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,UAAU,KAAK,CAAC,CAAC;AAAA,UACzEA,QAAO,SAAS,2BAA2B;AAAA,QAC7C;AAEA,YAAI,OAAO,MAAM,OAAO,UAAU;AAChC,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,wBAAwB;AAAA,YACxB,eAAe;AAAA,YACf,6BAA6B;AAAA,YAC7B,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,YACtC;AAAA,YACA,WAAW,OAAO,SAAS,MAAM;AAAA,YACjC,YAAY,OAAO,SAAS,QAAQ,QAAQ;AAAA,UAC9C;AAAA,QACF;AAKA,cAAM,QAAQ,OAAO,sBAAsB,SAAS;AAAA,UAClD;AAAA,UACA,SAAS;AAAA,UACT,aAAa;AAAA,QACf,CAAC;AACD,YAAI,MAAM,SAAS,OAAO;AACxB,iBAAO,OAAO,IAAI,mBAAmB;AAAA,YACnC,WAAW;AAAA,YACX,SAAS,uBAAuB,KAAK;AAAA,UACvC,CAAC;AAAA,QACH;AAEA,cAAM,cAAc,OAAO,IAAI,MAAM,MAAM,EAAE,KAAK,QAAQ,CAAC,EAAE;AAAA,UAC3DA,QAAO,IAAI,CAAC,WAAW,EAAE,IAAI,MAAe,MAAM,EAAE;AAAA,UACpDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,OAAO,KAAK,CAAC,CAAC;AAAA,UACtEA,QAAO,SAAS,wBAAwB;AAAA,QAC1C;AAEA,YAAI,YAAY,IAAI;AAClB,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,wBAAwB;AAAA,YACxB,eAAe;AAAA,YACf,6BAA6B,YAAY,MAAM,wBAAwB;AAAA,YACvE;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,YAAY;AAAA,UACd;AAAA,QACF;AAEA,YAAI,MAAM,cAAc;AACtB,iBAAO;AAAA,YACL,WAAW;AAAA,YACX,wBAAwB;AAAA,YACxB,eAAe;AAAA,YACf,6BAA6B;AAAA,YAC7B;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,YAAY;AAAA,UACd;AAAA,QACF;AAEA,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,gBAAgB,OAAO,UAAU,WAAW,QAAQ,MAAM,SAAS;AAAA,QACnF,CAAC;AAAA,MACH;AAEF,YAAM,YAAY,CAAC,UACjBA,QAAO,IAAI,aAAa;AACtB,cAAM,OAAO,cAAc,KAAK;AAChC,cAAM,SAAS,oBAAoB,KAAK;AAOxC,cAAM,WAAW,OAAO,IAAI,KAAK,aAAa,IAAI,SAAS,IAAI,CAAC;AAChE,YAAI,UAAU;AACZ,iBAAO,OAAO,IAAI,8BAA8B,EAAE,MAAM,SAAS,IAAI,EAAE,CAAC;AAAA,QAC1E;AAEA,eAAO,IAAI,KAAK,aACb,SAAS;AAAA,UACR,MAAM,SAAS,IAAI;AAAA,UACnB,aAAa,MAAM;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,UACX,YAAY;AAAA,QACd,CAAC,EACA;AAAA,UACCA,QAAO,SAAS,mCAAmC;AAAA,YACjD,YAAY,EAAE,wBAAwB,KAAK;AAAA,UAC7C,CAAC;AAAA,QACH;AACF,eAAO,EAAE,KAAK;AAAA,MAChB,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY;AAAA,YACV,wBAAwB,MAAM,aAAa;AAAA,YAC3C,mBAAmB,MAAM;AAAA,UAC3B;AAAA,QACF,CAAC;AAAA,MACH;AAEF,YAAM,eAAe,CAAC,SACpBA,QAAO,IAAI,aAAa;AACtB,cAAM,cAAc,SAAS,IAAI;AACjC,cAAM,SAAS,OAAO,IAAI,KAAK,aAAa,IAAI,WAAW;AAC3D,cAAM,SAAS,SAAS,0BAA0B,OAAO,MAAM,IAAI;AACnE,cAAM,mBAAmB,gCAAgC,MAAM,MAAM;AACrE,cAAM,cAAc,OAAO,IAAI,YAAY,KAAK,EAAE,YAAY,CAAC;AAC/D,cAAM,iBAAiB,OAAO,IAAI,YAAY,KAAK;AACnD,cAAM,uBAAuB,OAAO,IAAI,MAAM,YAAY;AAC1D,cAAM,gBAAgB,IAAI;AAAA,UACxB,eACG,OAAO,CAAC,eAAe,OAAO,WAAW,WAAW,MAAM,OAAO,WAAW,CAAC,EAC7E;AAAA,YAAQ,CAAC,eACR,WAAW,eAAe,OACtB,CAAC,IACD;AAAA,cACE;AAAA,gBACE,WAAW,oBAAoB,WAAW;AAAA,gBAC1C,WAAW;AAAA,cACb;AAAA,YACF;AAAA,UACN;AAAA,QACJ;AACA,cAAM,oBAAoB,IAAI;AAAA,UAC5B,qBAAqB,IAAI,CAAC,WAAW;AAAA,YACnC,eAAe,OAAO,OAAO,OAAO,IAAI;AAAA,YACxC;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM,kBAAkB,oBAAI,IAG1B;AAEF,mBAAW,cAAc,aAAa;AACpC,cAAI,WAAW,eAAe,KAAM;AACpC,gBAAM,QAAQ,WAAW,oBAAoB,WAAW;AACxD,gBAAM,MAAM,eAAe,OAAO,WAAW,WAAW;AACxD,gBAAM,SAAS,kBAAkB,IAAI,GAAG;AACxC,cAAI,QAAQ,OAAO,SAAS,8BAA+B;AAC3D,0BAAgB,IAAI,KAAK;AAAA,YACvB;AAAA,YACA,MAAM,WAAW;AAAA,UACnB,CAAC;AAAA,QACH;AACA,mBAAW,UAAU,sBAAsB;AACzC,gBAAM,MAAM,eAAe,OAAO,OAAO,OAAO,IAAI;AACpD,cAAI,cAAc,IAAI,GAAG,EAAG;AAC5B,cACE,OAAO,OAAO,SAAS,kCACtB,OAAO,OAAO,eAAe,QAAQ,OAAO,OAAO,OAAO,WAAW,MAAM,OAC5E;AACA,4BAAgB,IAAI,KAAK,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,KAAK,CAAC;AACnE;AAAA,UACF;AACA,cAAI,uBAAuB,QAAQ,kBAAkB,MAAM,GAAG;AAC5D,4BAAgB,IAAI,KAAK,EAAE,OAAO,OAAO,OAAO,MAAM,OAAO,KAAK,CAAC;AAAA,UACrE;AAAA,QACF;AAEA,eAAO,IAAI,KAAK,aACb,OAAO,WAAW,EAClB,KAAKA,QAAO,SAAS,qCAAqC,MAAMA,QAAO,IAAI,CAAC;AAE/E,eAAOA,QAAO;AAAA,UACZ,gBAAgB,OAAO;AAAA,UACvB,CAAC,WAAW,IAAI,MAAM,aAAa,OAAO,OAAO,OAAO,IAAI;AAAA,UAC5D,EAAE,SAAS,KAAK;AAAA,QAClB;AAAA,MACF,CAAC,EAAE;AAAA,QACDA,QAAO,SAAS,4BAA4B;AAAA,UAC1C,YAAY,EAAE,wBAAwB,KAAK;AAAA,QAC7C,CAAC;AAAA,MACH;AAEF,YAAM,YAAY,CAAC,SACjB,IAAI,KAAK,aAAa,IAAI,SAAS,IAAI,CAAC,EAAE;AAAA,QACxCA,QAAO,SAAS,yBAAyB;AAAA,UACvC,YAAY,EAAE,wBAAwB,KAAK;AAAA,QAC7C,CAAC;AAAA,MACH;AAEF,YAAM,kBAAkB,CAAC,MAAc,WACrC,IAAI,KAAK,aAAa,OAAO,SAAS,IAAI,GAAG,EAAE,OAAO,CAAC,EAAE;AAAA,QACvDA,QAAO,SAAS,+BAA+B;AAAA,UAC7C,YAAY,EAAE,wBAAwB,KAAK;AAAA,QAC7C,CAAC;AAAA,MACH;AAEF,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUA,cAAc,CAAC,EAAE,QAAQ,YAAY,SAAS,MAC5CA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,0BAA0B,MAAM;AAC/C,UAAI,CAAC,OAAQ,QAAO,EAAE,OAAO,CAAC,EAAwB;AAEtD,YAAM,QAAQ,OAAO,SAAS,EAAE,KAAKA,QAAO,cAAc,MAAM,IAAI,CAAC;AAErE,YAAM,QAAQ,OAAO,oBAAoB,QAAQ,OAAO,UAAU,EAAE;AAAA,QAClEA,QAAO,IAAI,CAAC,OAAO,mBAAmB,EAAE,CAAC;AAAA,QACzCA,QAAO;AAAA,MACT;AAEA,YAAM,WAAW,OAAO,UAAU,KAAK,IACnC,OAAO,cAAc,MAAM,OAAO,EAAE;AAAA,QAClCA,QAAO,IAAI,CAAC,OAAO,EAAE,IAAI,MAAe,UAAU,EAAE,EAAE;AAAA,QACtDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,EAAE,IAAI,OAAgB,UAAU,KAAK,CAAC,CAAC;AAAA,QACzEA,QAAO,SAAS,6BAA6B;AAAA,UAC3C,YAAY,EAAE,uBAAuB,OAAO,WAAW,IAAI,EAAE;AAAA,QAC/D,CAAC;AAAA,MACH,IACA,EAAE,IAAI,OAAgB,UAAU,KAAK;AAEzC,YAAM,UAAU,SAAS,MAAM,SAAS,WAAW,SAAS,SAAS,QAAQ,CAAC;AAC9E,aAAO,EAAE,OAAO,QAAQ,IAAI,SAAS,EAAE;AAAA,IACzC,CAAC,EAAE;AAAA,MACDA,QAAO,SAAS,4BAA4B;AAAA,QAC1C,YAAY,EAAE,uBAAuB,OAAO,WAAW,IAAI,EAAE;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,IAEF,YAAY,CAAC,EAAE,SAAS,YAAY,MAAM,OAAO,MAC/CA,QAAO,IAAI,aAAa;AACtB,YAAM,SAAS,0BAA0B,WAAW,MAAM;AAC1D,UAAI,CAAC,QAAQ;AACX,eAAO,OAAO,IAAI,mBAAmB;AAAA,UACnC,WAAW;AAAA,UACX,SAAS,oBAAoB,QAAQ,WAAW;AAAA,QAClD,CAAC;AAAA,MACH;AAEA,YAAM,QAAQ,UAAU,QAAQ,WAAW;AAC3C,UAAI,CAAC,OAAO;AACV,eAAO,OAAO,IAAI,sBAAsB;AAAA,UACtC,OAAO;AAAA,UACP,SAAS,SAAS,QAAQ,IAAI;AAAA,QAChC,CAAC;AAAA,MACH;AAEA,YAAM,YACJ,OAAO,cAAc,UAAU,UAAW,OAAO,mBAAmB;AAEtE,YAAM,YAA0B,OAAO;AAAA,QACrC;AAAA,QACA,WAAW;AAAA,QACX;AAAA,MACF,EAAE,KAAKA,QAAO,IAAI,CAAC,OAAO,mBAAmB,EAAE,CAAC,CAAC;AAEjD,YAAM,MAAM,OAAO,cAAc;AAAA,QAC/B,QAAQ,OAAO,QAAQ,IAAI;AAAA,QAC3B,UAAU,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,WAAWD,QAAO,eAAe,0BAA0B,GAAG,CAAC;AACrE,UAAI,UAAU,YAAY,MAAM;AAC9B,eAAO,WAAW,KAAK;AAAA,UACrB,MAAM;AAAA,UACN,SAAS,uBAAuB,SAAS,OAAO;AAAA,UAChD,SAAS,EAAE,SAAS,SAAS,QAAQ;AAAA,QACvC,CAAC;AAAA,MACH;AACA,aAAO,WAAW,GAAG,GAAG;AAAA,IAC1B,CAAC,EAAE;AAAA,MACDC,QAAO;AAAA,QAAS;AAAA,QAAsB,CAAC,EAAE,QAAQ,MAC/CA,QAAO;AAAA,UACL,gBAAgB;AAAA,YACd,MAAM;AAAA,YACN;AAAA,YACA,QAAQ,EAAE,IAAI,OAAO,WAAW,WAAW,EAAE;AAAA,YAC7C,YAAY,EAAE,MAAM,YAAY,OAAO,OAAO,WAAW,UAAU,EAAE;AAAA,UACvE,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACAA,QAAO,SAAS,0BAA0B;AAAA,QACxC,YAAY;AAAA,UACV,iBAAiB,OAAO,QAAQ,IAAI;AAAA,UACpC,wBAAwB,OAAO,QAAQ,WAAW;AAAA,QACpD;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IAEF,QAAQ,CAAC,EAAE,KAAK,IAAI,MAClBA,QAAO,IAAI,aAAa;AACtB,YAAM,kBAAkB,SAAS,mBAAmB,IAAI;AACxD,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,SAAS,OAAOA,QAAO,IAAI;AAAA,QAC/B,KAAK,MAAM,IAAI,IAAI,OAAO;AAAA,QAC1B,OAAO,CAAC,UAAU;AAAA,MACpB,CAAC,EAAE,KAAKA,QAAO,MAAM;AACrB,UAAID,QAAO,OAAO,MAAM,EAAG,QAAO;AAElC,YAAM,OAAO,OAAO,MAAM,YAAY;AACtC,YAAM,OAAO,mBAAmB,EAAE,UAAU,QAAQ,CAAC;AAErD,YAAM,YAAY,mBAAmB,EAAE,WAAW,UAAU,UAAU,QAAQ,CAAC;AAE/E,YAAM,YAAY,OAAO,cAAc,SAAS,EAAE;AAAA,QAChDC,QAAO,IAAI,MAAM,IAAI;AAAA,QACrBA,QAAO,MAAM,MAAMA,QAAO,QAAQ,KAAK,CAAC;AAAA,QACxCA,QAAO,SAAS,2BAA2B;AAAA,MAC7C;AAEA,UAAI,WAAW;AACb,eAAO;AAAA,UACL,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,sBAAsB,SAAS,EAAE,gBAAgB,CAAC;AACvE,UAAI,MAAM,SAAS,OAAO;AACxB,eAAO;AAAA,UACL,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAIA,UAAI,gBAAgB,OAAO,OAAO,KAAK,GAAG;AACxC,eAAO;AAAA,UACL,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,UAAU;AAAA,UACV;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,IACT,CAAC,EAAE;AAAA,MACDA,QAAO,MAAM,MAAMA,QAAO,QAAQ,IAAI,CAAC;AAAA,MACvCA,QAAO,SAAS,qBAAqB;AAAA,QACnC,YAAY,EAAE,gBAAgB,IAAI;AAAA,MACpC,CAAC;AAAA,IACH;AAAA;AAAA;AAAA,IAIF,oBAAoB,CAAC,EAAE,SAAS,MAC9BA,QAAO,KAAK,MAAM;AAChB,YAAM,MAAuC,CAAC;AAC9C,iBAAW,OAAO,UAAU;AAC1B,cAAM,QAAQ,UAAU,IAAI,WAAW;AACvC,cAAM,MAAM,OAAO;AACnB,YAAI,KAAK,oBAAoB,MAAM;AACjC,cAAI,OAAO,IAAI,IAAI,CAAC,IAAI;AAAA,YACtB,kBAAkB;AAAA,YAClB,qBAAqB,IAAI,SAAS,OAAO,YAAY,OAAO,IAAI,IAAI;AAAA,UACtE;AAAA,QACF,OAAO;AACL,cAAI,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,kBAAkB,MAAM;AAAA,QACpD;AAAA,MACF;AACA,aAAO;AAAA,IACT,CAAC;AAAA,IAEH,qBAAqB;AAAA,IACrB,4BAA4B;AAAA,IAE5B,sBAAsB;AAAA,MACpB,MAAM;AAAA,MACN,WAAW,CAAC,EAAE,KAAK,aAAa,OAAO,MACrCA,QAAO,IAAI,aAAa;AACtB,cAAM,OAAO,0BAA0B,MAAM;AAC7C,YAAI,CAAC,KAAM;AACX,eAAO,IAAI,KAAK,aAAa,OAAO,aAAa,EAAE,QAAQ,KAAK,CAAC;AAAA,MACnE,CAAC;AAAA,IACL;AAAA,IAEA,eAAe,CAAC,SAAS;AAAA,MACvB;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO;AAAA,UACL,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,YACb,cAAc;AAAA,YACd,SAAS,CAAC,UACR,KAAK,cAAc,KAA8B,EAAE;AAAA,cACjDA,QAAO,IAAI,WAAW,EAAE;AAAA,cACxBA,QAAO;AAAA,gBAAS;AAAA,gBAAsB,CAAC,EAAE,SAAS,UAAU,MAC1DA,QAAO,QAAQ,eAAe,yBAAyB,SAAS,EAAE,UAAU,CAAC,CAAC;AAAA,cAChF;AAAA,YACF;AAAA,UACJ,CAAC;AAAA,UACD,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,YACb,cAAc;AAAA,YACd,SAAS,CAAC,UAAU;AAClB,oBAAM,OAAO;AACb,qBAAOA,QAAO;AAAA,gBAAI,KAAK,UAAU,KAAK,IAAI;AAAA,gBAAG,CAAC,gBAC5C,WAAW,GAAG,EAAE,YAAY,CAAC;AAAA,cAC/B;AAAA,YACF;AAAA,UACF,CAAC;AAAA,UACD,KAAK;AAAA,YACH,MAAM;AAAA,YACN,aACE;AAAA,YACF,aAAa;AAAA,cACX,kBAAkB;AAAA,cAClB,qBAAqB;AAAA,YACvB;AAAA,YACA,aAAa;AAAA,YACb,cAAc;AAAA,YACd,SAAS,CAAC,aAAa;AACrB,oBAAM,QAAQ;AACd,qBAAO,KAAK,UAAU,KAAuB,EAAE;AAAA,gBAC7CA,QAAO,IAAI,WAAW,EAAE;AAAA,gBACxBA,QAAO;AAAA,kBACL;AAAA,kBACA,CAAC,EAAE,KAAK,MACNA,QAAO;AAAA,oBACL;AAAA,sBACE;AAAA,sBACA,eAAe,IAAI;AAAA,oBACrB;AAAA,kBACF;AAAA,gBACJ;AAAA,cACF;AAAA,YACF;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;","names":["tool","Effect","Option","Schema","Effect","Effect","Effect","Option","Schema","Schema","Option","Effect","Effect","Option","Schema","Schema","Option","Effect"]}